Skip to content

Commit 04a3ac8

Browse files
sebhmgsebhmg
committed
[DEVOPS-922] configuration fro zizmor
1 parent 87ffe83 commit 04a3ac8

8 files changed

Lines changed: 82 additions & 48 deletions

‎.github/dependabot.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "github-actions"
9+
directory: "/"
10+
target-branch: "develop"
11+
schedule:
12+
interval: "weekly"
13+
cooldown:
14+
default-days: 4

‎.github/workflows/issue_to_jira.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,15 @@ on:
44
issues:
55
types: [opened]
66

7-
permissions:
8-
contents: read
9-
issues: write
7+
permissions: {}
108

119
jobs:
1210
call-workflow-create-jira-issue:
1311
if: startsWith(github.repository, 'MiraGeoscience/') # run on the Mira repo only
14-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@main
12+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v2
13+
permissions:
14+
contents: read
15+
issues: write
1516
with:
1617
project-key: 'GEOPY'
1718
components: '[{"name": "simpeg"}]'

‎.github/workflows/pr_add_jira_summary.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,15 @@ on:
44
pull_request_target: # zizmor: ignore[dangerous-triggers]
55
types: [opened]
66

7-
permissions:
8-
contents: read
9-
pull-requests: write
7+
permissions: {}
108

119
jobs:
1210
call-workflow-add-jira-issue-summary:
1311
if: startsWith(github.repository, 'MiraGeoscience/') # run if PR targets the Mira repo only
14-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@main
12+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@v2
13+
permissions:
14+
contents: read
15+
pull-requests: write
1516
secrets:
1617
JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
1718
JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}

‎.github/workflows/python_deploy_dev.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,18 @@ on:
55
tags:
66
- 'v*' # Push events to every version tag (eg. v1.0.0)
77

8+
permissions: {}
9+
810
concurrency:
911
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
1012
cancel-in-progress: true
1113

1214
jobs:
1315
call-workflow-conda-publish:
1416
name: Publish development conda package on JFrog Artifactory
15-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@main
17+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v2
1618
permissions:
17-
contents: write # to create draft release and attach artifacts
18-
actions: read
19+
contents: write
1920
with:
2021
package-name: 'mira-simpeg'
2122
python-version: '3.10'
@@ -28,10 +29,9 @@ jobs:
2829
JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
2930
call-workflow-pypi-publish:
3031
name: Publish development pypi package (JFrog Artifactory, TestPyPI)
31-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@main
32+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v2
3233
permissions:
33-
contents: write # to create draft release and attach artifacts
34-
actions: read
34+
contents: write
3535
with:
3636
package-manager: 'setuptools'
3737
package-name: 'mira-simpeg'

‎.github/workflows/python_deploy_prod.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ on:
1919
type: boolean
2020
default: true
2121

22+
permissions: {}
23+
2224
concurrency:
2325
group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.event.inputs.release-tag || github.run_id }}
2426
cancel-in-progress: true
@@ -27,10 +29,9 @@ jobs:
2729
call-workflow-conda-release:
2830
name: Publish production Conda package on JFrog Artifactory
2931
if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
30-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@main
32+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v2
3133
permissions:
32-
contents: write # seems required to find the draft release
33-
actions: read
34+
contents: write
3435
with:
3536
virtual-repo-names: '["public-noremote-conda-prod"]'
3637
release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
@@ -40,10 +41,9 @@ jobs:
4041
call-workflow-pypi-release:
4142
name: Publish production PyPI package (JFrog Artifactory, PyPI)
4243
if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
43-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@main
44+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v2
4445
permissions:
45-
contents: write # seems required to find the draft release
46-
actions: read
46+
contents: write
4747
with:
4848
package-name: 'mira-simpeg'
4949
virtual-repo-names: '["public-pypi-prod", "pypi"]'

‎.github/workflows/security_scan.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Security Scan
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened, ready_for_review]
6+
branches:
7+
- develop
8+
- main
9+
- release/**
10+
- feature/**
11+
- hotfix/**
12+
push:
13+
branches:
14+
- develop
15+
- main
16+
- release/**
17+
- feature/**
18+
- hotfix/**
19+
20+
permissions: {}
21+
22+
concurrency:
23+
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
24+
cancel-in-progress: true
25+
26+
jobs:
27+
call-workflow-zizmor-annotate:
28+
name: Zizmor analysis (advanced security)
29+
# run on the Mira repo only (upstream SimPEG repo has its own workflow for Zizmor)
30+
if: ${{ github.event_name != 'pull_request' && startsWith(github.repository, 'MiraGeoscience/') }}
31+
permissions:
32+
security-events: write
33+
contents: read
34+
actions: read
35+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v2
36+
37+
call-workflow-zizmor-advanced-security:
38+
name: Zizmor analysis (annotate)
39+
# run on the Mira repo only (upstream SimPEG repo has its own workflow for Zizmor)
40+
if: ${{ github.event_name == 'pull_request' && startsWith(github.repository, 'MiraGeoscience/') }}
41+
permissions:
42+
checks: write
43+
contents: read
44+
actions: read
45+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v2

‎.github/workflows/zizmor-security-mira.yml‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎zizmor.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
rules:

0 commit comments

Comments
 (0)