Skip to content

Commit b21817e

Browse files
rffontenellerffontenelle
committed
Apply fixes for zizmor findings
1 parent 8934dcb commit b21817e

12 files changed

Lines changed: 142 additions & 58 deletions

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ updates:
44
directory: "/"
55
schedule:
66
interval: "weekly"
7+
cooldown:
8+
default-days: 7
79
assignees:
810
- "rffontenelle"
911
commit-message:
@@ -17,6 +19,8 @@ updates:
1719
directory: "/"
1820
schedule:
1921
interval: "weekly"
22+
cooldown:
23+
default-days: 7
2024
assignees:
2125
- "rffontenelle"
2226
commit-message:

‎.github/workflows/check.yml‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ on:
2424
required: true
2525
type: string
2626
secrets:
27-
TELEGRAM_TOKEN:
27+
telegram_token:
2828
description: "Token required for interacting with Telegram API"
2929
required: false
30-
TELEGRAM_TO:
30+
telegram_to:
3131
description: "Account ID that will receive the telegram notification"
3232
required: false
3333

@@ -52,12 +52,13 @@ jobs:
5252
matrix:
5353
format: [ html, latex, epub ]
5454
steps:
55-
- uses: actions/checkout@v7
55+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
5656
with:
5757
fetch-depth: 5
58+
persist-credentials: false
5859

5960
- name: Set up Python 3
60-
uses: actions/setup-python@v7
61+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
6162
with:
6263
python-version: ${{ inputs.version }}
6364
cache: pip
@@ -75,7 +76,7 @@ jobs:
7576
run: sudo apt update -y && sudo apt install librsvg2-bin -y
7677

7778
- name: Add problem matcher
78-
uses: sphinx-doc/github-problem-matcher@v1.1
79+
uses: sphinx-doc/github-problem-matcher@1f74d6599f4a5e89a20d3c99aab4e6a70f7bda0f # v1.1
7980

8081
- name: Build docs
8182
id: build
@@ -93,24 +94,24 @@ jobs:
9394

9495
- name: Notify via Telegram
9596
if: always() && steps.prepare.outcome == 'success' && github.event_name == 'schedule' && inputs.tx_project == 'python-newest'
96-
uses: appleboy/telegram-action@v1.0.1
97+
uses: appleboy/telegram-action@221e6b684967abe813051ee4a37dd61770a83ad3 # v1.0.1
9798
with:
98-
to: ${{ secrets.TELEGRAM_TO }}
99-
token: ${{ secrets.TELEGRAM_TOKEN }}
99+
to: ${{ secrets.telegram_to }}
100+
token: ${{ secrets.telegram_token }}
100101
format: markdown
101102
disable_web_page_preview: true
102103
message_file: logs/notify.txt
103104

104105
- name: Upload artifact - log files
105106
if: always() && steps.build.outcome == 'failure'
106-
uses: actions/upload-artifact@v7
107+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
107108
with:
108109
name: logs-${{ inputs.version }}-${{ matrix.format }}
109110
path: logs/*
110111

111112
- name: Upload artifact - docs
112113
if: always() && steps.build.outcome == 'success'
113-
uses: actions/upload-artifact@v7
114+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
114115
with:
115116
name: python-docs-pt-br-${{ inputs.version }}-${{ matrix.format }}
116117
path: cpython/Doc/build/${{ matrix.format }}
@@ -121,13 +122,13 @@ jobs:
121122
runs-on: ubuntu-latest
122123
needs: [ 'build' ]
123124
steps:
124-
- uses: actions/download-artifact@v8
125+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
125126
with:
126127
name: python-docs-pt-br-${{ inputs.version }}-latex
127128
- run: sudo apt-get update
128129
- run: sudo apt-get install -y latexmk texlive-xetex fonts-freefont-otf xindy texlive-lang-portuguese
129130
- run: make
130-
- uses: actions/upload-artifact@v7
131+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
131132
if: always()
132133
with:
133134
name: python-docs-pt-br-${{ inputs.version }}-pdf
@@ -139,12 +140,13 @@ jobs:
139140
name: Lint translations
140141
runs-on: ubuntu-latest
141142
steps:
142-
- uses: actions/checkout@v7
143+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
143144
with:
144145
fetch-depth: 5
146+
persist-credentials: false
145147

146148
- name: Set up Python 3
147-
uses: actions/setup-python@v7
149+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
148150
with:
149151
python-version: ${{ inputs.version }}
150152
cache: pip
@@ -158,7 +160,7 @@ jobs:
158160
run: ./scripts/setup.sh
159161

160162
- name: Add problem matcher
161-
uses: rffontenelle/sphinx-lint-problem-matcher@v1.0.0
163+
uses: rffontenelle/sphinx-lint-problem-matcher@4270bf50b2c93640a7cbb231c09f8e694699af9f #v1.0.0
162164

163165
- name: lint translations files
164166
id: lint
@@ -176,17 +178,17 @@ jobs:
176178

177179
- name: Notify via Telegram
178180
if: always() && steps.prepare.outcome == 'success' && github.event_name == 'schedule' && inputs.tx_project == 'python-newest'
179-
uses: appleboy/telegram-action@v1.0.1
181+
uses: appleboy/telegram-action@221e6b684967abe813051ee4a37dd61770a83ad3 # v1.0.1
180182
with:
181-
to: ${{ secrets.TELEGRAM_TO }}
182-
token: ${{ secrets.TELEGRAM_TOKEN }}
183+
to: ${{ secrets.telegram_to }}
184+
token: ${{ secrets.telegram_token }}
183185
format: markdown
184186
disable_web_page_preview: true
185187
message_file: logs/notify.txt
186188

187189
- name: Upload artifact - log files
188190
if: always() && steps.lint.outcome == 'failure'
189-
uses: actions/upload-artifact@v7
191+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
190192
with:
191193
name: ${{ inputs.version }}-lint-logs
192194
path: logs/*
@@ -199,9 +201,10 @@ jobs:
199201
name: Check for zero-width space characters
200202
runs-on: ubuntu-latest
201203
steps:
202-
- uses: actions/checkout@v7
204+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
203205
with:
204206
ref: ${{ inputs.version }}
207+
persist-credentials: false
205208

206209
- name: Make sure the repository is up to date
207210
if: github.event_name != 'pull_request'

‎.github/workflows/python-310.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,21 @@ on:
88
jobs:
99
sync:
1010
uses: ./.github/workflows/sync.yml
11+
permissions:
12+
contents: write
1113
with:
1214
tx_project: ${{ github.workflow }}
1315
version: '3.10'
14-
secrets: inherit
16+
secrets:
17+
tx_token: ${{ secrets.TX_TOKEN }}
1518
check:
1619
uses: ./.github/workflows/check.yml
20+
permissions:
21+
contents: read
1722
needs: sync
1823
with:
1924
tx_project: ${{ github.workflow }}
2025
version: '3.10'
21-
secrets: inherit
26+
secrets:
27+
telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
28+
telegram_to: ${{ secrets.TELEGRAM_TO }}

‎.github/workflows/python-311.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,27 @@ on:
55
schedule:
66
- cron: '0 0 * * *'
77

8+
permissions:
9+
contents: write
10+
811
jobs:
912
sync:
1013
uses: ./.github/workflows/sync.yml
14+
permissions:
15+
contents: write
1116
with:
1217
tx_project: ${{ github.workflow }}
1318
version: '3.11'
14-
secrets: inherit
19+
secrets:
20+
tx_token: ${{ secrets.TX_TOKEN }}
1521
check:
1622
uses: ./.github/workflows/check.yml
23+
permissions:
24+
contents: read
1725
needs: sync
1826
with:
1927
tx_project: ${{ github.workflow }}
2028
version: '3.11'
21-
secrets: inherit
29+
secrets:
30+
telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
31+
telegram_to: ${{ secrets.TELEGRAM_TO }}

‎.github/workflows/python-312.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,21 @@ on:
88
jobs:
99
sync:
1010
uses: ./.github/workflows/sync.yml
11+
permissions:
12+
contents: write
1113
with:
1214
tx_project: ${{ github.workflow }}
1315
version: '3.12'
14-
secrets: inherit
16+
secrets:
17+
tx_token: ${{ secrets.TX_TOKEN }}
1518
check:
1619
uses: ./.github/workflows/check.yml
20+
permissions:
21+
contents: read
1722
needs: sync
1823
with:
1924
tx_project: ${{ github.workflow }}
2025
version: '3.12'
21-
secrets: inherit
26+
secrets:
27+
telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
28+
telegram_to: ${{ secrets.TELEGRAM_TO }}

‎.github/workflows/python-313.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,21 @@ on:
1616
jobs:
1717
sync:
1818
uses: ./.github/workflows/sync.yml
19+
permissions:
20+
contents: write
1921
with:
2022
tx_project: ${{ github.workflow }}
2123
version: 3.13
22-
secrets: inherit
24+
secrets:
25+
tx_token: ${{ secrets.TX_TOKEN }}
2326
check:
2427
uses: ./.github/workflows/check.yml
28+
permissions:
29+
contents: read
2530
needs: sync
2631
with:
2732
tx_project: ${{ github.workflow }}
2833
version: 3.13
29-
secrets: inherit
34+
secrets:
35+
telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
36+
telegram_to: ${{ secrets.TELEGRAM_TO }}

‎.github/workflows/python-314.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,21 @@ on:
1616
jobs:
1717
sync:
1818
uses: ./.github/workflows/sync.yml
19+
permissions:
20+
contents: write
1921
with:
2022
tx_project: python-314
2123
version: 3.14
22-
secrets: inherit
24+
secrets:
25+
tx_token: ${{ secrets.TX_TOKEN }}
2326
check:
2427
uses: ./.github/workflows/check.yml
28+
permissions:
29+
contents: read
2530
needs: sync
2631
with:
2732
tx_project: python-314
2833
version: 3.14
29-
secrets: inherit
34+
secrets:
35+
telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
36+
telegram_to: ${{ secrets.TELEGRAM_TO }}

‎.github/workflows/python-315.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,25 @@ on:
1313
- main
1414
- '3.15'
1515

16+
1617
jobs:
1718
sync:
1819
uses: ./.github/workflows/sync.yml
20+
permissions:
21+
contents: write
1922
with:
2023
tx_project: python-newest
2124
version: 3.15
22-
secrets: inherit
25+
secrets:
26+
tx_token: ${{ secrets.TX_TOKEN }}
2327
check:
2428
uses: ./.github/workflows/check.yml
29+
permissions:
30+
contents: read
2531
needs: sync
2632
with:
2733
tx_project: python-newest
2834
version: 3.15
29-
secrets: inherit
35+
secrets:
36+
telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
37+
telegram_to: ${{ secrets.TELEGRAM_TO }}

‎.github/workflows/python-37.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,21 @@ on:
66
jobs:
77
sync:
88
uses: ./.github/workflows/sync.yml
9+
permissions:
10+
contents: write
911
with:
1012
tx_project: ${{ github.workflow }}
1113
version: 3.7
12-
secrets: inherit
14+
secrets:
15+
tx_token: ${{ secrets.TX_TOKEN }}
1316
check:
1417
uses: ./.github/workflows/check.yml
18+
permissions:
19+
contents: read
1520
needs: sync
1621
with:
1722
tx_project: ${{ github.workflow }}
1823
version: 3.7
19-
secrets: inherit
24+
secrets:
25+
telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
26+
telegram_to: ${{ secrets.TELEGRAM_TO }}

‎.github/workflows/python-38.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,21 @@ on:
66
jobs:
77
sync:
88
uses: ./.github/workflows/sync.yml
9+
permissions:
10+
contents: write
911
with:
1012
tx_project: ${{ github.workflow }}
1113
version: 3.8
12-
secrets: inherit
14+
secrets:
15+
tx_token: ${{ secrets.TX_TOKEN }}
1316
check:
1417
uses: ./.github/workflows/check.yml
18+
permissions:
19+
contents: read
1520
needs: sync
1621
with:
1722
tx_project: ${{ github.workflow }}
1823
version: 3.8
19-
secrets: inherit
24+
secrets:
25+
telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
26+
telegram_to: ${{ secrets.TELEGRAM_TO }}

0 commit comments

Comments
 (0)