mirror of
https://github.com/ansible/ansible-documentation.git
synced 2026-03-26 13:18:58 +07:00
86f9d4351e
* ci: fix issues indentified by zizmor GHA linter This fixes issues identified by the zizmor linter which checks for Github Actions security best practicies. Summary of changes: - Remove possibilities for shell injection. These can all only be activated by workflow_dispatch input provided by people who already have access to the repository but still a good idea to tidy this up. Many of these occur in the build-package-docs actions. We should test everything to make sure nothing is broken by these changes. - Explicitly set permissions. This is not strictly required, because we already enforce a limited set of default permissions in the repo's GHA settings, but zizmor wants us to be explicit. - Use `persist-credentials: false` with the checkout action. Also, when rebasing this commit, I added back the manual `nox -s clone-core` step to keep the outputs separate. * ci: run zizmor in CI and noxfile - Adds lockfile - Adds nox session - Adds nox session to CI matrix * ci: fix additional issues identified by zizmor - Add default permissions to new workflows - Add cooldown to dependabot * ci: add zizmor configuration for unpinned-uses We could configure dependabot to pin shared workflow commit SHA hashes, but for now, let's relax the unpinned-uses relax * ci: restore secrets: inheirt for pip-compile workflows See comment for more details. * ci: fix token auth for pip-compile workflow * README: mention that lint session runs GHA checks * Update noxfile.py Co-authored-by: Don Naro <dnaro@redhat.com> * nox zizmor: allow overriding persona * nox: actually run zizmor as part of lint session * ci: use GHA expression instead of shell test Co-authored-by: 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) <wk@sydorenko.org.ua> * ci: use Python to avoid shell+json quoting issues --------- Co-authored-by: Don Naro <dnaro@redhat.com> Co-authored-by: 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) <wk@sydorenko.org.ua>
75 lines
2.3 KiB
YAML
75 lines
2.3 KiB
YAML
---
|
|
name: "Refresh dev dependencies"
|
|
"on":
|
|
schedule:
|
|
# Weekly
|
|
- cron: "0 0 * * 0"
|
|
workflow_dispatch:
|
|
inputs:
|
|
reset-branch:
|
|
type: boolean
|
|
default: false
|
|
labels:
|
|
required: false
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
refresh:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- base-branch: devel
|
|
pr-branch: pip-compile/devel/dev
|
|
nox-args: >-
|
|
-e 'pip-compile(formatters)'
|
|
'pip-compile(typing)'
|
|
'pip-compile(static)'
|
|
'pip-compile(spelling)'
|
|
'pip-compile(tag)'
|
|
'pip-compile(pip-compile)'
|
|
python-versions: "3.12"
|
|
- base-branch: stable-2.20
|
|
pr-branch: pip-compile/stable-2.20/dev
|
|
nox-args: >-
|
|
-e 'pip-compile(formatters)'
|
|
'pip-compile(typing)'
|
|
'pip-compile(static)'
|
|
'pip-compile(spelling)'
|
|
python-versions: "3.12"
|
|
- base-branch: stable-2.19
|
|
pr-branch: pip-compile/stable-2.19/dev
|
|
nox-args: >-
|
|
-e 'pip-compile(formatters)'
|
|
'pip-compile(typing)'
|
|
'pip-compile(static)'
|
|
'pip-compile(spelling)'
|
|
python-versions: "3.11"
|
|
- base-branch: stable-2.18
|
|
pr-branch: pip-compile/stable-2.18/dev
|
|
nox-args: >-
|
|
-e 'pip-compile(formatters)'
|
|
'pip-compile(typing)'
|
|
'pip-compile(static)'
|
|
'pip-compile(spelling)'
|
|
python-versions: "3.11"
|
|
name: "Refresh dev dependencies"
|
|
uses: ./.github/workflows/reusable-pip-compile.yml
|
|
with:
|
|
message: "ci: refresh dev dependencies"
|
|
base-branch: "${{ matrix.base-branch }}"
|
|
pr-branch: "${{ matrix.pr-branch }}"
|
|
nox-args: "${{ matrix.nox-args }}"
|
|
python-versions: "${{ matrix.python-versions }}"
|
|
reset-branch: "${{ inputs.reset-branch || false }}"
|
|
labels: "${{ inputs.labels || 'no_backport,tooling' }}"
|
|
# Pass using inherit, as this seems to be the only possible way to access
|
|
# secrets defined in an enviornment when using nested workflows.
|
|
secrets: inherit # zizmor: ignore[secrets-inherit]
|
|
# secrets:
|
|
# BOT_APP_ID: "${{ secrets.BOT_APP_ID }}"
|
|
# BOT_APP_KEY: "${{ secrets.BOT_APP_KEY }}"
|