diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fcdd3e88b..e8e30235b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,6 +8,8 @@ updates: actions: patterns: - "*" + cooldown: + default-days: 7 - package-ecosystem: "pip" directory: "/" schedule: @@ -16,3 +18,5 @@ updates: actions: patterns: - "*" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5783e9edf..92b1d7f6d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,6 +15,9 @@ defaults: run: shell: bash -eux {0} +permissions: + contents: read + jobs: build: runs-on: ${{ matrix.os }} @@ -46,9 +49,11 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} @@ -86,15 +91,17 @@ jobs: cd $HOME python -m ipykernel_launcher --help - - uses: jupyterlab/maintainer-tools/.github/actions/upload-coverage@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/upload-coverage@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 coverage: runs-on: ubuntu-latest needs: - build steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/report-coverage@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/report-coverage@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: fail_under: 80 @@ -102,9 +109,11 @@ jobs: name: Test Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - name: Check mypy deps are in sync with project deps run: hatch run typing:check @@ -118,20 +127,24 @@ jobs: check_release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - - uses: jupyter-server/jupyter_releaser/.github/actions/check-release@v2 + - uses: jupyter-server/jupyter_releaser/.github/actions/check-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ secrets.GITHUB_TOKEN }} test_docs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: python_version: "3.14" @@ -155,10 +168,12 @@ jobs: python-version: ["3.11"] steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - name: Install the Python dependencies without debugpy run: | @@ -178,14 +193,16 @@ jobs: timeout-minutes: 20 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.11" - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: dependency_type: minimum python_version: ${{ matrix.python-version }} @@ -204,10 +221,12 @@ jobs: timeout-minutes: 20 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: dependency_type: pre @@ -220,9 +239,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 20 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/make-sdist@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/make-sdist@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 test_sdist: runs-on: ubuntu-latest @@ -230,12 +251,14 @@ jobs: name: Install from SDist and Test timeout-minutes: 20 steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/test-sdist@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/test-sdist@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 link_check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/check-links@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/check-links@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml index 8d73da022..e4b209ce4 100644 --- a/.github/workflows/downstream.yml +++ b/.github/workflows/downstream.yml @@ -9,18 +9,23 @@ concurrency: group: downstream-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: nbclient: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - name: Run Test - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: nbclient env_values: IPYKERNEL_CELL_NAME=\ @@ -29,13 +34,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - name: Run Test - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: ipywidgets test_command: pytest -vv -raXxs -W default --durations 10 --color=yes @@ -44,13 +51,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - name: Run Test - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: jupyter_client test_command: "pytest -vv -raXxs -W default --durations 10 --color=yes -k 'not (test_input_request or signal_kernel_subprocess)'" @@ -60,13 +69,15 @@ jobs: timeout-minutes: 20 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - name: Run Test - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: ipyparallel package_spec: ".[test]" @@ -75,10 +86,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - name: Run Test run: | diff --git a/.github/workflows/enforce-label.yml b/.github/workflows/enforce-label.yml index 75432d5f8..6ee6e66c8 100644 --- a/.github/workflows/enforce-label.yml +++ b/.github/workflows/enforce-label.yml @@ -14,4 +14,4 @@ jobs: pull-requests: write steps: - name: enforce-triage-label - uses: jupyterlab/maintainer-tools/.github/actions/enforce-label@v1 + uses: jupyterlab/maintainer-tools/.github/actions/enforce-label@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 01b95a8dc..d93f65c72 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -8,6 +8,9 @@ defaults: run: shell: bash -eux {0} +permissions: + contents: read + jobs: build: runs-on: "ubuntu-latest" @@ -17,10 +20,12 @@ jobs: python-version: ["3.12"] steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - name: Build run: | diff --git a/.github/workflows/prep-release.yml b/.github/workflows/prep-release.yml index 396330bb9..008f1fd6b 100644 --- a/.github/workflows/prep-release.yml +++ b/.github/workflows/prep-release.yml @@ -29,11 +29,11 @@ jobs: permissions: contents: write steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - name: Prep Release id: prep-release - uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ secrets.GITHUB_TOKEN }} version_spec: ${{ github.event.inputs.version_spec }} @@ -46,4 +46,6 @@ jobs: - name: "** Next Step **" run: | - echo "Optional): Review Draft Release: ${{ steps.prep-release.outputs.release_url }}" + echo "Optional): Review Draft Release: ${STEPS_PREP_RELEASE_OUTPUTS_RELEASE_URL}" + env: + STEPS_PREP_RELEASE_OUTPUTS_RELEASE_URL: ${{ steps.prep-release.outputs.release_url }} diff --git a/.github/workflows/publish-changelog.yml b/.github/workflows/publish-changelog.yml index 7d3d4b909..a6e0cf6da 100644 --- a/.github/workflows/publish-changelog.yml +++ b/.github/workflows/publish-changelog.yml @@ -9,26 +9,33 @@ on: description: "The branch to target" required: false +permissions: + contents: write + jobs: publish_changelog: runs-on: ubuntu-latest environment: release steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - - uses: actions/create-github-app-token@v3 + - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 id: app-token with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write - name: Publish changelog id: publish-changelog - uses: jupyter-server/jupyter_releaser/.github/actions/publish-changelog@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/publish-changelog@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ steps.app-token.outputs.token }} branch: ${{ github.event.inputs.branch }} - name: "** Next Step **" run: | - echo "Merge the changelog update PR: ${{ steps.publish-changelog.outputs.pr_url }}" + echo "Merge the changelog update PR: ${STEPS_PUBLISH_CHANGELOG_OUTPUTS_PR_URL}" + env: + STEPS_PUBLISH_CHANGELOG_OUTPUTS_PR_URL: ${{ steps.publish-changelog.outputs.pr_url }} diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 6df5d8319..8002d2726 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -12,6 +12,9 @@ on: description: "Comma separated list of steps to skip" required: false +permissions: + contents: write + jobs: publish_release: runs-on: ubuntu-latest @@ -19,17 +22,19 @@ jobs: permissions: id-token: write steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 - - uses: actions/create-github-app-token@v3 + - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 id: app-token with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write - name: Populate Release id: populate-release - uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ steps.app-token.outputs.token }} branch: ${{ github.event.inputs.branch }} @@ -38,7 +43,7 @@ jobs: - name: Finalize Release id: finalize-release - uses: jupyter-server/jupyter_releaser/.github/actions/finalize-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/finalize-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ steps.app-token.outputs.token }} release_url: ${{ steps.populate-release.outputs.release_url }} @@ -47,10 +52,14 @@ jobs: if: ${{ success() }} run: | echo "Verify the final release" - echo ${{ steps.finalize-release.outputs.release_url }} + echo ${STEPS_FINALIZE_RELEASE_OUTPUTS_RELEASE_URL} + env: + STEPS_FINALIZE_RELEASE_OUTPUTS_RELEASE_URL: ${{ steps.finalize-release.outputs.release_url }} - name: "** Failure Message **" if: ${{ failure() }} run: | echo "Failed to Publish the Draft Release Url:" - echo ${{ steps.populate-release.outputs.release_url }} + echo ${STEPS_POPULATE_RELEASE_OUTPUTS_RELEASE_URL} + env: + STEPS_POPULATE_RELEASE_OUTPUTS_RELEASE_URL: ${{ steps.populate-release.outputs.release_url }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 000000000..fd67ffec4 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,39 @@ +name: GitHub Actions Security Analysis with zizmor + +on: + push: + branches: ["main"] + pull_request: + branches: ["main"] + +permissions: + contents: read + +jobs: + zizmor: + runs-on: ubuntu-latest + permissions: + contents: read + # Needed to upload the results to the code-scanning dashboard. + security-events: write + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - name: Install uv + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 + - name: Run zizmor + id: zizmor + run: uvx zizmor --format=sarif . > results.sarif + continue-on-error: true + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Upload SARIF results + if: always() + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + with: + sarif_file: results.sarif + category: zizmor + - name: Fail if zizmor found problems + if: steps.zizmor.outcome == 'failure' + run: exit 1 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 2341b8f7d..f612d4f06 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -32,8 +32,8 @@ repos: - id: mdformat additional_dependencies: [mdformat-footnote] - - repo: https://github.com/pre-commit/mirrors-prettier - rev: "v4.0.0-alpha.8" + - repo: https://github.com/rbubley/mirrors-prettier + rev: "v3.9.6" hooks: - id: prettier types_or: [yaml, html, json]