ci: Update actions

.github/workflows/docs.yml

@@ -8,18 +8,22 @@ on:
       - master
   pull_request:
 
+permissions: {}
+
 jobs:
 
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.11'
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - run: python -m pip install sphinx==5.3.0 furo==2022.9.29
       - run: python -m sphinx -W -b html docs/ build/html/
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@v5
         with:
           path: build/html
 
@@ -33,4 +37,4 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/master'
     steps:
-      - uses: actions/deploy-pages@v4
+      - uses: actions/deploy-pages@v5

.github/workflows/lint.yml

@@ -8,15 +8,30 @@ on:
       - master
   pull_request:
 
+permissions: {}
+
 jobs:
   reuse:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - run: python -m pip install reuse
       - run: python -m reuse lint
+
+  zizmor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - run: python -m pip install zizmor==1.29.0
+      - run: zizmor .
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/tests.yml

@@ -8,6 +8,8 @@ on:
       - master
   pull_request:
 
+permissions: {}
+
 jobs:
   tests:
     runs-on: ${{ matrix.platform }}
@@ -24,17 +26,21 @@ jobs:
           - '3.13t'
           - '3.14'
           - '3.14t'
+          - '3.15'
+          - '3.15t'
         platform:
           - macos-latest
           - ubuntu-latest
           - windows-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python }}
           allow-prereleases: true
-      - uses: bus1/cabuild/action/msdevshell@v1
+      - uses: bus1/cabuild/action/msdevshell@06ea2833eef61e9b0d0ce0d728416e617e4fb1fe  # v1
         with:
           architecture: x64
         if: runner.os == 'Windows'

.github/workflows/wheels.yml

@@ -6,63 +6,58 @@ on:
   push:
     tags:
       - 'v[0-9]*'
-  workflow_dispatch:
+
+permissions: {}
 
 jobs:
 
   wheels:
-    runs-on: ${{ matrix.os }}-latest
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu
-            architecture: x86_64
-          - os: ubuntu
-            architecture: aarch64
-          - os: macos
-            architecture: x86_64
-          - os: macos
-            architecture: arm64
-          - os: windows
+          - os: ubuntu-latest
+          - os: ubuntu-24.04-arm
+          - os: windows-latest
             architecture: x86
-          - os: windows
-            architecture: AMD64
+          - os: windows-latest
+            architecture: x64
+          - os: windows-11-arm
+            architecture: arm64
+          - os: macos-15-intel
+          - os: macos-14
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-qemu-action@v2
+      - uses: actions/checkout@v7
         with:
-          platforms: arm64
-        if: runner.os == 'Linux' && matrix.architecture == 'aarch64'
-      - uses: bus1/cabuild/action/msdevshell@v1
+          persist-credentials: false
+      - uses: bus1/cabuild/action/msdevshell@06ea2833eef61e9b0d0ce0d728416e617e4fb1fe  # v1
         with:
-          architecture: x64
-        if: runner.os == 'Windows' && matrix.architecture == 'AMD64'
-      - uses: bus1/cabuild/action/msdevshell@v1
+          architecture: ${{ matrix.architecture }}
+        if: runner.os == 'Windows'
+      - uses: actions/setup-python@v7
         with:
-          architecture: x86
-        if: runner.os == 'Windows' && matrix.architecture == 'x86'
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.13'
-      - run: pipx run --python 3.13 cibuildwheel~=3.1.0
+          python-version: '3.14'
+      - run: echo "${{ case(matrix.architecture == 'x64', 'AMD64', matrix.architecture) }}"
+      - run: pipx run --python 3.14 cibuildwheel==4.2.1
         env:
-          CIBW_ENABLE: cpython-freethreading
           CIBW_SKIP: '*-musllinux*'
-          CIBW_ARCHS: ${{ matrix.architecture }}
+          CIBW_ARCHS: ${{ case(matrix.architecture == 'x64', 'AMD64', matrix.architecture) }}
           CIBW_TEST_COMMAND: python {project}/test.py
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: wheels-${{ matrix.os }}-${{ matrix.architecture }}
           path: wheelhouse/*.whl
 
   sdist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - run: python -m pip install build
       - run: python -m build --sdist
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: sdist
           path: dist/*.tar.gz
@@ -72,12 +67,13 @@ jobs:
       - wheels
       - sdist
     runs-on: ubuntu-latest
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
     environment: upload
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           merge-multiple: true
           path: dist
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2

pyproject.toml

@@ -32,6 +32,7 @@ classifiers = [
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
     "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3.15",
     "Topic :: Software Development :: Libraries",
 ]
 

zizmor.yml

@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: Daniele Nicolodi <daniele@grinta.net>
+# SPDX-License-Identifier: Apache-2.0 OR LGPL-2.1-or-later
+
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin