Skip to content

Add zizmor and lock GitHub Actions dependencies #493

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
savannahostrowski wants to merge 1 commit into
base: main
Choose a base branch
from
+137 −18
Open

Add zizmor and lock GitHub Actions dependencies #493

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,20 @@

version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "quarterly"
groups:
actions:
patterns:
- "*"
cooldown:
default-days: 14

- package-ecosystem: "pip" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
interval: "quarterly"
cooldown:
default-days: 14
66 changes: 66 additions & 0 deletions .github/workflows/actions.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
# This file is machine-generated by `gh actions-lock`.
# Do not edit by hand; run `gh actions-lock` to update.
# Docs: https://gh.io/actions-lockfile
version: 'v0.0.3'
workflows:
'.github/workflows/ci.yml':
- 'actions/checkout@v6.0.2'
- 'actions/setup-python@v6.2.0'
'.github/workflows/pypi.yml':
- 'actions/checkout@v6.0.2'
- 'actions/download-artifact@v8.0.1'
- 'actions/setup-python@v6.2.0'
- 'actions/upload-artifact@v7.0.1'
- 'pypa/gh-action-pypi-publish@v1.14.0'
- 'sigstore/gh-action-sigstore-python@v3.3.0'
dependencies:
'actions/checkout@v6.0.2':
ref: 'v6.0.2'
commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
owner_id: 44036562
repo_id: 197814629
'actions/download-artifact@v8.0.1':
ref: 'v8.0.1'
commit: 'sha1-3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c'
owner_id: 44036562
repo_id: 192626254
'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065':
ref: 'v5.6.0'
commit: 'sha1-a26af69be951a213d495a4c3e4e4022e16d87065'
owner_id: 44036562
repo_id: 192625525
'actions/setup-python@v6.2.0':
ref: 'v6.2.0'
commit: 'sha1-a309ff8b426b58ec0e2a45f0f869d46889d02405'
owner_id: 44036562
repo_id: 192625525
'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
ref: 'v7.0.0'
commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
owner_id: 44036562
repo_id: 192625955
'actions/upload-artifact@v7.0.1':
ref: 'v7.0.1'
commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
owner_id: 44036562
repo_id: 192625955
'pypa/gh-action-pypi-publish@v1.14.0':
ref: 'v1.14.0'
commit: 'sha1-cef221092ed1bacb1cc03d23a2d87d1d172e277b'
owner_id: 647025
repo_id: 178055147
uses:
- 'actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065'
'sigstore/gh-action-sigstore-python@v3.3.0':
ref: 'v3.3.0'
commit: 'sha1-04cffa1d795717b140764e8b640de88853c92acc'
owner_id: 71096353
repo_id: 508560980
uses:
- 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
- 'softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe'
'softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe':
ref: 'v2.6.1'
commit: 'sha1-153bb8e04406b158c6c84fc1615b65b24149a1fe'
owner_id: 2242
repo_id: 204253808
42 changes: 34 additions & 8 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,18 @@ name: ci
branches:
- main

permissions:
contents: read

jobs:
lint:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
- uses: actions/checkout@v6.0.2
with:
persist-credentials: false
- uses: actions/setup-python@v6.2.0
with:
python-version: "3.11"
cache: pip
Expand All @@ -21,14 +27,30 @@ jobs:
- name: Run lints
run: ./lint.sh

lockfile:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@v6.0.2
with:
persist-credentials: false
- name: Verify workflow lockfile
env:
GH_TOKEN: ${{ github.token }}
run: |
gh extension install github/gh-actions-lock --pin v0.4.1
gh actions-lock --verify

test:
runs-on: ubuntu-latest
strategy:
matrix:
python_version: ["3.11", "3.12", "3.13"]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
- uses: actions/checkout@v6.0.2
with:
persist-credentials: false
- uses: actions/setup-python@v6.2.0
with:
python-version: ${{ matrix.python_version }}
cache: pip
Expand All @@ -42,8 +64,10 @@ jobs:
long_test_linux:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
- uses: actions/checkout@v6.0.2
with:
persist-credentials: false
- uses: actions/setup-python@v6.2.0
with:
python-version: 3.13
cache: pip
Expand All @@ -57,8 +81,10 @@ jobs:
long_test_windows:
runs-on: windows-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
- uses: actions/checkout@v6.0.2
with:
persist-credentials: false
- uses: actions/setup-python@v6.2.0
with:
python-version: 3.13
cache: pip
Expand Down
19 changes: 11 additions & 8 deletions .github/workflows/pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,20 @@ on:
tags:
- 'v*.*.*'

permissions:
contents: read

jobs:
build:
name: Build distribution 📦
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@v6.0.2
with:
persist-credentials: false
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
uses: actions/setup-python@v6.2.0
with:
python-version: "3.x"
- name: Install pypa/build
Expand All @@ -27,7 +30,7 @@ jobs:
run: |
python3 -m build
- name: Store the distribution packages
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
uses: actions/upload-artifact@v7.0.1
with:
name: python-package-distributions
path: dist/
Expand All @@ -46,12 +49,12 @@ jobs:

steps:
- name: Download all the dists
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
uses: actions/download-artifact@v8.0.1
with:
name: python-package-distributions
path: dist/
- name: Publish distribution 📦 to PyPI
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b #v1.14.0
uses: pypa/gh-action-pypi-publish@v1.14.0

github-release:
name: >-
Expand All @@ -67,12 +70,12 @@ jobs:

steps:
- name: Download all the dists
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
uses: actions/download-artifact@v8.0.1
with:
name: python-package-distributions
path: dist/
- name: Sign the dists with Sigstore
uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
uses: sigstore/gh-action-sigstore-python@v3.3.0
with:
inputs: >-
./dist/*.tar.gz
Expand All @@ -94,4 +97,4 @@ jobs:
run: >-
gh release upload
"$GITHUB_REF_NAME" dist/**
--repo "$GITHUB_REPOSITORY"
--repo "$GITHUB_REPOSITORY"
9 changes: 9 additions & 0 deletions DEVELOPER.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,15 @@

This repository contains a number of GitHub Actions workflows to run benchmarks on a set of private, self-hosted, bare metal machines.

## CI checks

Install the test dependencies with `python -m pip install '.[test]'`, then run
`./lint.sh`, which includes zizmor checks for `.github`.

After changing action references or adding workflows under `.github/workflows`,
run `gh actions-lock` and commit the updated lockfile with the workflow changes.
This requires the [gh-actions-lock extension](https://github.com/github/gh-actions-lock).

## The workflows

There is a single user-facing workflow, `benchmark.yml`, that [reuses](https://docs.github.com/en/actions/using-workflows/reusing-workflows) the other workflows, prefixed with `_`.
Expand Down
1 change: 1 addition & 0 deletions lint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,4 @@ set -e
python -m black --check bench_runner tests
python -m flake8 bench_runner tests
python -m pyright bench_runner
zizmor --offline --strict-collection .github
3 changes: 2 additions & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ test = [
"pytest==9.2.0",
"pytest-cov==6.2.1",
"pytest-xdist==3.8.0",
"zizmor==1.32.0",
]

[tool.setuptools_scm]
Expand All @@ -54,4 +55,4 @@ source = [
"bench_runner",
"/tmp/pytest-of-*/pytest-*/*/repo/outer_venv/lib/python*/site-packages/bench_runner",
"/tmp/pytest-of-*/pytest-*/*/repo/venv/lib/python*/site-packages/bench_runner",
]
]
Loading