pip-compile

Author: manics

.github/workflows/build.yml

@@ -50,6 +50,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: JupyterHub version
         id: version
@@ -75,7 +77,7 @@ jobs:
           allTags: ${{ (github.ref != format('refs/heads/{0}', env.LATEST_BRANCH)) && (github.base_ref != format('refs/heads/{0}', env.LATEST_BRANCH)) }}
           strict: "true"
 
-      - name: Get new tag
+      - name: Get new tag # zizmor: ignore[template-injection]
         id: new
         run: |
           echo "TAG=${{ steps.version.outputs.VERSION }}-${{ steps.quayio.outputs.buildNumber }}" >> $GITHUB_OUTPUT
@@ -95,6 +97,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Should we push this image to a public registry?
         run: |
@@ -106,8 +110,6 @@ jobs:
               echo "PUBLIC=false" >> $GITHUB_ENV
           fi
 
-      - uses: actions/checkout@v4
-
       # Setup docker to build for multiple platforms, see:
       # https://github.com/docker/build-push-action/tree/v6.9.0?tab=readme-ov-file#usage
       # https://docs.docker.com/build/ci/github-actions/multi-platform/
@@ -120,7 +122,7 @@ jobs:
           # Allows pushing to registry on localhost:5000
           driver-opts: network=host
 
-      - name: Setup push rights to Docker Hub
+      - name: Setup push rights to Docker Hub # zizmor: ignore[template-injection]
         # This was setup by...
         # 1. Creating a [Robot Account](https://quay.io/organization/jupyterhub?tab=robots) in the JupyterHub
         # .  Quay.io org
@@ -150,7 +152,7 @@ jobs:
             ${{ env.REGISTRY }}${{ env.IMAGE }}:
             ${{ (env.PUBLIC == 'true' && env.PUBLISH_DOCKERIO == 'true') && format('{0}:', env.IMAGE) || '' }}
 
-      - name: Print tags
+      - name: Print tags # zizmor: ignore[template-injection]
         run: |
           echo "Existing tags: ${{ needs.tag.outputs.existing-tags }}"
           echo "New tags: ${{ needs.tag.outputs.new-tag }}"

.pre-commit-config.yaml

@@ -14,7 +14,13 @@ ci:
   autoupdate_schedule: monthly
 
 repos:
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v4.0.0-alpha.8
+  # https://github.com/pre-commit/mirrors-prettier is not maintained
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.4.2
     hooks:
       - id: prettier
+
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v0.8.0
+    hooks:
+      - id: zizmor

base/requirements.txt

@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.11
+# This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
 #    pip-compile
@@ -10,19 +10,19 @@ annotated-types==0.7.0
     # via pydantic
 arrow==1.3.0
     # via isoduration
-attrs==24.2.0
+attrs==24.3.0
     # via
     #   jsonschema
     #   referencing
-certifi==2024.8.30
+certifi==2024.12.14
     # via requests
 certipy==0.2.1
     # via jupyterhub
 cffi==1.17.1
     # via cryptography
-charset-normalizer==3.4.0
+charset-normalizer==3.4.1
     # via requests
-cryptography==43.0.3
+cryptography==44.0.0
     # via certipy
 fqdn==1.5.1
     # via jsonschema
@@ -35,19 +35,19 @@ idna==3.10
     #   requests
 isoduration==20.11.0
     # via jsonschema
-jinja2==3.1.4
+jinja2==3.1.5
     # via jupyterhub
 jsonpointer==3.0.0
     # via jsonschema
 jsonschema[format-nongpl]==4.23.0
     # via jupyter-events
 jsonschema-specifications==2024.10.1
     # via jsonschema
-jupyter-events==0.10.0
+jupyter-events==0.11.0
     # via jupyterhub
 jupyterhub==5.2.1
     # via -r requirements.in
-mako==1.3.6
+mako==1.3.8
     # via alembic
 markupsafe==3.0.2
     # via
@@ -59,23 +59,23 @@ packaging==24.2
     # via jupyterhub
 pamela==1.2.0
     # via jupyterhub
-prometheus-client==0.21.0
+prometheus-client==0.21.1
     # via jupyterhub
 pycparser==2.22
     # via cffi
-pydantic==2.10.1
+pydantic==2.10.5
     # via jupyterhub
-pydantic-core==2.27.1
+pydantic-core==2.27.2
     # via pydantic
 python-dateutil==2.9.0.post0
     # via
     #   arrow
     #   jupyterhub
-python-json-logger==2.0.7
+python-json-logger==3.2.1
     # via jupyter-events
 pyyaml==6.0.2
     # via jupyter-events
-referencing==0.35.1
+referencing==0.36.0
     # via
     #   jsonschema
     #   jsonschema-specifications
@@ -90,15 +90,15 @@ rfc3986-validator==0.1.1
     # via
     #   jsonschema
     #   jupyter-events
-rpds-py==0.21.0
+rpds-py==0.22.3
     # via
     #   jsonschema
     #   referencing
-six==1.16.0
+six==1.17.0
     # via
     #   python-dateutil
     #   rfc3339-validator
-sqlalchemy==2.0.36
+sqlalchemy==2.0.37
     # via
     #   alembic
     #   jupyterhub
@@ -108,17 +108,18 @@ traitlets==5.14.3
     # via
     #   jupyter-events
     #   jupyterhub
-types-python-dateutil==2.9.0.20241003
+types-python-dateutil==2.9.0.20241206
     # via arrow
 typing-extensions==4.12.2
     # via
     #   alembic
     #   pydantic
     #   pydantic-core
+    #   referencing
     #   sqlalchemy
 uri-template==1.3.0
     # via jsonschema
-urllib3==2.2.3
+urllib3==2.3.0
     # via requests
 webcolors==24.11.1
     # via jsonschema