diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock new file mode 100644 index 000000000..64946868e --- /dev/null +++ b/.github/workflows/actions.lock @@ -0,0 +1,86 @@ +# This file is machine-generated by `gh actions-lock`. +# Do not edit by hand; run `gh actions-lock` to update. +# Docs: https://gh.io/actions-lockfile +version: 'v0.0.3' +workflows: + '.github/workflows/agent-scan.yml': + - 'matteogabriele/agentscan-action@v2.5.0' + '.github/workflows/cifuzz.yml': + - 'actions/upload-artifact@v7.0.2' + - 'github/codeql-action@v4.39.3' + - 'google/oss-fuzz@06a694ed8ee65428f29d220a001681a19ccde657' + '.github/workflows/documentation.yml': + - 'actions/checkout@v7.0.1' + - 'astral-sh/setup-uv@v10.3.3' + '.github/workflows/pr-quality.yml': + - 'peakoss/anti-slop@v0.3.0' + '.github/workflows/ruff.yml': + - 'actions/checkout@v7.0.1' + - 'actions/setup-python@v7.1.0' + '.github/workflows/tests.yml': + - 'actions/checkout@v7.0.1' + - 'actions/download-artifact@v8.0.2' + - 'actions/setup-python@v7.1.0' + - 'actions/upload-artifact@v7.0.2' + - 'astral-sh/setup-uv@v10.3.3' + - 'coverallsapp/github-action@v2.3.8' + - 'ncipollo/release-action@v1.21.0' + '.github/workflows/zizmor.yml': + - 'actions/checkout@v7.0.1' + - 'github/codeql-action@v4.39.3' +dependencies: + 'actions/checkout@v7.0.1': + ref: 'v7.0.1' + commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1' + owner_id: 44036562 + repo_id: 197814629 + 'actions/download-artifact@v8.0.2': + ref: 'v8.0.2' + commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' + owner_id: 44036562 + repo_id: 192626254 + 'actions/setup-python@v7.1.0': + ref: 'v7.1.0' + commit: 'sha1-6d4fd22b20465ccc0f7354476588e8df7c9ca0e0' + owner_id: 44036562 + repo_id: 192625525 + 'actions/upload-artifact@v7.0.2': + ref: 'v7.0.2' + commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' + owner_id: 44036562 + repo_id: 192625955 + 'astral-sh/setup-uv@v10.3.3': + ref: 'v10.3.3' + commit: 'sha1-68559e99cc807c1eb7e9238fd43a15bba460eec2' + owner_id: 115962839 + repo_id: 846733598 + 'coverallsapp/github-action@v2.3.8': + ref: 'v2.3.8' + commit: 'sha1-8d6379e14d29928660c4ba802d8e85393440b329' + owner_id: 16691566 + repo_id: 200696780 + 'github/codeql-action@v4.39.3': + ref: 'v4.39.3' + commit: 'sha1-33d7b85da1a04171e211befe2c739303b9a4c066' + owner_id: 9919 + repo_id: 259445878 + 'google/oss-fuzz@06a694ed8ee65428f29d220a001681a19ccde657': + ref: 'master' + commit: 'sha1-06a694ed8ee65428f29d220a001681a19ccde657' + owner_id: 1342004 + repo_id: 63809205 + 'matteogabriele/agentscan-action@v2.5.0': + ref: 'v2.5.0' + commit: 'sha1-8112fb79b33fafb8506159df20129a34209ac410' + owner_id: 5337152 + repo_id: 1183120486 + 'ncipollo/release-action@v1.21.0': + ref: 'v1.21.0' + commit: 'sha1-339a81892b84b4eeb0f6e744e4574d79d0d9b8dd' + owner_id: 5712756 + repo_id: 204020546 + 'peakoss/anti-slop@v0.3.0': + ref: 'v0.3.0' + commit: 'sha1-57858eead489d08b255fab2af45a506c2ca6eab2' + owner_id: 227272980 + repo_id: 1153153658 diff --git a/.github/workflows/agent-scan.yml b/.github/workflows/agent-scan.yml index de26d55eb..2266db936 100644 --- a/.github/workflows/agent-scan.yml +++ b/.github/workflows/agent-scan.yml @@ -30,7 +30,7 @@ jobs: # key: agentscan-cache-${{ github.actor }} # restore-keys: agentscan-cache- - name: AgentScan - uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410 # v2.5.0 + uses: MatteoGabriele/agentscan-action@v2.5.0 with: # allowed-users: "angatha,ennamarie19,niccokunzmann,peskypotato,SashankBhamidi,stevepiercy" honeypot: true diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 74df8c513..4e302d2c2 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -21,7 +21,7 @@ jobs: fuzz-seconds: 600 output-sarif: true - name: Upload Crash - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 + uses: actions/upload-artifact@v7.0.2 if: failure() && steps.build.outcome == 'success' with: name: artifacts @@ -29,7 +29,7 @@ jobs: - name: Upload Sarif if: always() && steps.build.outcome == 'success' # https://github.com/github/codeql-action/releases - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 + uses: github/codeql-action/upload-sarif@v4.39.3 with: # Path to SARIF file relative to the root of the repository sarif_file: cifuzz-sarif/results.sarif diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index b94c1f456..96cd1ff87 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -28,13 +28,13 @@ jobs: matrix: python-version: ['3.11', '3.14'] steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 fetch-tags: true - name: Install uv - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + uses: astral-sh/setup-uv@v10.3.3 with: # UV_VERSION can be set in the repository settings: # Settings -> Secrets and variables -> Actions or click here: diff --git a/.github/workflows/pr-quality.yml b/.github/workflows/pr-quality.yml index 43c088514..893bd12c8 100644 --- a/.github/workflows/pr-quality.yml +++ b/.github/workflows/pr-quality.yml @@ -17,7 +17,7 @@ jobs: anti-slop: runs-on: ubuntu-latest steps: - - uses: peakoss/anti-slop@57858eead489d08b255fab2af45a506c2ca6eab2 # v0.3.0 + - uses: peakoss/anti-slop@v0.3.0 with: max-failures: 4 max-description-length: 1500 diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml index f2c775959..29bfca2f7 100644 --- a/.github/workflows/ruff.yml +++ b/.github/workflows/ruff.yml @@ -9,9 +9,9 @@ jobs: Please set up your development environment and run the formatting command. https://icalendar.readthedocs.io/en/stable/contribute/development.html#format-code steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Set up Python - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + uses: actions/setup-python@v7.1.0 with: python-version: 3.14 cache: pip diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 127c04803..8c093d948 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -21,7 +21,7 @@ jobs: # See https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/passing-information-between-jobs#example-defining-outputs-for-a-job include: ${{ steps.set-matrix.outputs.include }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Set matrix id: set-matrix env: @@ -44,13 +44,13 @@ jobs: - name: Skip notice if: ${{ matrix.skip }} run: echo "Skipped ${{ matrix.test_name }} (not required for this trigger)" - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 if: ${{ !matrix.skip }} with: fetch-tags: true - name: Install uv and Python ${{ matrix.python_version }} if: ${{ !matrix.skip }} - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + uses: astral-sh/setup-uv@v10.3.3 with: # zizmor: ignore[cache-poisoning] - run-tests does not produce release artifacts enable-cache: true @@ -70,7 +70,7 @@ jobs: run: ${{ matrix.test_command }} - name: Coveralls Parallel if: ${{ !matrix.skip }} - uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2 + uses: coverallsapp/github-action@v2.3.8 with: flag-name: run-${{ matrix.test_name }} parallel: true @@ -89,7 +89,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Coveralls Finished - uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2 + uses: coverallsapp/github-action@v2.3.8 with: parallel-finished: true format: cobertura @@ -101,18 +101,18 @@ jobs: contents: read runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Install uv and Python - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + uses: astral-sh/setup-uv@v10.3.3 with: enable-cache: false version: "0.11.6" - name: Check the release files run: make test-dist - name: Upload built packages - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + uses: actions/upload-artifact@v7.0.2 with: name: built-packages path: dist/* @@ -124,12 +124,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Download built packages - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + uses: actions/download-artifact@v8.0.2 with: name: built-packages path: dist - name: Install uv and Python 3.14 - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 + uses: astral-sh/setup-uv@v10.3.3 with: enable-cache: false # UV_VERSION can be set in the repository settings: @@ -165,9 +165,9 @@ jobs: TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }} TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Set up Python - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 + uses: actions/setup-python@v7.1.0 with: python-version: "3.14" - name: Update pip @@ -206,9 +206,9 @@ jobs: environment: name: github-release steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/checkout@v7.0.1 - name: Create GitHub release from tag - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 + uses: ncipollo/release-action@v1.21.0 with: allowUpdates: true body: "To view the changes, please see the [Changelog](https://icalendar.readthedocs.io/en/latest/reference/changelog.html). This release can be installed from [PyPI](https://pypi.org/project/icalendar/#history)." diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index da1c0459d..fba6159e4 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -16,17 +16,37 @@ jobs: security-events: write steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7.0.1 with: persist-credentials: false - name: Update pip run: scripts/update-pip.sh - name: Install zizmor - run: pip install zizmor==1.30.1 # also update pyproject.toml + # 1.32.0 is the first release that reads the actions lockfile + run: pip install zizmor==1.32.0 # also update pyproject.toml - name: Run zizmor run: zizmor --format sarif .github/workflows/ > zizmor-results.sarif - name: Upload SARIF file # https://github.com/github/codeql-action/releases - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 + uses: github/codeql-action/upload-sarif@v4.39.3 with: sarif_file: zizmor-results.sarif + + # Fails when .github/workflows/actions.lock is out of sync with the + # workflows or a locked pin no longer verifies upstream. + # https://docs.github.com/en/actions/how-tos/administer/enforce-workflow-lockfiles + lockfile: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout repository + uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + - name: Verify the actions lockfile + env: + GH_TOKEN: ${{ github.token }} + run: | + gh extension install github/gh-actions-lock --pin v0.4.1 + gh actions-lock --verify diff --git a/news/2096.internal b/news/2096.internal new file mode 100644 index 000000000..bf7ceb25d --- /dev/null +++ b/news/2096.internal @@ -0,0 +1 @@ +Locked the GitHub Actions workflows: every workflow pins its actions by version tag, with the tag-to-commit mapping recorded in ``.github/workflows/actions.lock`` and verified in CI by ``gh actions-lock --verify`` (`Issue #2096 `_). @rahul05ranjan diff --git a/pyproject.toml b/pyproject.toml index a5de81739..56a633f65 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -103,7 +103,7 @@ dev = [ "towncrier>=25.8.0", "tox", "tox-uv", - "zizmor==1.30.1", # also update .github/workflows/zizmor.yml + "zizmor==1.32.0; python_version >= '3.11'", # also update .github/workflows/zizmor.yml ] test = [