diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml index a2969c49..5377a908 100644 --- a/.github/workflows/downstream.yml +++ b/.github/workflows/downstream.yml @@ -5,14 +5,19 @@ name: Test downstream projects on: workflow_call: +permissions: + contents: read + jobs: ipython: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: ipython package_spec: -e .[test] @@ -21,9 +26,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: nbconvert package_spec: -e .[test] @@ -32,9 +39,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: jupyter_server @@ -42,9 +51,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: ipywidgets @@ -52,9 +63,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: notebook test_command: pytest -vv --ignore-glob=notebook/tests/selenium/* --ignore-glob=notebook/nbconvert/tests/* --ignore-glob=notebook/services/nbconvert/tests/* diff --git a/.github/workflows/prep-release.yml b/.github/workflows/prep-release.yml index c84d5eba..51fff01a 100644 --- a/.github/workflows/prep-release.yml +++ b/.github/workflows/prep-release.yml @@ -29,14 +29,14 @@ jobs: permissions: contents: write steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - name: Prep Release id: prep-release - uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ secrets.GITHUB_TOKEN }} version_spec: ${{ github.event.inputs.version_spec }} @@ -49,4 +49,6 @@ jobs: - name: "** Next Step **" run: | - echo "Optional): Review Draft Release: ${{ steps.prep-release.outputs.release_url }}" + echo "Optional): Review Draft Release: ${STEPS_PREP_RELEASE_OUTPUTS_RELEASE_URL}" + env: + STEPS_PREP_RELEASE_OUTPUTS_RELEASE_URL: ${{ steps.prep-release.outputs.release_url }} diff --git a/.github/workflows/publish-changelog.yml b/.github/workflows/publish-changelog.yml index 213d018e..c2fbcfae 100644 --- a/.github/workflows/publish-changelog.yml +++ b/.github/workflows/publish-changelog.yml @@ -13,25 +13,31 @@ jobs: publish_changelog: runs-on: ubuntu-latest environment: release + permissions: + contents: read steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - - uses: actions/create-github-app-token@v3 + - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write - name: Publish changelog id: publish-changelog - uses: jupyter-server/jupyter_releaser/.github/actions/publish-changelog@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/publish-changelog@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ steps.app-token.outputs.token }} branch: ${{ github.event.inputs.branch }} - name: "** Next Step **" run: | - echo "Merge the changelog update PR: ${{ steps.publish-changelog.outputs.pr_url }}" + echo "Merge the changelog update PR: ${STEPS_PUBLISH_CHANGELOG_OUTPUTS_PR_URL}" + env: + STEPS_PUBLISH_CHANGELOG_OUTPUTS_PR_URL: ${{ steps.publish-changelog.outputs.pr_url }} diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 81937c40..8bc6ed2f 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -19,20 +19,21 @@ jobs: permissions: id-token: write steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - - uses: actions/create-github-app-token@v3 + - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} + permission-contents: write - name: Populate Release id: populate-release - uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ steps.app-token.outputs.token }} branch: ${{ github.event.inputs.branch }} @@ -41,7 +42,7 @@ jobs: - name: Finalize Release id: finalize-release - uses: jupyter-server/jupyter_releaser/.github/actions/finalize-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/finalize-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ steps.app-token.outputs.token }} release_url: ${{ steps.populate-release.outputs.release_url }} @@ -50,10 +51,14 @@ jobs: if: ${{ success() }} run: | echo "Verify the final release" - echo ${{ steps.finalize-release.outputs.release_url }} + echo ${STEPS_FINALIZE_RELEASE_OUTPUTS_RELEASE_URL} + env: + STEPS_FINALIZE_RELEASE_OUTPUTS_RELEASE_URL: ${{ steps.finalize-release.outputs.release_url }} - name: "** Failure Message **" if: ${{ failure() }} run: | echo "Failed to Publish the Draft Release Url:" - echo ${{ steps.populate-release.outputs.release_url }} + echo ${STEPS_POPULATE_RELEASE_OUTPUTS_RELEASE_URL} + env: + STEPS_POPULATE_RELEASE_OUTPUTS_RELEASE_URL: ${{ steps.populate-release.outputs.release_url }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index a4c24693..6a917235 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -15,6 +15,9 @@ concurrency: ${{ github.event.pull_request.number || github.sha }} cancel-in-progress: true +permissions: + contents: read + defaults: run: shell: bash -eux {0} @@ -41,8 +44,10 @@ jobs: python-version: "pypy-3.11" steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" @@ -51,7 +56,7 @@ jobs: # Codecov merges the uploads of every matrix job into one report for # the commit, so each job uploads its own and nothing combines them here. - name: Upload coverage to Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 with: files: coverage.xml disable_search: true @@ -66,9 +71,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: dependency_type: minimum node_version: "none" @@ -80,8 +87,10 @@ jobs: name: Test Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" @@ -96,8 +105,10 @@ jobs: timeout-minutes: 10 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" @@ -110,9 +121,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: dependency_type: pre node_version: "none" @@ -125,12 +138,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - - uses: jupyterlab/maintainer-tools/.github/actions/make-sdist@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/make-sdist@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 test_sdist: runs-on: ubuntu-latest @@ -138,11 +153,11 @@ jobs: name: Install from SDist and Test timeout-minutes: 20 steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - - uses: jupyterlab/maintainer-tools/.github/actions/test-sdist@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/test-sdist@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 # Downstream projects are slow and only meaningful if traitlets itself is # healthy, so hold them until every fast job has finished and passed. @@ -154,25 +169,27 @@ jobs: - test_docs - test_prereleases - test_sdist - uses: ./.github/workflows/downstream.yml + uses: $/.github/workflows/downstream.yml check_links: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - - uses: jupyterlab/maintainer-tools/.github/actions/check-links@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/check-links@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 check_release: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" @@ -180,6 +197,6 @@ jobs: run: | pip install -e . - name: Check Release - uses: jupyter-server/jupyter_releaser/.github/actions/check-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/check-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..8c972647 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,33 @@ +name: Zizmor + +on: + push: + branches: [main] + pull_request: + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: {} + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + security-events: write # upload SARIF results to code scanning + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Run zizmor + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 + with: + advanced-security: true + online-audits: true + persona: regular + version: 1.31.1