[Maintenance] Action pinning

.github/scripts/report_nightly_build_failure.py

@@ -1,28 +1,30 @@
 """
-Called by GH Actions when the nightly build fails.
+Called by GitHub Action when the nightly build fails.
 
 This reports an error to the #nightly-build-failures Slack channel.
 """
 
 import os
 
-import requests
+import urllib3
 
 
 if "SLACK_WEBHOOK_URL" in os.environ:
+    # https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-variables
+    repository = os.environ["GITHUB_REPOSITORY"]
+    run_id = os.environ["GITHUB_RUN_ID"]
+    url = f"https://github.com/{repository}/actions/runs/{run_id}"
+
     print("Reporting to #nightly-build-failures slack channel")
-    response = requests.post(
+
+    urllib3.request(
+        "POST",
         os.environ["SLACK_WEBHOOK_URL"],
-        json={
-            "text": "A Nightly build failed. See https://github.com/wagtail-nest/wagtail-polymath/actions/runs/"
-            + os.environ["GITHUB_RUN_ID"],
-        },
-        timeout=30,
+        json={"text": f"A Nightly build failed. See {url}"},
     )
 
-    print("Slack responded with:", response)
-
 else:
     print(
-        "Unable to report to #nightly-build-failures slack channel because SLACK_WEBHOOK_URL is not set"
+        "Unable to report to #nightly-build-failures slack channel "
+        "because SLACK_WEBHOOK_URL is not set"
     )

.github/workflows/nightly.yml

@@ -1,37 +1,47 @@
-name: Nightly Wagtail Test
+name: Nightly Wagtail test
 
 on:
   schedule:
-    - cron: '0 1 * * *'
-    # At 01:00, daily
+    # Weekly on Monday.
+    - cron: "0 0 * * 1"
+
   workflow_dispatch:
 
-env:
-  WEBHOOK_EXISTS: ${{ secrets.SLACK_WEBHOOK_URL != '' }}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:  {}
 
 jobs:
-  nightly-wagtail-test:
+  nightly-test:
+    name: Nightly tests against Wagtail main
+    # Cannot check the existence of secrets, so limiting to repository name to prevent all forks to run nightly.
+    # See: https://github.com/actions/runner/issues/520
+    if: ${{ github.repository == 'wagtail-nest/wagtail-polymath' }}
     runs-on: ubuntu-latest
-    if: ${{ vars.WEBHOOK_EXISTS }}
+    permissions:
+      contents: read # to fetch code (actions/checkout)
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
-          python-version: '3.11'
-
-      - run: git clone https://github.com/wagtail/wagtail.git
-
-      - run: python -m pip install flit
-      - run: flit install --deps production --extras testing
-      - run: python -m pip install ./wagtail
-
-      - run: python tests/manage.py test
-
-      - name: Report failure
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: "3.14"
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip tox "urllib3==2.6.3"
+      - name: Test
+        id: test
+        continue-on-error: true
+        run: tox -e wagtailmain
+
+      - name: Send Slack notification on failure
+        if: steps.test.outcome == 'failure'
         run: |
-          python -m pip install requests
-          python ./.github/scripts/report_nightly_build_failure.py
-        if: ${{ failure() && env.WEBHOOK_EXISTS == 'true' }}
+          python .github/scripts/report_nightly_build_failure.py
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

.github/workflows/publish.yml

@@ -6,46 +6,57 @@ on:
   release:
     types: [published]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   build:
+    name: 🏗️ Build
     runs-on: ubuntu-latest
     permissions:
       contents: read # to fetch code (actions/checkout)
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - name: Set up Python 3.11
-        uses: actions/setup-python@v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
-          python-version: '3.11'
+          python-version: '3.14'
 
-      - name: Install dependencies
+      - name: ⬇️ Install build dependencies
         run: |
-          python -m pip install --upgrade pip
-          python -m pip install flit
+          python -m pip install --upgrade pip flit
           python -m flit install --symlink
 
-      - name: Build
+      - name: 🏗️ Build
         run: python -m flit build
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           path: ./dist
 
-  publish:
-    needs: build
+  # https://docs.pypi.org/trusted-publishers/using-a-publisher/
+  publish-pypi:
+    name: ⬆️ Upload release to PyPI
+    environment: 'publish'
+    if: github.repository_owner == 'wagtail-nest' && github.event.action == 'published'
     runs-on: ubuntu-latest
+    needs: build
+
     permissions:
-      contents: none
-      id-token: write # required for trusted publishing
-    environment: publish
+      id-token: write  # Mandatory for trusted publishing
+
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          path: dist
 
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: 🚀 Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
         with:
-          packages-dir: artifact/
-          print-hash: true
+          attestations: true

.github/workflows/ruff.yml

@@ -8,17 +8,30 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   ruff:
     name: Ruff
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
-    # Keep in sync with .pre-comit-config.yaml
-    - run: python -Im pip install --user ruff==0.15.16
+      - name: Install Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: "3.14"
+      - name: Install dependencies
+      # Keep in sync with .pre-comit-config.yaml
+      - run: python -Im pip install ruff==0.15.16
 
-    - name: Run ruff
-      working-directory: ./src
-      run: ruff check --output-format=github wagtailmath
+      - name: Run ruff
+        working-directory: ./src
+        run: ruff check --output-format=github wagtailmath

.github/workflows/test.yml

@@ -7,30 +7,111 @@ on:
       - 'stable/**'
 
   pull_request:
+    branches: [main]
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read # to fetch code (actions/checkout)
+permissions: {}
+
+env:
+  FORCE_COLOR: "1" # Make tools pretty.
+  TOX_TESTENV_PASSENV: FORCE_COLOR
+  PIP_DISABLE_PIP_VERSION_CHECK: "1"
+  PIP_NO_PYTHON_VERSION_WARNING: "1"
+  PYTHON_LATEST: "3.14"
 
 jobs:
   test-sqlite:
+    name: Python ${{ matrix.python-version }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
     strategy:
       matrix:
-        python: ['3.10', '3.11', '3.12', '3.13', '3.14']
+        python-versio n: ['3.10', '3.11', '3.12', '3.13', '3.14']
 
     steps:
-      - uses: actions/checkout@v4
-      - name: Set up Python ${{ matrix.python }}
-        uses: actions/setup-python@v5
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            files.pythonhosted.org:443
+            objects.githubusercontent.com:443
+            github.com:443
+            pypi.org:443
+            api.github.com:443
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
-          python-version: ${{ matrix.python }}
-      - name: Install
+          persist-credentials: false
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
         run: |
           python -Im pip install --upgrade pip setuptools wheel
           python -Im pip install .[ci]
       - name: Test
         run: tox
+
+      - name: ⬆️ Upload coverage data
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        with:
+          name: coverage-data-${{ matrix.python-version }}
+          path: .coverage.*
+          include-hidden-files: true
+          if-no-files-found: ignore
+          retention-days: 1
+
+  coverage:
+    name: Combine & check coverage.
+    runs-on: ubuntu-latest
+    needs: tests
+    permissions:
+      contents: read # to fetch code (actions/checkout)
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            files.pythonhosted.org:443
+            objects.githubusercontent.com:443
+            github.com:443
+            pypi.org:443
+            api.github.com:443
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          # Use latest Python, so it understands all syntax.
+          python-version: ${{env.PYTHON_LATEST}}
+
+      - run: python -Im pip install --upgrade coverage
+
+      - name: Download coverage data
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          pattern: coverage-data-*
+          merge-multiple: true
+
+      - name: ＋  Combine coverage
+        run: |
+          python -Im coverage combine
+          python -Im coverage html --skip-covered --skip-empty
+          python -Im coverage report
+          echo "## Coverage summary" >> $GITHUB_STEP_SUMMARY
+          python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
+      - name: 📈 Upload HTML report if check failed.
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        with:
+          name: html-report
+          path: htmlcov

.github/workflows/zizmor.yml

@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read         # Only needed for private repos. Needed to clone the repo.
+      actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

tox.ini

@@ -53,7 +53,7 @@ commands = python -Im pytest --cov --cov-append --ignore=docs/ {posargs: -vv}
 
 [testenv:interactive]
 description = An interactive environment for local testing purposes
-basepython = python3.12
+basepython = python3.14
 package = editable
 
 deps =