diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index b9233df..13ffcce 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -8,18 +8,22 @@ on: - master pull_request: +permissions: {} + jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: '3.11' - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 + with: + persist-credentials: false - run: python -m pip install sphinx==5.3.0 furo==2022.9.29 - run: python -m sphinx -W -b html docs/ build/html/ - - uses: actions/upload-pages-artifact@v3 + - uses: actions/upload-pages-artifact@v5 with: path: build/html @@ -33,4 +37,4 @@ jobs: runs-on: ubuntu-latest if: github.ref == 'refs/heads/master' steps: - - uses: actions/deploy-pages@v4 + - uses: actions/deploy-pages@v5 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 07f115f..2fa41a0 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -8,15 +8,30 @@ on: - master pull_request: +permissions: {} + jobs: reuse: runs-on: ubuntu-latest strategy: fail-fast: false steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + with: + persist-credentials: false + - uses: actions/setup-python@v7 with: python-version: '3.12' - run: python -m pip install reuse - run: python -m reuse lint + + zizmor: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + with: + persist-credentials: false + - run: python -m pip install zizmor==1.29.0 + - run: zizmor . + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 7d4f69a..1180379 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -8,6 +8,8 @@ on: - master pull_request: +permissions: {} + jobs: tests: runs-on: ${{ matrix.platform }} @@ -24,17 +26,21 @@ jobs: - '3.13t' - '3.14' - '3.14t' + - '3.15' + - '3.15t' platform: - macos-latest - ubuntu-latest - windows-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + with: + persist-credentials: false + - uses: actions/setup-python@v7 with: python-version: ${{ matrix.python }} allow-prereleases: true - - uses: bus1/cabuild/action/msdevshell@v1 + - uses: bus1/cabuild/action/msdevshell@06ea2833eef61e9b0d0ce0d728416e617e4fb1fe # v1 with: architecture: x64 if: runner.os == 'Windows' diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index 2efaff8..a716e48 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -6,52 +6,45 @@ on: push: tags: - 'v[0-9]*' - workflow_dispatch: + +permissions: {} jobs: wheels: - runs-on: ${{ matrix.os }}-latest + runs-on: ${{ matrix.os }} strategy: fail-fast: false matrix: include: - - os: ubuntu - architecture: x86_64 - - os: ubuntu - architecture: aarch64 - - os: macos - architecture: x86_64 - - os: macos - architecture: arm64 - - os: windows + - os: ubuntu-latest + - os: ubuntu-24.04-arm + - os: windows-latest architecture: x86 - - os: windows - architecture: AMD64 + - os: windows-latest + architecture: x64 + - os: windows-11-arm + architecture: arm64 + - os: macos-15-intel + - os: macos-14 steps: - - uses: actions/checkout@v4 - - uses: docker/setup-qemu-action@v2 + - uses: actions/checkout@v7 with: - platforms: arm64 - if: runner.os == 'Linux' && matrix.architecture == 'aarch64' - - uses: bus1/cabuild/action/msdevshell@v1 + persist-credentials: false + - uses: bus1/cabuild/action/msdevshell@06ea2833eef61e9b0d0ce0d728416e617e4fb1fe # v1 with: - architecture: x64 - if: runner.os == 'Windows' && matrix.architecture == 'AMD64' - - uses: bus1/cabuild/action/msdevshell@v1 + architecture: ${{ matrix.architecture }} + if: runner.os == 'Windows' + - uses: actions/setup-python@v7 with: - architecture: x86 - if: runner.os == 'Windows' && matrix.architecture == 'x86' - - uses: actions/setup-python@v5 - with: - python-version: '3.13' - - run: pipx run --python 3.13 cibuildwheel~=3.1.0 + python-version: '3.14' + - run: echo "${{ case(matrix.architecture == 'x64', 'AMD64', matrix.architecture) }}" + - run: pipx run --python 3.14 cibuildwheel==4.2.1 env: - CIBW_ENABLE: cpython-freethreading CIBW_SKIP: '*-musllinux*' - CIBW_ARCHS: ${{ matrix.architecture }} + CIBW_ARCHS: ${{ case(matrix.architecture == 'x64', 'AMD64', matrix.architecture) }} CIBW_TEST_COMMAND: python {project}/test.py - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: wheels-${{ matrix.os }}-${{ matrix.architecture }} path: wheelhouse/*.whl @@ -59,10 +52,12 @@ jobs: sdist: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 + with: + persist-credentials: false - run: python -m pip install build - run: python -m build --sdist - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: sdist path: dist/*.tar.gz @@ -72,12 +67,13 @@ jobs: - wheels - sdist runs-on: ubuntu-latest + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') environment: upload permissions: id-token: write steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: merge-multiple: true path: dist - - uses: pypa/gh-action-pypi-publish@release/v1 + - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 diff --git a/pyproject.toml b/pyproject.toml index 8461a95..e412184 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -32,6 +32,7 @@ classifiers = [ "Programming Language :: Python :: 3.12", "Programming Language :: Python :: 3.13", "Programming Language :: Python :: 3.14", + "Programming Language :: Python :: 3.15", "Topic :: Software Development :: Libraries", ] diff --git a/zizmor.yml b/zizmor.yml new file mode 100644 index 0000000..63f947f --- /dev/null +++ b/zizmor.yml @@ -0,0 +1,8 @@ +# SPDX-FileCopyrightText: Daniele Nicolodi +# SPDX-License-Identifier: Apache-2.0 OR LGPL-2.1-or-later + +rules: + unpinned-uses: + config: + policies: + actions/*: ref-pin