Skip to content

Commit 31ba4de

Browse files
zerolabzerolab
committed
Pin actions to commit hashes
1 parent 6ac1e83 commit 31ba4de

2 files changed

Lines changed: 121 additions & 57 deletions

File tree

‎.github/workflows/publish.yml‎

Lines changed: 49 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,38 @@ on:
44
release:
55
types: [published]
66

7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.ref }}
9+
cancel-in-progress: true
10+
11+
permissions: {}
12+
713
jobs:
814
build:
15+
name: Build
916
runs-on: ubuntu-latest
1017
permissions:
1118
contents: read # to fetch code (actions/checkout)
1219
steps:
13-
- uses: actions/checkout@v4
20+
- name: Harden Runner
21+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
22+
with:
23+
disable-sudo: true
24+
egress-policy: block
25+
allowed-endpoints: >
26+
files.pythonhosted.org:443
27+
objects.githubusercontent.com:443
28+
github.com:443
29+
pypi.org:443
30+
api.github.com:443
31+
32+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1433
with:
1534
fetch-depth: 0
1635

17-
- uses: actions/setup-python@v5
36+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
1837
with:
1938
python-version: '3.14'
20-
cache: "pip"
21-
cache-dependency-path: "**/pyproject.toml"
2239

2340
- name: ⬇️ Install build dependencies
2441
run: |
@@ -27,25 +44,44 @@ jobs:
2744
- name: 🏗️ Build
2845
run: python -Im flit build
2946

30-
- uses: actions/upload-artifact@v4
47+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
3148
with:
3249
path: ./dist
3350

3451
# https://docs.pypi.org/trusted-publishers/using-a-publisher/
35-
pypi-publish:
36-
needs: build
37-
environment: 'publish'
38-
52+
publish-pypi:
3953
name: ⬆️ Upload release to PyPI
54+
environment: 'publish'
4055
runs-on: ubuntu-latest
56+
needs: build
57+
4158
permissions:
4259
# Mandatory for trusted publishing
4360
id-token: write
61+
4462
steps:
45-
- uses: actions/download-artifact@v4
63+
- name: 🔒 Harden Runner
64+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
65+
with:
66+
disable-sudo: true
67+
egress-policy: block
68+
allowed-endpoints: >
69+
github.com:443
70+
api.github.com:443
71+
ghcr.io:443
72+
pkg-containers.githubusercontent.com:443
73+
pypi.org:443
74+
upload.pypi.org:443
75+
files.pythonhosted.org:443
76+
fulcio.sigstore.dev:443
77+
rekor.sigstore.dev:443
78+
tuf-repo-cdn.sigstore.dev:443
79+
80+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
81+
with:
82+
path: dist
4683

4784
- name: 🚀 Publish package distributions to PyPI
48-
uses: pypa/gh-action-pypi-publish@release/v1
85+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
4986
with:
50-
packages-dir: artifact/
51-
print-hash: true
87+
attestations: true

‎.github/workflows/test.yml‎

Lines changed: 72 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
branches: [main]
88

99
concurrency:
10-
group: ${{ github.head_ref || github.run_id }}
10+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
1111
cancel-in-progress: true
1212

1313
permissions:
@@ -30,61 +30,89 @@ jobs:
3030
python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
3131

3232
steps:
33-
- uses: actions/checkout@v4
34-
35-
- name: 🐍 Set up Python ${{ matrix.python-version }}
36-
uses: actions/setup-python@v5
37-
with:
38-
python-version: ${{ matrix.python-version }}
39-
40-
- name: 🌍 Start dummy client
41-
uses: Eun/http-server-action@v1
42-
with:
43-
directory: ${{ github.workspace }}/wagtail_headless_preview/tests/client
44-
port: 8020
45-
no-cache: false
46-
content-types: |
47-
{
48-
"html": "text/html",
49-
"js": "text/javascript",
50-
"json": "application/json",
51-
"txt": "text/plain"
52-
}
53-
54-
- name: ⬇️ Install dependencies
55-
run: |
56-
python -Im pip install --upgrade pip setuptools wheel flit tox tox-gh-actions
57-
58-
- name: 🏗️ Build wheel
59-
run: python -Im flit build --format wheel
60-
61-
- name: 🧪 Run tox targets for Python ${{ matrix.python-version }}
62-
run: tox --installpkg ./dist/*.whl
63-
64-
- name: ⬆️ Upload coverage data
65-
uses: actions/upload-artifact@v4
66-
with:
67-
name: coverage-data-${{ matrix.python-version }}
68-
path: .coverage.*
69-
if-no-files-found: ignore
70-
include-hidden-files: true
71-
retention-days: 1
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
35+
with:
36+
disable-sudo: true
37+
egress-policy: block
38+
allowed-endpoints: >
39+
files.pythonhosted.org:443
40+
objects.githubusercontent.com:443
41+
github.com:443
42+
pypi.org:443
43+
api.github.com:443
44+
45+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
46+
with:
47+
persist-credentials: false
48+
49+
- name: 🐍 Set up Python ${{ matrix.python-version }}
50+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
51+
with:
52+
python-version: ${{ matrix.python-version }}
53+
54+
- name: 🌍 Start dummy client
55+
uses: Eun/http-server-action@dadebd209d4a902eeefceb524c24c38b364c46a7 # v1.0.13
56+
with:
57+
directory: ${{ github.workspace }}/wagtail_headless_preview/tests/client
58+
port: 8020
59+
no-cache: false
60+
content-types: |
61+
{
62+
"html": "text/html",
63+
"js": "text/javascript",
64+
"json": "application/json",
65+
"txt": "text/plain"
66+
}
67+
68+
- name: ⬇️ Install dependencies
69+
run: |
70+
python -Im pip install --upgrade pip setuptools wheel flit tox tox-gh-actions
71+
72+
- name: 🏗️ Build wheel
73+
run: python -Im flit build --format wheel
74+
75+
- name: 🧪 Run tox targets for Python ${{ matrix.python-version }}
76+
run: tox --installpkg ./dist/*.whl
77+
78+
- name: ⬆️ Upload coverage data
79+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
80+
with:
81+
name: coverage-data-${{ matrix.python-version }}
82+
path: .coverage.*
83+
if-no-files-found: ignore
84+
include-hidden-files: true
85+
retention-days: 1
7286

7387
coverage:
88+
name: Combine & check coverage.
7489
runs-on: ubuntu-latest
7590
needs: tests
7691

7792
steps:
78-
- uses: actions/checkout@v4
79-
- uses: actions/setup-python@v5
93+
- name: Harden Runner
94+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
95+
with:
96+
disable-sudo: true
97+
egress-policy: block
98+
allowed-endpoints: >
99+
files.pythonhosted.org:443
100+
objects.githubusercontent.com:443
101+
github.com:443
102+
pypi.org:443
103+
api.github.com:443
104+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
105+
with:
106+
persist-credentials: false
107+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
80108
with:
81109
# Use latest Python, so it understands all syntax.
82110
python-version: ${{env.PYTHON_LATEST}}
83111

84112
- run: python -Im pip install --upgrade coverage[toml]
85113

86114
- name: Download coverage data
87-
uses: actions/download-artifact@v4
115+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
88116
with:
89117
pattern: coverage-data-*
90118
merge-multiple: true
@@ -98,7 +126,7 @@ jobs:
98126
python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
99127
100128
- name: 📈 Upload HTML report if check failed.
101-
uses: actions/upload-artifact@v4
129+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
102130
with:
103131
name: html-report
104132
path: htmlcov

0 commit comments

Comments
 (0)