Merge branch 'main' into mh-add-check-all

Author: mhucka

.github/actionlint.yaml

@@ -12,8 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# Summary: configure actionlint (https://github.com/rhysd/actionlint).
+
 self-hosted-runner:
-  # We don't have self-hosted runners, but we do use some of the "partner"
-  # runner images at https://github.com/actions/partner-runner-images
+  # We use some custom runners and also some GitHub runners from
+  # https://github.com/actions/partner-runner-images
   labels:
     - ubuntu-24.04-arm
+    - ubuntu-slim
+    - ubuntu-24.04-x64-8-core

.github/workflows/ci.yaml

@@ -118,9 +118,6 @@ jobs:
       docker: ${{steps.filter.outputs.docker || steps.filter.outputs.ci}}
       docker_files: ${{steps.filter.outputs.docker_files}}
 
-      requirements: ${{steps.filter.outputs.requirements || steps.filter.outputs.ci}}
-      requirements_files: ${{steps.filter.outputs.requirements_files}}
-
       shell: ${{steps.filter.outputs.shell || steps.filter.outputs.ci}}
       shell_files: ${{steps.filter.outputs.shell_files}}
     steps:
@@ -129,27 +126,28 @@ jobs:
         name: Use the user-provided SHA as the basis for comparison
         env:
           GH_TOKEN: ${{github.token}}
+          INPUTS_SHA: ${{inputs.sha}}
         run: |
           set -x +e
-          url="repos/${{github.repository}}/commits/${{inputs.sha}}"
-          if full_sha="$(gh api $url -q '.sha')"; then
+          url="repos/${{github.repository}}/commits/${INPUTS_SHA}"
+          if full_sha="$(gh api "$url" -q '.sha')"; then
             echo "base=$full_sha" >> "$GITHUB_ENV"
           else
             {
             echo "### :x: Workflow error"
             echo "The SHA provided to _Run Workflow_ does not exist:"
-            echo "<code>${{inputs.sha}}</code>"
+            echo "<code>${INPUTS_SHA}</code>"
             } >> "$GITHUB_STEP_SUMMARY"
             exit 1
           fi
 
       - if: github.event_name != 'workflow_dispatch'
         name: Use ref ${{github.ref_name}} as the basis for comparison
         run: |
-          echo base=${{github.ref_name}} >> "$GITHUB_ENV"
+          echo base="${GITHUB_REF_NAME}" >> "$GITHUB_ENV"
 
       - name: Check out a copy of the OpenFermion git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Determine files changed by this ${{github.event_name}} event
         uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
@@ -169,6 +167,12 @@ jobs:
                   - '**/CITATION.cff'
             python:
               - '**/*.py'
+              - 'dev_tools/conf/**'
+              - 'dev_tools/requirements/deps/*.txt'
+              - 'dev_tools/requirements/env/*.txt'
+              - 'dev_tools/requirements/max_compat/*.txt'
+              - 'docs/**/*-requirements.txt'
+              - 'docs/**/requirements.txt'
             gha:
               - added|modified:
                   - './.github/workflows/*.yaml'
@@ -183,10 +187,6 @@ jobs:
             docker:
               - '**/dockerfile'
               - '**/Dockerfile'
-            requirements:
-              - 'dev_tools/requirements/deps/*.txt'
-              - 'docs/**/*-requirements.txt'
-              - 'docs/**/requirements.txt'
             shell:
               - '**/*.sh'
               - 'check/*'
@@ -199,10 +199,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python with caching of pip dependencies
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{inputs.python_ver || env.python_ver}}
           architecture: 'x64'
@@ -228,12 +228,12 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Set up Python and restore cache
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{inputs.python_ver || env.python_ver}}
           architecture: 'x64'
@@ -257,10 +257,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python and restore cache
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{inputs.python_ver || env.python_ver}}
           architecture: 'x64'
@@ -284,10 +284,10 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python and restore cache
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{inputs.python_ver || env.python_ver}}
           architecture: 'x64'
@@ -324,10 +324,10 @@ jobs:
       fail-fast: false
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python and restore cache
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{inputs.python_ver || env.python_ver}}
           cache: pip
@@ -351,12 +351,14 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - run: |
-          result="${{needs.pytest-matrix.result}}"
+          result="${NEEDS_PYTEST_MATRIX_RESULT}"
           if [[ $result == "success" || $result == "skipped" ]]; then
             exit 0
           else
             exit 1
           fi
+        env:
+          NEEDS_PYTEST_MATRIX_RESULT: ${{needs.pytest-matrix.result}}
 
   pytest-extra-matrix:
     if: needs.changes.outputs.python == 'true'
@@ -371,10 +373,10 @@ jobs:
       fail-fast: false
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python and restore cache
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{inputs.python_ver || env.python_ver}}
           cache: pip
@@ -398,12 +400,14 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - run: |
-          result="${{needs.pytest-extra-matrix.result}}"
+          result="${NEEDS_PYTEST_EXTRA_MATRIX_RESULT}"
           if [[ $result == "success" || $result == "skipped" ]]; then
             exit 0
           else
             exit 1
           fi
+        env:
+          NEEDS_PYTEST_EXTRA_MATRIX_RESULT: ${{needs.pytest-extra-matrix.result}}
 
   python-compat:
     if: needs.changes.outputs.python == 'true'
@@ -413,12 +417,12 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
         # Note: deliberately not using our Python cache here b/c this runs
         # a different version of Python.
       - name: Set up Python and restore cache
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{env.python_compat_ver}}
 
@@ -439,12 +443,12 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Set up Python and restore cache
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{inputs.python_ver || env.python_ver}}
           cache: pip
@@ -466,10 +470,10 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     env:
-      changed_files: ${{needs.changes.outputs.yaml_files}}
+      CHANGED_FILES: ${{needs.changes.outputs.yaml_files}}
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up yamllint output problem matcher
         run: echo "::add-matcher::.github/problem-matchers/yamllint.json"
@@ -478,7 +482,7 @@ jobs:
         run: |
           set -x
           # shellcheck disable=SC2086
-          yamllint $changed_files
+          yamllint ${CHANGED_FILES}
 
   json-lint:
     if: needs.changes.outputs.json == 'true'
@@ -487,10 +491,10 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     env:
-      changed_files: ${{needs.changes.outputs.json_files}}
+      CHANGED_FILES: ${{needs.changes.outputs.json_files}}
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install jsonlint
         run: npm install -g @prantlf/jsonlint
@@ -499,19 +503,19 @@ jobs:
         run: echo '::add-matcher::.github/problem-matchers/jsonlint.json'
 
       - name: Run jsonlint on JSON files
-        run: jsonlint --continue ${{env.changed_files}}
+        run: |
+          # shellcheck disable=SC2086
+          jsonlint --continue ${CHANGED_FILES}
 
   cff-validation:
     if: needs.changes.outputs.cff == 'true'
     name: CITATION.cff checks
     needs: changes
     runs-on: ubuntu-24.04
     timeout-minutes: 5
-    env:
-      changed_files: ${{needs.changes.outputs.cff_files}}
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install cffconvert
         run: pip install cffconvert
@@ -527,10 +531,10 @@ jobs:
     runs-on: macos-14
     timeout-minutes: 5
     env:
-      changed_files: ${{needs.changes.outputs.docker_files}}
+      CHANGED_FILES: ${{needs.changes.outputs.docker_files}}
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # Note: there is a hadolint GitHub Actions available, but it only accepts
       # one Dockerfile to check. We have > 1 file to check, so we need the CLI.
@@ -541,7 +545,9 @@ jobs:
         run: echo '::add-matcher::.github/problem-matchers/hadolint.json'
 
       - name: Run hadolint on Dockerfiles that have been changed
-        run: hadolint ${{env.changed_files}}
+        run: |
+          # shellcheck disable=SC2086
+          hadolint ${CHANGED_FILES}
 
   workflow-validation:
     if: needs.changes.outputs.gha == 'true'
@@ -550,15 +556,14 @@ jobs:
     # This uses a Mac runner because actionlint isn't available via Linux apt.
     runs-on: macos-14
     timeout-minutes: 5
-    env:
-      changed_files: ${{needs.changes.outputs.gha_files}}
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # The next action simply fails if there are any unpinned actions.
       - name: Verify that all workflow actions have pinned versions
-        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@9e9574ef04ea69da568d6249bd69539ccc704e74
+        # yamllint disable-line rule:line-length
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@70c4af2ed5282c51ba40566d026d6647852ffa3e # v5.0.1
 
       # If we didn't fail the previous check, go on to more time-consuming ones.
       - name: Install actionlint
@@ -577,25 +582,18 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     env:
-      changed_files: ${{needs.changes.outputs.shell_files}}
+      CHANGED_FILES: ${{needs.changes.outputs.shell_files}}
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up shellcheck output problem matcher
         run: echo "::add-matcher::.github/problem-matchers/shellcheck.json"
 
       - name: Run shellcheck on shell scripts that have been changed
-        run: shellcheck ${{env.changed_files}}
-
-  vulnerability-checks:
-    if: needs.changes.outputs.requirements == 'true'
-    name: Vulnerability checks
-    needs: changes
-    uses: ./.github/workflows/osv-scanner.yaml
-    permissions: write-all
-    with:
-      reason: CI
+        run: |
+          # shellcheck disable=SC2086
+          shellcheck ${CHANGED_FILES}
 
   print-debugging-info:
     if: failure()
@@ -604,10 +602,10 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Check out a copy of the git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python with caching of pip dependencies
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{inputs.python_ver || env.python_ver}}
           architecture: 'x64'

.github/workflows/nightly-pytest.yaml

@@ -74,10 +74,10 @@ jobs:
 
     steps:
       - name: Check out a copy of the OpenFermion git repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python ${{matrix.python-version}}
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         id: cache
         with:
           python-version: ${{matrix.python-version}}