Skip to content

Commit 285acf8

Browse files
VeckoTheGeckoclaude
VeckoTheGecko
and
claude
authored
Security linting of GHA workflows (#2560)
Co-authored-by: Claude <noreply@anthropic.com>
1 parent 1724158 commit 285acf8

5 files changed

Lines changed: 86 additions & 38 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ updates:
44
directory: "/"
55
schedule:
66
interval: "monthly"
7+
cooldown:
8+
default-days: 7

‎.github/workflows/additional.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,21 @@ on:
44
schedule:
55
- cron: "0 0 1 */3 *" # Run every 3 months
66

7+
permissions: {}
8+
79
jobs:
810
min-version-policy:
911
name: Minimum Version Policy
1012
runs-on: "ubuntu-latest"
13+
permissions:
14+
contents: read
1115
env:
1216
COLUMNS: 120
1317
steps:
14-
- uses: actions/checkout@v5
15-
- uses: astral-sh/setup-uv@v7
18+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
19+
with:
20+
persist-credentials: false
21+
- uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
1622
with:
1723
version: "0.9.26"
1824
- run: |
@@ -25,10 +31,14 @@ jobs:
2531
linkcheck:
2632
name: pixi run docs-linkcheck
2733
runs-on: "ubuntu-latest"
34+
permissions:
35+
contents: read
2836

2937
steps:
30-
- uses: actions/checkout@v5
31-
- uses: prefix-dev/setup-pixi@v0.9.0
38+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
39+
with:
40+
persist-credentials: false
41+
- uses: prefix-dev/setup-pixi@fef5c9568ca6c4ff7707bf840ab0692ba3f08293 # v0.9.0
3242
- run: pixi run docs-linkcheck
3343

3444
create-issue-on-failure:
@@ -43,7 +53,7 @@ jobs:
4353
issues: write
4454
steps:
4555
- name: Create issue
46-
uses: actions/github-script@v8
56+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
4757
with:
4858
script: |
4959
const workflowUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;

‎.github/workflows/ci.yml‎

Lines changed: 47 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -14,18 +14,23 @@ defaults:
1414
run:
1515
shell: bash -el {0}
1616

17+
permissions: {}
18+
1719
jobs:
1820
should-run-ci:
1921
name: should run ci
2022
runs-on: ubuntu-slim
23+
permissions:
24+
contents: read
2125
if: |
2226
github.repository == 'Parcels-code/Parcels'
2327
&& (github.event_name == 'push' || github.event_name == 'pull_request')
2428
steps:
25-
- uses: actions/checkout@v5
29+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
2630
with:
2731
fetch-depth: 2
28-
- uses: xarray-contrib/ci-trigger@v1
32+
persist-credentials: false
33+
- uses: xarray-contrib/ci-trigger@74ddc46fc6ca7509549ac7b660d7a185948c1e74 # v1
2934
id: check-skip
3035
with:
3136
keyword: "[skip-ci]"
@@ -38,14 +43,18 @@ jobs:
3843
cache-pixi-lock:
3944
runs-on: ubuntu-latest
4045
needs: [should-run-ci]
46+
permissions:
47+
contents: read
4148
outputs:
4249
cache-key: ${{ steps.pixi-lock.outputs.cache-key }}
4350
pixi-version: ${{ steps.pixi-lock.outputs.pixi-version }}
4451
steps:
45-
- uses: actions/checkout@v4
52+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
53+
with:
54+
persist-credentials: false
4655
- uses: Parcels-code/pixi-lock/create-and-cache@a9aee67fa67426e6b0297fa5bef80600572be153
4756
id: pixi-lock
48-
- uses: actions/upload-artifact@v7
57+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
4958
with:
5059
name: pixi-lock
5160
path: pixi.lock
@@ -54,6 +63,8 @@ jobs:
5463
name: "Unit tests: ${{ matrix.os }} | pixi run -e ${{ matrix.pixi-environment }} tests"
5564
runs-on: ${{ matrix.os }}-latest
5665
needs: [cache-pixi-lock]
66+
permissions:
67+
contents: read
5768
env:
5869
COVERAGE_REPORT: "${{ matrix.os }}_${{ matrix.pixi-environment }}_unit_test_report.html"
5970
strategy:
@@ -69,12 +80,14 @@ jobs:
6980
- os: ubuntu
7081
pixi-environment: "test-minimum"
7182
steps:
72-
- uses: actions/checkout@v5
83+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
84+
with:
85+
persist-credentials: false
7386
- name: Restore cached pixi lockfile
7487
uses: Parcels-code/pixi-lock/restore@a9aee67fa67426e6b0297fa5bef80600572be153
7588
with:
7689
cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
77-
- uses: prefix-dev/setup-pixi@v0.9.0
90+
- uses: prefix-dev/setup-pixi@fef5c9568ca6c4ff7707bf840ab0692ba3f08293 # v0.9.0
7891
with:
7992
pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
8093
locked: false # TODO: Remove once v7 of the lock file is removed, or once we stop having external source dependencies https://github.com/Parcels-code/Parcels/pull/2550#issuecomment-4088660238
@@ -83,7 +96,7 @@ jobs:
8396
# https://github.com/actions/cache/blob/main/tips-and-workarounds.md#update-a-cache
8497
- name: Restore cached hypothesis directory
8598
id: restore-hypothesis-cache
86-
uses: actions/cache/restore@v4
99+
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
87100
with:
88101
path: .hypothesis/
89102
key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}
@@ -92,31 +105,33 @@ jobs:
92105
- name: Unit test
93106
id: unit-test
94107
run: |
95-
pixi run -e ${{ matrix.pixi-environment }} tests -v -s --cov=parcels --cov-report=xml --html="${{ env.COVERAGE_REPORT }}" --self-contained-html
108+
pixi run -e ${{ matrix.pixi-environment }} tests -v -s --cov=parcels --cov-report=xml --html="${COVERAGE_REPORT}" --self-contained-html
96109
# explicitly save the cache so it gets updated, also do this even if it fails.
97110
- name: Save cached hypothesis directory
98111
id: save-hypothesis-cache
99112
if: always() && steps.unit-test.outcome != 'skipped'
100-
uses: actions/cache/save@v4
113+
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
101114
with:
102115
path: .hypothesis/
103116
key: cache-hypothesis-${{ runner.os }}-${{ github.run_id }}
104117
- name: Codecov
105-
uses: codecov/codecov-action@v5.5.1
118+
uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
106119
env:
107-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
120+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]
108121
with:
109122
flags: unit-tests
110123
- name: Upload test results
111124
if: ${{ always() }} # Always run this step, even if tests fail
112-
uses: actions/upload-artifact@v7
125+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
113126
with:
114127
name: Unittest report ${{ matrix.os }}-${{ matrix.pixi-environment }}
115128
path: ${{ env.COVERAGE_REPORT }}
116129
integration-test:
117130
name: "Integration: ${{ matrix.os }} | pixi run -e ${{ matrix.pixi-environment }} tests-notebooks"
118131
runs-on: ${{ matrix.os }}-latest
119132
needs: [cache-pixi-lock]
133+
permissions:
134+
contents: read
120135
# TODO v4: Re-enable the workflow once development has stabilized and we want to run integration tests again
121136
if: false
122137
env:
@@ -130,56 +145,63 @@ jobs:
130145
- os: ubuntu
131146
python-version: "3.11"
132147
steps:
133-
- uses: actions/checkout@v5
148+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
149+
with:
150+
persist-credentials: false
134151
- name: Restore cached pixi lockfile
135152
uses: Parcels-code/pixi-lock/restore@a9aee67fa67426e6b0297fa5bef80600572be153
136153
with:
137154
cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
138-
- uses: prefix-dev/setup-pixi@v0.9.0
155+
- uses: prefix-dev/setup-pixi@fef5c9568ca6c4ff7707bf840ab0692ba3f08293 # v0.9.0
139156
with:
140157
pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
141158
locked: false # TODO: Remove once v7 of the lock file is removed, or once we stop having external source dependencies https://github.com/Parcels-code/Parcels/pull/2550#issuecomment-4088660238
142159
cache: true
143160
cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
144161
- name: Integration test
145162
run: |
146-
pixi run test-notebooks -v -s --html="${{ env.COVERAGE_REPORT }}" --self-contained-html --cov=parcels --cov-report=xml
163+
pixi run test-notebooks -v -s --html="${COVERAGE_REPORT}" --self-contained-html --cov=parcels --cov-report=xml
147164
- name: Codecov
148-
uses: codecov/codecov-action@v5.5.1
165+
uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
149166
env:
150-
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
167+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]
151168
with:
152169
flags: integration-tests
153170
- name: Upload test results
154171
if: ${{ always() }} # Always run this step, even if tests fail
155-
uses: actions/upload-artifact@v7
172+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
156173
with:
157174
name: Integration test report ${{ matrix.os }}-${{ matrix.pixi-environment }}
158175
path: ${{ env.COVERAGE_REPORT }}
159176
merge-test-artifacts:
160177
runs-on: ubuntu-latest
178+
permissions: {}
161179
needs:
162180
- unit-test
163181
- integration-test
164182
- typechecking
165183
steps:
166184
- name: Merge Artifacts
167-
uses: actions/upload-artifact/merge@v7
185+
uses: actions/upload-artifact/merge@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
168186
with:
169187
name: Testing reports
170188
pattern: "* report *"
171189
typechecking:
172190
name: "TypeChecking: pixi run typing"
173191
runs-on: ubuntu-latest
174192
needs: [cache-pixi-lock]
193+
permissions:
194+
contents: read
175195
steps:
176196
- name: Checkout
177-
uses: actions/checkout@v5
197+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
198+
with:
199+
persist-credentials: false
178200
- name: Restore cached pixi lockfile
179201
uses: Parcels-code/pixi-lock/restore@a9aee67fa67426e6b0297fa5bef80600572be153
180202
with:
181203
cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
182-
- uses: prefix-dev/setup-pixi@v0.9.0
204+
- uses: prefix-dev/setup-pixi@fef5c9568ca6c4ff7707bf840ab0692ba3f08293 # v0.9.0
183205
with:
184206
pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
185207
locked: false # TODO: Remove once v7 of the lock file is removed, or once we stop having external source dependencies https://github.com/Parcels-code/Parcels/pull/2550#issuecomment-4088660238
@@ -195,14 +217,15 @@ jobs:
195217
id-token: write
196218
runs-on: ubuntu-latest
197219
steps:
198-
- uses: actions/checkout@v5
220+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
199221
with:
200222
fetch-depth: 0
223+
persist-credentials: false
201224
- name: Restore cached pixi lockfile
202225
uses: Parcels-code/pixi-lock/restore@a9aee67fa67426e6b0297fa5bef80600572be153
203226
with:
204227
cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
205-
- uses: prefix-dev/setup-pixi@v0.9.0
228+
- uses: prefix-dev/setup-pixi@fef5c9568ca6c4ff7707bf840ab0692ba3f08293 # v0.9.0
206229
with:
207230
pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
208231
locked: false # TODO: Remove once v7 of the lock file is removed, or once we stop having external source dependencies https://github.com/Parcels-code/Parcels/pull/2550#issuecomment-4088660238
@@ -219,4 +242,4 @@ jobs:
219242
pixi run -e build rattler-build upload prefix -c parcels "${pkg}"
220243
done
221244
env:
222-
PREFIX_API_KEY: ${{ secrets.PREFIX_API_KEY }}
245+
PREFIX_API_KEY: ${{ secrets.PREFIX_API_KEY }} # zizmor: ignore[secrets-outside-env]

‎.github/workflows/pypi-release.yml‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,20 @@ on:
88
- "v*"
99
workflow_dispatch:
1010

11+
permissions: {}
12+
1113
jobs:
1214
build-artifacts:
1315
runs-on: ubuntu-latest
1416
if: github.repository == 'Parcels-code/parcels'
17+
permissions:
18+
contents: read
1519
steps:
16-
- uses: actions/checkout@v5
20+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
1721
with:
1822
fetch-depth: 0
19-
- uses: actions/setup-python@v6
23+
persist-credentials: false
24+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
2025
name: Install Python
2126
with:
2227
python-version: "3.11"
@@ -42,20 +47,22 @@ jobs:
4247
else
4348
echo "✅ Looks good"
4449
fi
45-
- uses: actions/upload-artifact@v7
50+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
4651
with:
4752
name: releases
4853
path: dist
4954

5055
test-built-dist:
5156
needs: build-artifacts
5257
runs-on: ubuntu-latest
58+
permissions: {}
59+
environment: test-pypi
5360
steps:
54-
- uses: actions/setup-python@v6
61+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
5562
name: Install Python
5663
with:
5764
python-version: "3.11"
58-
- uses: actions/download-artifact@v8
65+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
5966
with:
6067
name: releases
6168
path: dist
@@ -72,7 +79,7 @@ jobs:
7279
7380
- name: Publish package to TestPyPI
7481
if: github.event_name == 'push'
75-
uses: pypa/gh-action-pypi-publish@v1.12.4
82+
uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4 # zizmor: ignore[use-trusted-publishing]
7683
with:
7784
user: __token__
7885
password: ${{ secrets.PARCELS_PYPI_TEST_TOKEN }}
@@ -83,19 +90,21 @@ jobs:
8390
needs: test-built-dist
8491
if: github.event_name == 'release'
8592
runs-on: ubuntu-latest
93+
permissions: {}
8694
steps:
87-
- uses: actions/download-artifact@v8
95+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
8896
with:
8997
name: releases
9098
path: dist
9199
- name: Publish package to PyPI
92-
uses: pypa/gh-action-pypi-publish@v1.12.4
100+
uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
93101

94102
test-pypi-release:
95103
needs: upload-to-pypi
96104
runs-on: ubuntu-latest
105+
permissions: {}
97106
steps:
98-
- uses: conda-incubator/setup-miniconda@v3
107+
- uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3
99108
with:
100109
activate-environment: parcels
101110
python-version: "3.11"

‎.pre-commit-config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ repos:
99
- id: check-json
1010
types: [text]
1111
files: \.(json|ipynb)$
12+
- repo: https://github.com/zizmorcore/zizmor-pre-commit
13+
rev: v1.23.1
14+
hooks:
15+
- id: zizmor
1216
- repo: https://github.com/astral-sh/ruff-pre-commit
1317
rev: v0.15.4
1418
hooks:

0 commit comments

Comments
 (0)