From 81c1bc1f17cfaf04fefcc276487938970d18070f Mon Sep 17 00:00:00 2001 From: zerolab Date: Tue, 21 Jul 2026 15:03:43 +0100 Subject: [PATCH 1/3] Add zizmor GHA --- .github/workflows/zizmor.yml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..2d2daff --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,31 @@ +# https://github.com/woodruffw/zizmor +name: Zizmor 🌈 + +on: + push: + branches: ["main"] + pull_request: + branches: ["**"] + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: {} + +jobs: + zizmor: + name: Run zizmor 🌈 + runs-on: ubuntu-latest + permissions: + security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. + steps: + - name: Checkout repository + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0 + with: + persona: pedantic From b20c0fbff8cdab9bb21d564fc71d24d8dc096e68 Mon Sep 17 00:00:00 2001 From: zerolab Date: Tue, 21 Jul 2026 15:04:15 +0100 Subject: [PATCH 2/3] Bump GitHub action versions, pin to commits and add Harden Runner --- .github/workflows/publish.yml | 70 +++++++++++++++++++++++++++-------- .github/workflows/ruff.yml | 35 +++++++++++++++--- .github/workflows/test.yml | 67 +++++++++++++++++++++++++++------ 3 files changed, 139 insertions(+), 33 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 9b3a54f..946d7b5 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -4,21 +4,40 @@ on: release: types: [published] +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: {} + jobs: build: + name: Publish to PyPI runs-on: ubuntu-latest permissions: contents: read # to fetch code (actions/checkout) + steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + disable-sudo: true + egress-policy: block + allowed-endpoints: > + files.pythonhosted.org:443 + objects.githubusercontent.com:443 + github.com:443 + pypi.org:443 + api.github.com:443 + + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 + persist-credentials: false - - uses: actions/setup-python@v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: - python-version: '3.13' - cache: "pip" - cache-dependency-path: "**/pyproject.toml" + python-version: '3.14' - name: ⬇️ Install build dependencies run: | @@ -27,25 +46,44 @@ jobs: - name: 🏗️ Build run: python -m flit build - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: path: ./dist # https://docs.pypi.org/trusted-publishers/using-a-publisher/ - pypi-publish: - needs: build - environment: 'publish' - + publish-py: name: ⬆️ Upload release to PyPI + environment: 'publish' + if: github.repository_owner == 'torchbox' && github.event.action == 'published' runs-on: ubuntu-latest + needs: build + permissions: - # Mandatory for trusted publishing - id-token: write + id-token: write # Mandatory for trusted publishing + steps: - - uses: actions/download-artifact@v4 + - name: Harden Runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + disable-sudo: true + egress-policy: block + allowed-endpoints: > + - github.com:443 + - api.github.com:443 + - ghcr.io:443 + - pkg-containers.githubusercontent.com:443 + - pypi.org:443 + - upload.pypi.org:443 + - files.pythonhosted.org:443 + - fulcio.sigstore.dev:443 + - rekor.sigstore.dev:443 + - tuf-repo-cdn.sigstore.dev:443 + + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + path: dist - name: 🚀 Publish package distributions to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1 with: - packages-dir: artifact/ - print-hash: true + attestations: true diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml index 100353d..34b29cc 100644 --- a/.github/workflows/ruff.yml +++ b/.github/workflows/ruff.yml @@ -8,16 +8,39 @@ on: pull_request: branches: [main] +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: {} + jobs: ruff: + name: Ruff runs-on: ubuntu-latest + permissions: + contents: read # to fetch code (actions/checkout) steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + disable-sudo: true + egress-policy: block + allowed-endpoints: > + files.pythonhosted.org:443 + objects.githubusercontent.com:443 + github.com:443 + pypi.org:443 + api.github.com:443 + + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - # Keep in sync with .pre-commit-config.yaml - - run: python -Im pip install --user ruff==0.15.14 + # Keep in sync with .pre-commit-config.yaml + - run: python -Im pip install --user ruff==0.15.14 - - name: Run ruff - working-directory: ./src - run: ruff check --output-format=github wagtail_bynder + - name: Run ruff + working-directory: ./src + run: ruff check --output-format=github wagtail_bynder diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index acdddf3..ea8ee59 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -10,7 +10,7 @@ on: branches: [main] concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true permissions: @@ -25,6 +25,7 @@ env: jobs: test-latest: + name: Test on latest versions (and postgres) runs-on: ubuntu-latest strategy: matrix: @@ -43,10 +44,24 @@ jobs: options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5 steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + disable-sudo: true + egress-policy: block + allowed-endpoints: > + files.pythonhosted.org:443 + objects.githubusercontent.com:443 + github.com:443 + pypi.org:443 + api.github.com:443 + + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} @@ -64,14 +79,16 @@ jobs: run: tox --installpkg ./dist/*.whl - name: ⬆️ Upload coverage data - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: coverage-data-${{ matrix.python-version }}-django${{ matrix.django }}-wagtail${{ matrix.wagtail }}-postgres path: .coverage.* if-no-files-found: ignore + include-hidden-files: true retention-days: 1 test: + name: Test (sqlite) runs-on: ubuntu-latest strategy: fail-fast: false @@ -79,10 +96,24 @@ jobs: python-version: ["3.11", "3.12", "3.13", "3.14"] db: ["sqlite"] steps: - - uses: actions/checkout@v4 + - name: Harden Runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + disable-sudo: true + egress-policy: block + allowed-endpoints: > + files.pythonhosted.org:443 + objects.githubusercontent.com:443 + github.com:443 + pypi.org:443 + api.github.com:443 + + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.python-version }} @@ -97,7 +128,7 @@ jobs: run: tox --installpkg ./dist/*.whl - name: ⬆️ Upload coverage data - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: coverage-data-${{ matrix.python-version }}-django${{ matrix.django }}-wagtail${{ matrix.wagtail }}-sqlite path: .coverage.* @@ -106,14 +137,28 @@ jobs: retention-days: 1 coverage: + name: Combine & check coverage. runs-on: ubuntu-latest needs: - test-latest - test steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - name: Harden Runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + disable-sudo: true + egress-policy: block + allowed-endpoints: > + files.pythonhosted.org:443 + objects.githubusercontent.com:443 + github.com:443 + pypi.org:443 + api.github.com:443 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: # Use latest Python, so it understands all syntax. python-version: ${{env.PYTHON_LATEST}} @@ -121,7 +166,7 @@ jobs: - run: python -Im pip install --upgrade coverage - name: ⬇️ Download coverage data - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: coverage-data-* merge-multiple: true @@ -134,7 +179,7 @@ jobs: echo "## Coverage summary" >> $GITHUB_STEP_SUMMARY python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY - name: 📈 Upload HTML report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: html-report path: htmlcov From db8d9f8b8beeb4561534586c393f0dbca589833f Mon Sep 17 00:00:00 2001 From: zerolab Date: Tue, 21 Jul 2026 15:06:36 +0100 Subject: [PATCH 3/3] Bump pre-commit tool versions --- .github/workflows/ruff.yml | 2 +- .pre-commit-config.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml index 34b29cc..4ead159 100644 --- a/.github/workflows/ruff.yml +++ b/.github/workflows/ruff.yml @@ -39,7 +39,7 @@ jobs: persist-credentials: false # Keep in sync with .pre-commit-config.yaml - - run: python -Im pip install --user ruff==0.15.14 + - run: python -Im pip install --user ruff==0.15.22 - name: Run ruff working-directory: ./src diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index fa2cbd8..23f903e 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -3,7 +3,7 @@ ci: autoupdate_schedule: 'quarterly' default_language_version: - python: python3.13 + python: python3.14 repos: - repo: https://github.com/pre-commit/pre-commit-hooks @@ -21,8 +21,8 @@ repos: - id: trailing-whitespace - repo: https://github.com/astral-sh/ruff-pre-commit # keep in sync with .github/workflows/ruff.yml - rev: 'v0.15.14' + rev: 'v0.15.22' hooks: - id: ruff - args: [--fix, --exit-non-zero-on-fix] + args: [ --fix ] - id: ruff-format