From 9101dfcdd63280ab7d37c64ee0b538a9be8e752d Mon Sep 17 00:00:00 2001 From: Ashton Date: Sun, 30 Aug 2026 12:35:30 +1000 Subject: [PATCH 1/5] feat: add zizmor to pre commit and fix flagged errors --- .github/workflows/check-pr-template.yml | 2 ++ .github/workflows/ci.yml | 9 +++++++-- .github/workflows/new-issue.yml | 4 +++- .github/workflows/publish.yml | 8 +++++--- .github/workflows/translate.yml | 9 +++++++-- .github/zizmor.yml | 5 +++++ .pre-commit-config.yaml | 4 ++++ 7 files changed, 33 insertions(+), 8 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/check-pr-template.yml b/.github/workflows/check-pr-template.yml index 9196bacb1b..85b9269631 100644 --- a/.github/workflows/check-pr-template.yml +++ b/.github/workflows/check-pr-template.yml @@ -7,4 +7,6 @@ on: jobs: check-pr-template: name: Check PR template + permissions: + contents: read uses: beeware/.github/.github/workflows/pr-checklist.yml@main diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 40bef0a23f..c61453449d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,6 +2,8 @@ name: CI on: pull_request: +permissions: + contents: read # Cancel active CI runs for a PR before starting another run concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -22,17 +24,20 @@ jobs: pre-commit-source: "--group pre-commit" lint: + permissions: + contents: read needs: [ pre-commit ] runs-on: ubuntu-latest timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #V7.0.1 with: fetch-depth: 1 + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #V7.0.0 with: python-version: "3.X" cache: pip diff --git a/.github/workflows/new-issue.yml b/.github/workflows/new-issue.yml index e4a99c000b..b3fafee8ab 100644 --- a/.github/workflows/new-issue.yml +++ b/.github/workflows/new-issue.yml @@ -10,9 +10,11 @@ on: jobs: add-to-project: name: Add issue to BeeWare project + permissions: + contents: write runs-on: ubuntu-latest steps: - - uses: actions/add-to-project@v2.0.0 + - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd #V2.0.0 with: project-url: https://github.com/orgs/beeware/projects/1 github-token: ${{ secrets.BRUTUS_PAT_TOKEN }} diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index bf93c24a23..b2fa3933d9 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -27,12 +27,14 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #V7.0.1 with: fetch-depth: 1 + persist-credentials: false + - name: Set up Python - uses: actions/setup-python@v7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #V7.0.0 with: python-version: "3.X" cache: pip @@ -50,7 +52,7 @@ jobs: run: python -m tox -e docs-all - name: Deploy the built files - uses: JamesIves/github-pages-deploy-action@v4.8.0 + uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f #V4.8.0 with: folder: _build/html # The folder the action should deploy. branch: gh-pages # The branch to which the action should deploy. diff --git a/.github/workflows/translate.yml b/.github/workflows/translate.yml index 064bb83aca..86ec734e8d 100644 --- a/.github/workflows/translate.yml +++ b/.github/workflows/translate.yml @@ -13,18 +13,23 @@ env: jobs: update-translations: + permissions: + contents: write name: Update Translations if: github.repository == 'beeware/beeware.github.io' && github.actor != 'brutusthebee' runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7.0.1 + permissions: + contents: write + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #V7.0.1 with: fetch-depth: 1 + persist-credentials: false token: ${{ secrets.BRUTUS_PAT_TOKEN }} - name: Set up Python - uses: actions/setup-python@v7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #V7.0.0 with: python-version: "3.X" cache: pip diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000000..06d18883d9 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + beeware/*: ref-pin \ No newline at end of file diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index c41a2c5609..e3f0e64808 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -13,3 +13,7 @@ repos: rev: v0.2.43 hooks: - id: rumdl + - repo: https://github.com/zizmorcore/zizmor-pre-commit + rev: v1.26.1 + hooks: + - id: zizmor From a8ea292bd2c69fe8c2d834bb6ece039c7662edc0 Mon Sep 17 00:00:00 2001 From: Ashton Date: Sun, 30 Aug 2026 12:40:21 +1000 Subject: [PATCH 2/5] fix pre commit failing, end of file error --- .github/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 06d18883d9..a99650e81c 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -2,4 +2,4 @@ rules: unpinned-uses: config: policies: - beeware/*: ref-pin \ No newline at end of file + beeware/*: ref-pin From ada6ffc97394cadacd30fa81bd63bd6894d42124 Mon Sep 17 00:00:00 2001 From: Ashton Date: Sun, 30 Aug 2026 13:42:20 +1000 Subject: [PATCH 3/5] address suggestions of using v for versions instead of V, keep zizmor file content same as others, remove unneeded permissions --- .github/workflows/ci.yml | 6 ++---- .github/workflows/publish.yml | 6 +++--- .github/zizmor.yml | 4 ++++ 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c61453449d..2540f92a2d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,20 +24,18 @@ jobs: pre-commit-source: "--group pre-commit" lint: - permissions: - contents: read needs: [ pre-commit ] runs-on: ubuntu-latest timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #V7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 with: fetch-depth: 1 persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #V7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0 with: python-version: "3.X" cache: pip diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index b2fa3933d9..8b72c7c7f3 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -27,14 +27,14 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #V7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 with: fetch-depth: 1 persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #V7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0 with: python-version: "3.X" cache: pip @@ -52,7 +52,7 @@ jobs: run: python -m tox -e docs-all - name: Deploy the built files - uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f #V4.8.0 + uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 #v4.9.0 with: folder: _build/html # The folder the action should deploy. branch: gh-pages # The branch to which the action should deploy. diff --git a/.github/zizmor.yml b/.github/zizmor.yml index a99650e81c..b834affddd 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -1,5 +1,9 @@ rules: unpinned-uses: config: + # Allow BeeWare-provided actions to be unpinned. If an attacker is in a + # position to exploit those action, they're probably able to exploit + # repositories directly; and it's significantly easier for our internal + # actions to automatically be the most recent versions. policies: beeware/*: ref-pin From 967483b219890b3f9c366bcaf0bfce149a53ced9 Mon Sep 17 00:00:00 2001 From: Russell Keith-Magee Date: Sun, 30 Aug 2026 14:01:37 +1000 Subject: [PATCH 4/5] Apply suggestions from code review --- .github/workflows/ci.yml | 5 +++-- .github/workflows/new-issue.yml | 2 +- .github/workflows/publish.yml | 6 +++--- .github/workflows/translate.yml | 4 ++-- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2540f92a2d..0ebaa66506 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,7 @@ on: permissions: contents: read + # Cancel active CI runs for a PR before starting another run concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -29,13 +30,13 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.X" cache: pip diff --git a/.github/workflows/new-issue.yml b/.github/workflows/new-issue.yml index b3fafee8ab..ea7b7c7964 100644 --- a/.github/workflows/new-issue.yml +++ b/.github/workflows/new-issue.yml @@ -14,7 +14,7 @@ jobs: contents: write runs-on: ubuntu-latest steps: - - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd #V2.0.0 + - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0 with: project-url: https://github.com/orgs/beeware/projects/1 github-token: ${{ secrets.BRUTUS_PAT_TOKEN }} diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 8b72c7c7f3..f150e61245 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -27,14 +27,14 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.X" cache: pip @@ -52,7 +52,7 @@ jobs: run: python -m tox -e docs-all - name: Deploy the built files - uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 #v4.9.0 + uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 # v4.9.0 with: folder: _build/html # The folder the action should deploy. branch: gh-pages # The branch to which the action should deploy. diff --git a/.github/workflows/translate.yml b/.github/workflows/translate.yml index 86ec734e8d..a6fe983a02 100644 --- a/.github/workflows/translate.yml +++ b/.github/workflows/translate.yml @@ -22,14 +22,14 @@ jobs: - name: Checkout permissions: contents: write - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #V7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 persist-credentials: false token: ${{ secrets.BRUTUS_PAT_TOKEN }} - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #V7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.X" cache: pip From f57bb0aebe9f7f75d8b37d5d297779ee657abc61 Mon Sep 17 00:00:00 2001 From: Ashton Date: Sun, 30 Aug 2026 14:05:57 +1000 Subject: [PATCH 5/5] fix missed version comments --- .github/workflows/ci.yml | 5 +++-- .github/workflows/new-issue.yml | 2 +- .github/workflows/publish.yml | 6 +++--- .github/workflows/translate.yml | 4 ++-- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2540f92a2d..0ebaa66506 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,7 @@ on: permissions: contents: read + # Cancel active CI runs for a PR before starting another run concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -29,13 +30,13 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.X" cache: pip diff --git a/.github/workflows/new-issue.yml b/.github/workflows/new-issue.yml index b3fafee8ab..ea7b7c7964 100644 --- a/.github/workflows/new-issue.yml +++ b/.github/workflows/new-issue.yml @@ -14,7 +14,7 @@ jobs: contents: write runs-on: ubuntu-latest steps: - - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd #V2.0.0 + - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0 with: project-url: https://github.com/orgs/beeware/projects/1 github-token: ${{ secrets.BRUTUS_PAT_TOKEN }} diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 8b72c7c7f3..f150e61245 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -27,14 +27,14 @@ jobs: timeout-minutes: 5 steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.X" cache: pip @@ -52,7 +52,7 @@ jobs: run: python -m tox -e docs-all - name: Deploy the built files - uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 #v4.9.0 + uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 # v4.9.0 with: folder: _build/html # The folder the action should deploy. branch: gh-pages # The branch to which the action should deploy. diff --git a/.github/workflows/translate.yml b/.github/workflows/translate.yml index 86ec734e8d..a6fe983a02 100644 --- a/.github/workflows/translate.yml +++ b/.github/workflows/translate.yml @@ -22,14 +22,14 @@ jobs: - name: Checkout permissions: contents: write - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #V7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 persist-credentials: false token: ${{ secrets.BRUTUS_PAT_TOKEN }} - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #V7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.X" cache: pip