From d1f2619175a62e80953a097baedf70bc1b2fccad Mon Sep 17 00:00:00 2001 From: Christoph Reiter Date: Tue, 28 Apr 2026 13:08:56 +0200 Subject: [PATCH 1/2] Pin and update actions --- .github/workflows/test.yml | 24 ++++++++++++------------ .github/workflows/wheels.yml | 14 +++++++------- 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 5882d415..2f5653fd 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,10 +18,10 @@ jobs: pkgprefix: mingw-w64-clang-x86_64 steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: setup-msys2 - uses: msys2/setup-msys2@v2 + uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 with: msystem: ${{ matrix.msystem }} update: true @@ -61,7 +61,7 @@ jobs: poetry run coverage xml -i - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 ubuntu: runs-on: ubuntu-latest @@ -70,10 +70,10 @@ jobs: matrix: python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', '3.14t', 'pypy-3.11'] steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ matrix.python-version }} allow-prereleases: true @@ -107,7 +107,7 @@ jobs: uv run coverage xml -i - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 - name: Run linters if: ${{ !contains(matrix.python-version, 'pypy') }} @@ -140,18 +140,18 @@ jobs: architecture: 'arm64' os: 'windows-11-arm' steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python ${{ matrix.python-version }} id: setup-python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ matrix.python-version }} architecture: ${{ matrix.architecture }} allow-prereleases: true - name: Setup MSVC - uses: ilammy/msvc-dev-cmd@v1.13.0 + uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0 with: arch : ${{ matrix.architecture }} @@ -191,14 +191,14 @@ jobs: uv run coverage xml -i - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 macos: runs-on: macos-latest steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install dependencies run: | @@ -221,4 +221,4 @@ jobs: uv run coverage xml -i - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index 858d48ea..eb51d009 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -8,10 +8,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.11' @@ -24,7 +24,7 @@ jobs: - name: Build sdist run: python -m build --sdist - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: sdist path: ./dist/*.tar.gz @@ -47,15 +47,15 @@ jobs: arch: arm64 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup MSVC - uses: ilammy/msvc-dev-cmd@v1.13.0 + uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0 with: arch : ${{ matrix.arch }} - name: Build wheels - uses: pypa/cibuildwheel@v3.2.1 + uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1 env: CFLAGS: "-DCAIRO_WIN32_STATIC_BUILD=1" CIBW_BEFORE_BUILD: "python {package}/.ci/download-cairo-win32.py ${{ matrix.arch }}" @@ -65,7 +65,7 @@ jobs: CIBW_TEST_COMMAND: bash {package}/.ci/test-wheels.sh {package} CIBW_ENVIRONMENT_WINDOWS: PKG_CONFIG_PATH='${{ github.workspace }}/cairo-prebuild/lib/pkgconfig' PKG_CONFIG='${{ github.workspace }}/cairo-prebuild/bin/pkgconf.exe' - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: "wheel-${{ matrix.arch }}" path: ./wheelhouse/*.whl From afb852855c864d76fab1259ffaaa71bd552332b7 Mon Sep 17 00:00:00 2001 From: Christoph Reiter Date: Tue, 28 Apr 2026 13:13:42 +0200 Subject: [PATCH 2/2] Various zizmor warning fixes --- .github/workflows/test.yml | 29 +++++++++++++++++++++++++---- .github/workflows/wheels.yml | 11 +++++++++++ 2 files changed, 36 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2f5653fd..3c754d82 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -4,10 +4,14 @@ on: push: pull_request: +permissions: {} + jobs: msys2: runs-on: windows-latest + permissions: + contents: read strategy: fail-fast: false matrix: @@ -19,6 +23,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: setup-msys2 uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1 @@ -65,12 +71,16 @@ jobs: ubuntu: runs-on: ubuntu-latest + permissions: + contents: read strategy: fail-fast: false matrix: python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', '3.14t', 'pypy-3.11'] steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 @@ -123,6 +133,8 @@ jobs: msvc: runs-on: ${{ matrix.os }} + permissions: + contents: read strategy: fail-fast: false matrix: @@ -141,6 +153,8 @@ jobs: os: 'windows-11-arm' steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} id: setup-python @@ -156,13 +170,17 @@ jobs: arch : ${{ matrix.architecture }} - name: Download and extract Cairo Binary + env: + PYCAIRO_ARCH: ${{ matrix.architecture }} run: | - python .ci/download-cairo-win32.py "${{ matrix.architecture }}" + python .ci/download-cairo-win32.py "$env:PYCAIRO_ARCH" - name: Install dependencies + env: + PYTHON_PATH: ${{ steps.setup-python.outputs.python-path }} run: | - pipx install --python "${{ steps.setup-python.outputs.python-path }}" uv - pipx install --python "${{ steps.setup-python.outputs.python-path }}" meson + pipx install --python "$env:PYTHON_PATH" uv + pipx install --python "$env:PYTHON_PATH" meson uv sync - name: Build & Test with meson @@ -195,10 +213,13 @@ jobs: macos: runs-on: macos-latest - + permissions: + contents: read steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Install dependencies run: | diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index eb51d009..73ea7734 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -2,13 +2,20 @@ name: Build on: [push, pull_request] +permissions: {} + jobs: build_sdist: runs-on: ubuntu-latest + permissions: + contents: read + steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 @@ -32,6 +39,8 @@ jobs: build_wheels: name: Build wheels on ${{ matrix.os }} (${{ matrix.platform_id }}) runs-on: ${{ matrix.os }} + permissions: + contents: read strategy: fail-fast: false matrix: @@ -48,6 +57,8 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Setup MSVC uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0