Skip to content

Adjust GitHub Actions workflows to pass zizmor checks in pedantic mode. #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jpwarren merged 1 commit into from
May 30, 2026
Merged

Adjust GitHub Actions workflows to pass zizmor checks in pedantic mode. #77

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 29 additions & 21 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,17 +17,22 @@ env:

permissions: {}

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

jobs:
build-package:
name: Build & verify package
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
fetch-depth: 0

- uses: hynek/build-and-inspect-python-package@v2
- uses: hynek/build-and-inspect-python-package@d44ca7d91762de7a7d5436ddae667c6da6d1c3df # v2.18.0
id: baipp
with:
skip-wheel: true
Expand All @@ -50,24 +55,24 @@ jobs:

steps:
- name: Download pre-built packages
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: Packages
path: dist
- run: tar xf dist/*.tar.gz --strip-components=1
- uses: actions/setup-python@v5
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ matrix.python-version }}
allow-prereleases: true
- uses: hynek/setup-cached-uv@v2
- uses: hynek/setup-cached-uv@4300ec2180bc77d705e626a34e381b81a4772c51
- run: uv venv
- run: uv pip install .[dev]
- run: |
cd tests
uv run coverage run -p -m pytest

- name: Upload coverage data
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: coverage-data-${{ matrix.python-version }}
path: tests/.coverage.*
Expand All @@ -80,18 +85,18 @@ jobs:

steps:
- name: Download pre-built packages
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: Packages
path: dist
- run: tar xf dist/*.tar.gz --strip-components=1
- uses: actions/setup-python@v5
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version-file: .python-version-default
- uses: hynek/setup-cached-uv@v2
- uses: hynek/setup-cached-uv@4300ec2180bc77d705e626a34e381b81a4772c51

- name: Download coverage data
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: coverage-data-*
merge-multiple: true
Expand All @@ -111,7 +116,7 @@ jobs:
uv run coverage report --fail-under=70

- name: Upload HTML report if check failed.
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: html-report
path: htmlcov
Expand All @@ -123,27 +128,27 @@ jobs:
needs: build-package
steps:
- name: Download pre-built packages
uses: actions/download-artifact@v4
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: Packages
path: dist
- run: tar xf dist/*.tar.gz --strip-components=1
- uses: actions/setup-python@v5
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
# Keep in sync with tox/docs and .readthedocs.yaml.
python-version: "3.12"
- uses: hynek/setup-cached-uv@v2
- uses: hynek/setup-cached-uv@4300ec2180bc77d705e626a34e381b81a4772c51
- run: uv venv

# pyright:
# name: Check types using pyright
# runs-on: ubuntu-latest
# steps:
# - uses: actions/checkout@v4
# - uses: actions/setup-python@v5
# - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
# - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
# with:
# python-version-file: .python-version-default
# - uses: hynek/setup-cached-uv@v2
# - uses: hynek/setup-cached-uv@4300ec2180bc77d705e626a34e381b81a4772c51

# - run: uv venv
# - run: uv pip install .[dev] pyright typing
Expand All @@ -154,11 +159,13 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version-file: .python-version-default
- uses: hynek/setup-cached-uv@v2
- uses: hynek/setup-cached-uv@4300ec2180bc77d705e626a34e381b81a4772c51

- run: uv venv --python $(cat .python-version-default)
- run: uv pip install -e .[dev]
Expand All @@ -171,6 +178,7 @@ jobs:

# Ensure everything required is passing for branch protection.
required-checks-pass:
name: Verify all required checks pass
if: always()

needs:
Expand All @@ -182,6 +190,6 @@ jobs:

steps:
- name: Decide whether the needed jobs succeeded or failed
uses: re-actors/alls-green@release/v1
uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
with:
jobs: ${{ toJSON(needs) }}