diff --git a/.github/workflows/github-actionlint.yml b/.github/workflows/github-actionlint.yml index 1dcfcf8..544a175 100644 --- a/.github/workflows/github-actionlint.yml +++ b/.github/workflows/github-actionlint.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: © 2025 open-nudge +# SPDX-FileCopyrightText: © 2025, 2026 open-nudge # SPDX-FileContributor: szymonmaszke # # SPDX-License-Identifier: Apache-2.0 @@ -54,7 +54,7 @@ jobs: persist-credentials: false - name: "Check workflow files" # yamllint disable rule:line-length - uses: "docker://rhysd/actionlint:1.7.1@sha256:435ecdb63b1169e80ca3e136290072548c07fc4d76a044cf5541021712f8f344" # v1.7.1 + uses: "docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667" # v1.7.12 # yamllint enable rule:line-length with: args: "-color" diff --git a/.github/workflows/pre-commit-config.yml b/.github/workflows/pre-commit-config.yml index a4323ec..c6ef745 100644 --- a/.github/workflows/pre-commit-config.yml +++ b/.github/workflows/pre-commit-config.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: © 2025 open-nudge +# SPDX-FileCopyrightText: © 2025, 2026 open-nudge # SPDX-FileContributor: szymonmaszke # # SPDX-License-Identifier: Apache-2.0 @@ -36,7 +36,7 @@ jobs: # yamllint enable rule:line-length with: check: "pre-commit-config" - group: "pre-commit" + group: "prek" sparse-checkout: | .pre-commit-config.yaml ... diff --git a/.github/workflows/pre-commit-hooks.yml b/.github/workflows/pre-commit-hooks.yml index 7290ee3..2ea2311 100644 --- a/.github/workflows/pre-commit-hooks.yml +++ b/.github/workflows/pre-commit-hooks.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: © 2025 open-nudge +# SPDX-FileCopyrightText: © 2025, 2026 open-nudge # SPDX-FileContributor: szymonmaszke # # SPDX-License-Identifier: Apache-2.0 @@ -36,7 +36,7 @@ jobs: # yamllint enable rule:line-length with: check: "pre-commit-hooks" - group: "pre-commit" + group: "prek" sparse-checkout: | .pre-commit-hooks.yaml ... diff --git a/.github/workflows/release-slsa-provenance-reusable.yml b/.github/workflows/release-slsa-provenance-reusable.yml index 06bf560..945d8f9 100644 --- a/.github/workflows/release-slsa-provenance-reusable.yml +++ b/.github/workflows/release-slsa-provenance-reusable.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: © 2025 open-nudge +# SPDX-FileCopyrightText: © 2025, 2026 open-nudge # SPDX-FileContributor: szymonmaszke # # SPDX-License-Identifier: Apache-2.0 @@ -82,7 +82,7 @@ jobs: # yamllint disable rule:line-length # Currently this action needs to be referred by tag. More details at: # https://github.com/slsa-framework/slsa-github-generator#verification-of-provenance - uses: "slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0" + uses: "slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0" # zizmor: ignore[unpinned-uses] # yamllint enable rule:line-length with: provenance-name: "slsa-provenance-multiple-${{ github.sha }}.intoto.jsonl" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1ac7635..ecb9aa7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: © 2025 open-nudge +# SPDX-FileCopyrightText: © 2025, 2026 open-nudge # SPDX-FileContributor: szymonmaszke # # SPDX-License-Identifier: Apache-2.0 @@ -27,21 +27,27 @@ jobs: sboms: name: "SBOMs" permissions: - id-token: "write" - attestations: "write" + actions: "read" # Required to upload SARIF file to CodeQL. + security-events: "write" # Required to upload SARIF file to security tab. + id-token: "write" # Required to get GH token to attest. + attestations: "write" # Required to upload attestation. + artifact-metadata: "write" # Required to create artifact metadata. contents: "read" # yamllint disable rule:line-length uses: "open-nudge/opentemplate/.github/workflows/release-sboms-reusable.yml@main" # zizmor: ignore[unpinned-uses] # yamllint enable rule:line-length + with: + upload-grype-artifact: true + upload-grype-sarif: true sarifs: name: "SARIFs" permissions: # Required to upload SARIF file to CodeQL. # See: https://github.com/github/codeql-action/issues/2117 - actions: "read" + actions: "read" # Required to upload SARIF file to CodeQL. # Writing security events to upload SARIF file to security tab - security-events: "write" + security-events: "write" # Required to upload SARIF file to security tab. # Only need to read contents contents: "read" # yamllint disable rule:line-length @@ -52,13 +58,12 @@ jobs: name: "Tests" permissions: contents: "read" - # yamllint disable rule:line-length - uses: "open-nudge/opentemplate/.github/workflows/tests-reusable.yml@main" # zizmor: ignore[unpinned-uses] + uses: "./.github/workflows/tests-reusable.yml" docs: name: "Docs" permissions: - contents: "write" + contents: "write" # Required to write documentation to gh-pages. # yamllint disable rule:line-length uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses] # yamllint enable rule:line-length @@ -109,17 +114,18 @@ jobs: - "package-create" permissions: contents: "read" - pull-requests: "read" + pull-requests: "read" # Required to read PR metadata for changelog. # yamllint disable rule:line-length uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses] # yamllint enable rule:line-length with: download: true + full-checkout: true download-name: "dist-${{ github.sha }}" # yamllint disable rule:line-length command: | mkdir -p CHANGELOGS-${{ github.sha }} - export PYTHON_PACKAGE_VERSION="$(echo dist-${{ github.sha }}/dist/*.tar.gz | cut -d '-' -f 2 | cut -d '.' -f 1-3)" + export PYTHON_PACKAGE_VERSION=$(basename dist-${{ github.sha }}/dist/*.tar.gz | cut -d '-' -f 2) pdm run changelog > CHANGELOGS-${{ github.sha }}/CHANGELOG-${{ github.sha }}.md pdm run changelog-latest > CHANGELOGS-${{ github.sha }}/LATEST.md # yamllint enable rule:line-length @@ -175,7 +181,7 @@ jobs: steps: - name: "Harden Runner" # yamllint disable rule:line-length - uses: "step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0" # v2.12.0 + uses: "step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450" # v2.19.1 # yamllint enable rule:line-length with: disable-sudo: true @@ -183,7 +189,7 @@ jobs: allowed-endpoints: "${{ matrix.repository.endpoints }}" - name: "Download artifacts" # yamllint disable rule:line-length - uses: "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093" # v4.3.0 + uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8.0.1 with: name: "dist-${{ github.sha }}" path: "dist" @@ -191,7 +197,7 @@ jobs: if: > ! matrix.repository.skip # yamllint disable rule:line-length - uses: "pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc" # v1.12.4 + uses: "pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e" # v1.13.0 # yamllint enable rule:line-length with: repository-url: "${{ matrix.repository.url }}" @@ -215,7 +221,7 @@ jobs: # yamllint enable rule:indentation - name: "Upload artifacts" # yamllint disable rule:line-length - uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02" # v4.6.2 + uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1 # yamllint enable rule:line-length with: name: "dist-${{ github.sha }}" @@ -233,8 +239,8 @@ jobs: permissions: # Required to upload SARIF file to CodeQL. # See: https://github.com/github/codeql-action/issues/2117 - actions: "read" - contents: "write" + actions: "read" # Required to read the workflow path. + contents: "write" # Required to add assets to the release. id-token: "write" # To sign the provenance. # yamllint disable rule:line-length uses: "open-nudge/opentemplate/.github/workflows/release-slsa-provenance-reusable.yml@main" # zizmor: ignore[unpinned-uses] @@ -247,7 +253,7 @@ jobs: needs: - "slsa-provenance" permissions: - contents: "write" + contents: "write" # Required to push release assets and documentation. # yamllint disable rule:line-length uses: "open-nudge/opentemplate/.github/workflows/release-upload.yml@main" # zizmor: ignore[unpinned-uses] # yamllint enable rule:line-length diff --git a/.github/workflows/run-reusable.yml b/.github/workflows/run-reusable.yml index a21b48d..f0a3074 100644 --- a/.github/workflows/run-reusable.yml +++ b/.github/workflows/run-reusable.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: © 2025 open-nudge +# SPDX-FileCopyrightText: © 2025, 2026 open-nudge # SPDX-FileContributor: szymonmaszke # # SPDX-License-Identifier: Apache-2.0 @@ -113,7 +113,7 @@ jobs: permissions: contents: "read" timeout-minutes: "${{ inputs.timeout-minutes }}" - runs-on: "ubuntu-latest" + runs-on: "${{ inputs.os }}" steps: - name: "Harden Runner" # yamllint disable rule:line-length @@ -214,6 +214,7 @@ jobs: # nosemgrep - name: "Run command" # zizmor: ignore[template-injection] + shell: "bash" env: # GH_TOKEN is used by, for example, zizmor GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" @@ -222,9 +223,6 @@ jobs: run: | ${{ inputs.command }} - - name: "Check repository content" - run: > - ls -la - name: "Upload artifacts" if: > inputs.upload-path != '' diff --git a/.github/workflows/tests-reusable.yml b/.github/workflows/tests-reusable.yml index b3ba34a..04d8a28 100644 --- a/.github/workflows/tests-reusable.yml +++ b/.github/workflows/tests-reusable.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: © 2025 open-nudge +# SPDX-FileCopyrightText: © 2025, 2026 open-nudge # SPDX-FileContributor: szymonmaszke # # SPDX-License-Identifier: Apache-2.0 @@ -48,9 +48,7 @@ jobs: Tests | ${{ matrix.os }} | python-${{ matrix.python }} permissions: contents: "read" - # yamllint disable rule:line-length - uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses] - # yamllint enable rule:line-length + uses: "./.github/workflows/run-reusable.yml" with: # yamllint disable rule:line-length command: | @@ -59,6 +57,7 @@ jobs: # yamllint enable rule:line-length sparse-checkout: | **.py + tests/** group: "tests" core: true # yamllint disable rule:line-length @@ -78,9 +77,7 @@ jobs: needs: "tests-reusable" permissions: contents: "read" - # yamllint disable rule:line-length - uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses] - # yamllint enable rule:line-length + uses: "./.github/workflows/run-reusable.yml" with: # yamllint disable rule:line-length command: | diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 42c9099..dace2b2 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: © 2025 open-nudge +# SPDX-FileCopyrightText: © 2025, 2026 open-nudge # SPDX-FileContributor: szymonmaszke # # SPDX-License-Identifier: Apache-2.0 @@ -36,7 +36,5 @@ jobs: name: "Tests" permissions: contents: "read" - # yamllint disable rule:line-length - uses: "open-nudge/opentemplate/.github/workflows/tests-reusable.yml@main" # zizmor: ignore[unpinned-uses] - # yamllint enable rule:line-length + uses: "./.github/workflows/tests-reusable.yml" ... diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 5b65ccc..4895116 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: © 2025 open-nudge +# SPDX-FileCopyrightText: © 2025, 2026 open-nudge # SPDX-FileContributor: szymonmaszke # # SPDX-License-Identifier: Apache-2.0 @@ -22,7 +22,7 @@ repos: # ############################################################################## - repo: "https://github.com/siderolabs/conform" - rev: "e1fdd4c4624bafa674a905595a26c8d0797ddb6c" # frozen: v0.1.0-alpha.30 + rev: "cfa5066377ea6a751f2df3979a24a65cdc61974e" # frozen: v0.1.0-alpha.31 hooks: # pre-push due to PGP signature - id: "conform" @@ -34,14 +34,14 @@ repos: entry: "conform enforce" pass_filenames: false - repo: "https://github.com/trufflesecurity/trufflehog" - rev: "f15cb8b37b9b70056bc82a8eb7151f75fad27a71" # frozen: v3.90.13 + rev: "6f3c981e7b77f235fd2702dd74af25fc4b72bf11" # frozen: v3.96.0 hooks: - id: "trufflehog" alias: "secrets" name: "<<>> Secrets" verbose: true - repo: "https://github.com/google/osv-scanner/" - rev: "8b6727b2c439cdea8bc3a033bf7c76d76cbaee08" # frozen: v2.2.4 + rev: "a258868211a57052da6bd323f758b8388dee02bb" # frozen: v2.5.0 hooks: - id: "osv-scanner" name: "<<>> OSV Scanner" @@ -50,7 +50,7 @@ repos: - "--licenses=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,Unlicense,Zlib,OFL-1.1,0BSD,PSF-2.0" - "./" - repo: "https://github.com/errata-ai/vale" - rev: "27593b0e0e7eb8f0c2b7fae0d93fa1cfaabceb2f" # frozen: v3.13.0 + rev: "bc78bf3a639f29eef5c6bc3f0680105a82ef46f7" # frozen: v3.17.1 hooks: - id: "vale" alias: "setup-natural-language" @@ -62,14 +62,14 @@ repos: stages: - "pre-commit" - repo: "https://github.com/errata-ai/vale" - rev: "27593b0e0e7eb8f0c2b7fae0d93fa1cfaabceb2f" # frozen: v3.13.0 + rev: "bc78bf3a639f29eef5c6bc3f0680105a82ef46f7" # frozen: v3.17.1 hooks: - id: "vale" alias: "natural-language" name: "<<>> Natural language" verbose: true - repo: "https://github.com/rhysd/actionlint" - rev: "e7d448ef7507c20fc4c88a95d0c448b848cd6127" # frozen: v1.7.8 + rev: "914e7df21a07ef503a81201c76d2b11c789d3fca" # frozen: v1.7.12 hooks: - id: "actionlint" alias: "github-actions-actionlint" @@ -338,6 +338,7 @@ repos: entry: "pdm run -v check-security" language: "system" require_serial: true + exclude: "^pdm.lock$" - id: "release" name: "<<>> Release" entry: "pdm run -v check-release" diff --git a/.yamllint.yml b/.yamllint.yml index 352f1e8..a939c0e 100644 --- a/.yamllint.yml +++ b/.yamllint.yml @@ -1,4 +1,4 @@ -# SPDX-FileCopyrightText: © 2025 open-nudge +# SPDX-FileCopyrightText: © 2025, 2026 open-nudge # SPDX-FileContributor: szymonmaszke # # SPDX-License-Identifier: Apache-2.0 @@ -45,7 +45,7 @@ rules: key-duplicates: "enable" key-ordering: "disable" line-length: - max: 80 + max: 110 allow-non-breakable-words: true allow-non-breakable-inline-mappings: false new-line-at-end-of-file: "enable" diff --git a/README.md b/README.md index bf470df..b513a1b 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@