Skip to content

Commit 91e809f

Browse files
zerolabzerolab
authored
Pin GitHub Actions (#19)
1 parent 3fb2f40 commit 91e809f

8 files changed

Lines changed: 230 additions & 78 deletions

File tree

β€Ž.coveragercβ€Ž

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,16 @@
22
branch = True
33
concurrency = multiprocessing, thread
44
parallel = True
5-
source_pkgs = wagtailmath
6-
omit =
7-
**/migrations/*
8-
tests/*
5+
source = src/
6+
omit = **/migrations/*,tests/*
97

108
[paths]
11-
source =
12-
src/wagtailmath
13-
.tox/py*/**/site-packages
9+
source = src,.tox/py*/**/site-packages
1410

1511
[report]
1612
show_missing = True
1713
ignore_errors = True
14+
skip_empty = true
1815
skip_covered = True
1916

2017
# Regexes for lines to exclude from consideration

β€Ž.github/scripts/report_nightly_build_failure.pyβ€Ž

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,30 @@
11
"""
2-
Called by GH Actions when the nightly build fails.
2+
Called by GitHub Action when the nightly build fails.
33
44
This reports an error to the #nightly-build-failures Slack channel.
55
"""
66

77
import os
88

9-
import requests
9+
import urllib3
1010

1111

1212
if "SLACK_WEBHOOK_URL" in os.environ:
13+
# https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables
14+
repository = os.environ["GITHUB_REPOSITORY"]
15+
run_id = os.environ["GITHUB_RUN_ID"]
16+
url = f"https://github.com/{repository}/actions/runs/{run_id}"
17+
1318
print("Reporting to #nightly-build-failures slack channel")
14-
response = requests.post(
19+
20+
urllib3.request(
21+
"POST",
1522
os.environ["SLACK_WEBHOOK_URL"],
16-
json={
17-
"text": "A Nightly build failed. See https://github.com/wagtail-nest/wagtail-polymath/actions/runs/"
18-
+ os.environ["GITHUB_RUN_ID"],
19-
},
20-
timeout=30,
23+
json={"text": f"A Nightly build failed. See {url}"},
2124
)
2225

23-
print("Slack responded with:", response)
24-
2526
else:
2627
print(
27-
"Unable to report to #nightly-build-failures slack channel because SLACK_WEBHOOK_URL is not set"
28+
"Unable to report to #nightly-build-failures slack channel "
29+
"because SLACK_WEBHOOK_URL is not set"
2830
)

β€Ž.github/workflows/nightly.ymlβ€Ž

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,47 @@
1-
name: Nightly Wagtail Test
1+
name: Nightly Wagtail test
22

33
on:
44
schedule:
5-
- cron: '0 1 * * *'
6-
# At 01:00, daily
5+
# Weekly on Monday.
6+
- cron: "0 0 * * 1"
7+
78
workflow_dispatch:
89

9-
env:
10-
WEBHOOK_EXISTS: ${{ secrets.SLACK_WEBHOOK_URL != '' }}
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
permissions: {}
1115

1216
jobs:
13-
nightly-wagtail-test:
17+
nightly-test:
18+
name: Nightly tests against Wagtail main
19+
# Cannot check the existence of secrets, so limiting to repository name to prevent all forks to run nightly.
20+
# See: https://github.com/actions/runner/issues/520
21+
if: ${{ github.repository == 'wagtail-nest/wagtail-polymath' }}
1422
runs-on: ubuntu-latest
15-
if: ${{ vars.WEBHOOK_EXISTS }}
23+
permissions:
24+
contents: read # to fetch code (actions/checkout)
1625

1726
steps:
18-
- uses: actions/checkout@v4
19-
- uses: actions/setup-python@v5
27+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2028
with:
21-
python-version: '3.11'
22-
23-
- run: git clone https://github.com/wagtail/wagtail.git
24-
25-
- run: python -m pip install flit
26-
- run: flit install --deps production --extras testing
27-
- run: python -m pip install ./wagtail
28-
29-
- run: python tests/manage.py test
30-
31-
- name: Report failure
29+
persist-credentials: false
30+
- name: Set up Python
31+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
32+
with:
33+
python-version: "3.14"
34+
- name: Install dependencies
35+
run: |
36+
python -m pip install --upgrade pip tox "urllib3==2.6.3"
37+
- name: Test
38+
id: test
39+
continue-on-error: true
40+
run: tox -e wagtailmain
41+
42+
- name: Send Slack notification on failure
43+
if: steps.test.outcome == 'failure'
3244
run: |
33-
python -m pip install requests
34-
python ./.github/scripts/report_nightly_build_failure.py
35-
if: ${{ failure() && env.WEBHOOK_EXISTS == 'true' }}
45+
python .github/scripts/report_nightly_build_failure.py
3646
env:
3747
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

β€Ž.github/workflows/publish.ymlβ€Ž

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,46 +6,57 @@ on:
66
release:
77
types: [published]
88

9+
concurrency:
10+
group: ${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
12+
13+
permissions: {}
14+
915
jobs:
1016
build:
17+
name: πŸ—οΈ Build
1118
runs-on: ubuntu-latest
1219
permissions:
1320
contents: read # to fetch code (actions/checkout)
1421
steps:
15-
- uses: actions/checkout@v4
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1623
with:
1724
fetch-depth: 0
25+
persist-credentials: false
1826

19-
- name: Set up Python 3.11
20-
uses: actions/setup-python@v5
27+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2128
with:
22-
python-version: '3.11'
29+
python-version: '3.14'
2330

24-
- name: Install dependencies
31+
- name: ⬇️ Install build dependencies
2532
run: |
26-
python -m pip install --upgrade pip
27-
python -m pip install flit
33+
python -m pip install --upgrade pip flit
2834
python -m flit install --symlink
2935
30-
- name: Build
36+
- name: πŸ—οΈ Build
3137
run: python -m flit build
3238

33-
- uses: actions/upload-artifact@v4
39+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
3440
with:
3541
path: ./dist
3642

37-
publish:
38-
needs: build
43+
# https://docs.pypi.org/trusted-publishers/using-a-publisher/
44+
publish-pypi:
45+
name: ⬆️ Upload release to PyPI
46+
environment: 'publish'
47+
if: github.repository_owner == 'wagtail-nest' && github.event.action == 'published'
3948
runs-on: ubuntu-latest
49+
needs: build
50+
4051
permissions:
41-
contents: none
42-
id-token: write # required for trusted publishing
43-
environment: publish
52+
id-token: write # Mandatory for trusted publishing
53+
4454
steps:
45-
- uses: actions/download-artifact@v4
55+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
56+
with:
57+
path: dist
4658

47-
- name: Publish to PyPI
48-
uses: pypa/gh-action-pypi-publish@release/v1
59+
- name: πŸš€ Publish package distributions to PyPI
60+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
4961
with:
50-
packages-dir: artifact/
51-
print-hash: true
62+
attestations: true

β€Ž.github/workflows/ruff.ymlβ€Ž

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,30 @@ on:
88
pull_request:
99
branches: [main]
1010

11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
13+
cancel-in-progress: true
14+
15+
permissions: {}
16+
1117
jobs:
1218
ruff:
1319
name: Ruff
1420
runs-on: ubuntu-latest
1521

1622
steps:
17-
- uses: actions/checkout@v4
23+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
24+
with:
25+
persist-credentials: false
1826

19-
# Keep in sync with .pre-comit-config.yaml
20-
- run: python -Im pip install --user ruff==0.15.16
27+
- name: Install Python
28+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
29+
with:
30+
python-version: "3.14"
31+
- name: Install dependencies
32+
# Keep in sync with .pre-comit-config.yaml
33+
run: python -Im pip install ruff==0.15.16
2134

22-
- name: Run ruff
23-
working-directory: ./src
24-
run: ruff check --output-format=github wagtailmath
35+
- name: Run ruff
36+
working-directory: ./src
37+
run: ruff check --output-format=github wagtailmath

β€Ž.github/workflows/test.ymlβ€Ž

Lines changed: 91 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,30 +7,111 @@ on:
77
- 'stable/**'
88

99
pull_request:
10+
branches: [main]
1011

1112
concurrency:
12-
group: ${{ github.workflow }}-${{ github.ref }}
13+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
1314
cancel-in-progress: true
1415

15-
permissions:
16-
contents: read # to fetch code (actions/checkout)
16+
permissions: {}
17+
18+
env:
19+
FORCE_COLOR: "1" # Make tools pretty.
20+
TOX_TESTENV_PASSENV: FORCE_COLOR
21+
PIP_DISABLE_PIP_VERSION_CHECK: "1"
22+
PIP_NO_PYTHON_VERSION_WARNING: "1"
23+
PYTHON_LATEST: "3.14"
1724

1825
jobs:
19-
test-sqlite:
26+
tests:
27+
name: Python ${{ matrix.python-version }}
2028
runs-on: ubuntu-latest
29+
permissions:
30+
contents: read # to fetch code (actions/checkout)
31+
2132
strategy:
2233
matrix:
23-
python: ['3.10', '3.11', '3.12', '3.13', '3.14']
34+
python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
2435

2536
steps:
26-
- uses: actions/checkout@v4
27-
- name: Set up Python ${{ matrix.python }}
28-
uses: actions/setup-python@v5
37+
- name: Harden Runner
38+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
39+
with:
40+
disable-sudo: true
41+
egress-policy: block
42+
allowed-endpoints: >
43+
files.pythonhosted.org:443
44+
objects.githubusercontent.com:443
45+
github.com:443
46+
pypi.org:443
47+
api.github.com:443
48+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2949
with:
30-
python-version: ${{ matrix.python }}
31-
- name: Install
50+
persist-credentials: false
51+
- name: Set up Python ${{ matrix.python-version }}
52+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
53+
with:
54+
python-version: ${{ matrix.python-version }}
55+
- name: Install dependencies
3256
run: |
3357
python -Im pip install --upgrade pip setuptools wheel
3458
python -Im pip install .[ci]
3559
- name: Test
3660
run: tox
61+
62+
- name: ⬆️ Upload coverage data
63+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
64+
with:
65+
name: coverage-data-${{ matrix.python-version }}
66+
path: .coverage.*
67+
include-hidden-files: true
68+
if-no-files-found: ignore
69+
retention-days: 1
70+
71+
coverage:
72+
name: Combine & check coverage.
73+
runs-on: ubuntu-latest
74+
needs: tests
75+
permissions:
76+
contents: read # to fetch code (actions/checkout)
77+
78+
steps:
79+
- name: Harden Runner
80+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
81+
with:
82+
disable-sudo: true
83+
egress-policy: block
84+
allowed-endpoints: >
85+
files.pythonhosted.org:443
86+
objects.githubusercontent.com:443
87+
github.com:443
88+
pypi.org:443
89+
api.github.com:443
90+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
91+
with:
92+
persist-credentials: false
93+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
94+
with:
95+
# Use latest Python, so it understands all syntax.
96+
python-version: ${{env.PYTHON_LATEST}}
97+
98+
- run: python -Im pip install --upgrade coverage
99+
100+
- name: Download coverage data
101+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
102+
with:
103+
pattern: coverage-data-*
104+
merge-multiple: true
105+
106+
- name: οΌ‹ Combine coverage
107+
run: |
108+
python -Im coverage combine
109+
python -Im coverage html --skip-covered --skip-empty
110+
python -Im coverage report
111+
echo "## Coverage summary" >> $GITHUB_STEP_SUMMARY
112+
python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
113+
- name: πŸ“ˆ Upload HTML report if check failed.
114+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
115+
with:
116+
name: html-report
117+
path: htmlcov

β€Ž.github/workflows/zizmor.ymlβ€Ž

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: GitHub Actions Security Analysis with zizmor 🌈
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
permissions: {}
10+
11+
jobs:
12+
zizmor:
13+
name: Run zizmor 🌈
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
17+
contents: read # Only needed for private repos. Needed to clone the repo.
18+
actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
persist-credentials: false
24+
25+
- name: Run zizmor 🌈
26+
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

0 commit comments

Comments
Β (0)