diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml index a2969c49..643cd888 100644 --- a/.github/workflows/downstream.yml +++ b/.github/workflows/downstream.yml @@ -10,9 +10,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: ipython package_spec: -e .[test] @@ -21,9 +23,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: nbconvert package_spec: -e .[test] @@ -32,9 +36,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: jupyter_server @@ -42,9 +48,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: ipywidgets @@ -52,9 +60,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 - - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 + - uses: jupyterlab/maintainer-tools/.github/actions/downstream-test@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: package_name: notebook test_command: pytest -vv --ignore-glob=notebook/tests/selenium/* --ignore-glob=notebook/nbconvert/tests/* --ignore-glob=notebook/services/nbconvert/tests/* diff --git a/.github/workflows/prep-release.yml b/.github/workflows/prep-release.yml index c84d5eba..51fff01a 100644 --- a/.github/workflows/prep-release.yml +++ b/.github/workflows/prep-release.yml @@ -29,14 +29,14 @@ jobs: permissions: contents: write steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - name: Prep Release id: prep-release - uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ secrets.GITHUB_TOKEN }} version_spec: ${{ github.event.inputs.version_spec }} @@ -49,4 +49,6 @@ jobs: - name: "** Next Step **" run: | - echo "Optional): Review Draft Release: ${{ steps.prep-release.outputs.release_url }}" + echo "Optional): Review Draft Release: ${STEPS_PREP_RELEASE_OUTPUTS_RELEASE_URL}" + env: + STEPS_PREP_RELEASE_OUTPUTS_RELEASE_URL: ${{ steps.prep-release.outputs.release_url }} diff --git a/.github/workflows/publish-changelog.yml b/.github/workflows/publish-changelog.yml index 213d018e..545f3735 100644 --- a/.github/workflows/publish-changelog.yml +++ b/.github/workflows/publish-changelog.yml @@ -14,12 +14,12 @@ jobs: runs-on: ubuntu-latest environment: release steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - - uses: actions/create-github-app-token@v3 + - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: app-id: ${{ vars.APP_ID }} @@ -27,11 +27,13 @@ jobs: - name: Publish changelog id: publish-changelog - uses: jupyter-server/jupyter_releaser/.github/actions/publish-changelog@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/publish-changelog@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ steps.app-token.outputs.token }} branch: ${{ github.event.inputs.branch }} - name: "** Next Step **" run: | - echo "Merge the changelog update PR: ${{ steps.publish-changelog.outputs.pr_url }}" + echo "Merge the changelog update PR: ${STEPS_PUBLISH_CHANGELOG_OUTPUTS_PR_URL}" + env: + STEPS_PUBLISH_CHANGELOG_OUTPUTS_PR_URL: ${{ steps.publish-changelog.outputs.pr_url }} diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 81937c40..07d0e73c 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -19,12 +19,12 @@ jobs: permissions: id-token: write steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - - uses: actions/create-github-app-token@v3 + - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 id: app-token with: app-id: ${{ vars.APP_ID }} @@ -32,7 +32,7 @@ jobs: - name: Populate Release id: populate-release - uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ steps.app-token.outputs.token }} branch: ${{ github.event.inputs.branch }} @@ -41,7 +41,7 @@ jobs: - name: Finalize Release id: finalize-release - uses: jupyter-server/jupyter_releaser/.github/actions/finalize-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/finalize-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ steps.app-token.outputs.token }} release_url: ${{ steps.populate-release.outputs.release_url }} @@ -50,10 +50,14 @@ jobs: if: ${{ success() }} run: | echo "Verify the final release" - echo ${{ steps.finalize-release.outputs.release_url }} + echo ${STEPS_FINALIZE_RELEASE_OUTPUTS_RELEASE_URL} + env: + STEPS_FINALIZE_RELEASE_OUTPUTS_RELEASE_URL: ${{ steps.finalize-release.outputs.release_url }} - name: "** Failure Message **" if: ${{ failure() }} run: | echo "Failed to Publish the Draft Release Url:" - echo ${{ steps.populate-release.outputs.release_url }} + echo ${STEPS_POPULATE_RELEASE_OUTPUTS_RELEASE_URL} + env: + STEPS_POPULATE_RELEASE_OUTPUTS_RELEASE_URL: ${{ steps.populate-release.outputs.release_url }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index a4c24693..194235c1 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -41,8 +41,10 @@ jobs: python-version: "pypy-3.11" steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" @@ -51,7 +53,7 @@ jobs: # Codecov merges the uploads of every matrix job into one report for # the commit, so each job uploads its own and nothing combines them here. - name: Upload coverage to Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 with: files: coverage.xml disable_search: true @@ -66,9 +68,11 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: dependency_type: minimum node_version: "none" @@ -80,8 +84,10 @@ jobs: name: Test Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" @@ -96,8 +102,10 @@ jobs: timeout-minutes: 10 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" @@ -110,9 +118,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: dependency_type: pre node_version: "none" @@ -125,12 +135,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: actions/checkout@v7 - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - - uses: jupyterlab/maintainer-tools/.github/actions/make-sdist@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/make-sdist@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 test_sdist: runs-on: ubuntu-latest @@ -138,11 +150,11 @@ jobs: name: Install from SDist and Test timeout-minutes: 20 steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - - uses: jupyterlab/maintainer-tools/.github/actions/test-sdist@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/test-sdist@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 # Downstream projects are slow and only meaningful if traitlets itself is # healthy, so hold them until every fast job has finished and passed. @@ -154,25 +166,27 @@ jobs: - test_docs - test_prereleases - test_sdist - uses: ./.github/workflows/downstream.yml + uses: $/.github/workflows/downstream.yml check_links: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" - - uses: jupyterlab/maintainer-tools/.github/actions/check-links@v1 + - uses: jupyterlab/maintainer-tools/.github/actions/check-links@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 check_release: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Base Setup - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1 + uses: jupyterlab/maintainer-tools/.github/actions/base-setup@21b1cac622018fd37ec13a1c8081da814e10d94e # v1.0.0 with: node_version: "none" python_package_manager: "uv pip" @@ -180,6 +194,6 @@ jobs: run: | pip install -e . - name: Check Release - uses: jupyter-server/jupyter_releaser/.github/actions/check-release@v2 + uses: jupyter-server/jupyter_releaser/.github/actions/check-release@70e58c50c736ad496cca11fe4f2446033b68b027 # v2 with: token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..8c972647 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,33 @@ +name: Zizmor + +on: + push: + branches: [main] + pull_request: + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: {} + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + security-events: write # upload SARIF results to code scanning + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Run zizmor + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 + with: + advanced-security: true + online-audits: true + persona: regular + version: 1.31.1