CI: Update concurrency, permissions and actions (#313)

* CI: Add concurrency and permissions sections

* CI: Update cache versions, do not use old Python for flake8

* Update .github/workflows/pythonpackage.yml

Author: effigies

.github/workflows/docs-build-pr.yml

@@ -5,13 +5,20 @@ on:
   pull_request:
     branches: [ master, 'maint/*' ]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     if: "(github.repository_owner != 'nipreps') && !contains(github.event.head_commit.message, '[skip ci]')"
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         fetch-depth: 0
 

.github/workflows/docs-build-update.yml

@@ -6,12 +6,16 @@ on:
     branches: [ 'doc/*', 'docs/*', master, "maint/*" ]
     tags: [ '*' ]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         ssh-key: "${{ secrets.NIPREPS_DEPLOY }}"
         fetch-depth: 0

.github/workflows/pythonpackage.yml

@@ -10,6 +10,13 @@ on:
   pull_request:
     branches: [ master, 'maint/*' ]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     if: "!startsWith(github.ref, 'refs/tags/') && !contains(github.event.head_commit.message, '[skip ci]')"
@@ -20,15 +27,15 @@ jobs:
         pip: ["pip==21.2", "pip~=22.0"]
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Fetch all tags (for setuptools_scm to work)
       run: |
         /usr/bin/git -c protocol.version=2 fetch --tags --prune --unshallow origin
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
-    - uses: actions/cache@v1
+    - uses: actions/cache@v3
       with:
         path: $HOME/.cache/pip
         key: pip-cache-v1
@@ -86,10 +93,10 @@ jobs:
   flake8:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python 3.7
-      uses: actions/setup-python@v1
+    - uses: actions/checkout@v3
+    - name: Set up Python 3
+      uses: actions/setup-python@v4
       with:
-        python-version: 3.7
+        python-version: 3
     - run: pip install flake8
     - run: flake8 sdcflows/

.github/workflows/unittests.yml

@@ -6,6 +6,13 @@ on:
   schedule:
     - cron: 0 0 * * 0
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build-linux:
     if: "!contains(github.event.head_commit.message, '[skip ci]' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != 'nipreps/sdcflows'))"
@@ -81,7 +88,7 @@ jobs:
         git config --global user.name 'NiPreps Bot'
         git config --global user.email '[email protected]'
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
     - uses: actions/cache@v3
@@ -97,7 +104,7 @@ jobs:
       run: |
         $CONDA/bin/conda install -c conda-forge git-annex datalad pip
         $CONDA/bin/pip install datalad-osf
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Install minimal dependencies
       timeout-minutes: 5
       run: |