Add MAINTAINERS.md file

.github/workflows/build.yml

@@ -22,11 +22,11 @@ jobs:
             path: ~\AppData\Local\pypoetry\Cache\virtualenvs
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
 
       - name: Set up Python ${{ matrix.python-version }}
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -35,7 +35,7 @@ jobs:
         run: |
           echo "::set-output name=dir::$(pip cache dir)"
       - name: Cache pip dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.pip-cache.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ steps.setup-python.outputs.python-version }}
@@ -44,7 +44,7 @@ jobs:
         run: pip install poetry
 
       - name: Cache poetry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ matrix.path }}
           key: ${{ runner.os }}-poetry-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
@@ -58,14 +58,14 @@ jobs:
         timeout-minutes: 10
 
       - name: Upload test results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: pytest-results-${{ matrix.os }}-${{ matrix.python-version }}-${{ github.run_id }}
           path: test-results/junit.xml
         if: ${{ always() }}
 
       - name: Upload test coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: pytest-coverage-${{ matrix.os }}-${{ matrix.python-version }}-${{ github.run_id }}
           path: htmlcov

.github/workflows/cve-scanning-python.yml

@@ -17,8 +17,8 @@ jobs:
     name: Build and test App
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: "3.10"
       - uses: abatilo/actions-poetry@192395c0d10c082a7c62294ab5d9a9de40e48974
@@ -32,6 +32,26 @@ jobs:
         run: |
           poetry install
       - name: Scan CVEs
-        run: poetry export --without-hashes -f requirements.txt | safety check --full-report --stdin
+        # IDs below mirror .github/workflows/security.yml: all urllib3/aiohttp findings whose
+        # fix requires a version that dropped Python 3.9 support (this project's floor, see
+        # pyproject.toml). Passing -i here (rather than relying only on .safety-policy.yml)
+        # because the -i flag replaces, rather than merges with, the policy file's
+        # ignore-vulnerabilities list when both are used together. Revisit when Python 3.9
+        # support is dropped.
+        run: >
+          poetry export --without-hashes -f requirements.txt | safety check --full-report --stdin
+          -i 96886
+          -i SFTY-20260511-47957
+          -i SFTY-20260615-39401
+          -i SFTY-20260615-18154
+          -i SFTY-20260615-56865
+          -i SFTY-20260615-97789
+          -i SFTY-20260615-89136
+          -i SFTY-20260615-16622
+          -i SFTY-20260615-53053
+          -i SFTY-20260615-28483
+          -i SFTY-20260603-52923
+          -i SFTY-20260603-52285
+          -i SFTY-20260615-45392
         # Without poetry, use this command instead
         # run: safety check -r requirements.txt --full-report --policy-file safety-policy.yml

.github/workflows/e2e-build.yml

@@ -8,11 +8,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
 
       - name: Set up Python
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: '3.12'
 
@@ -21,7 +21,7 @@ jobs:
         run: |
           echo "dir=$(pip cache dir)" >> $GITHUB_OUTPUT
       - name: Cache pip dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.pip-cache.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ steps.setup-python.outputs.python-version }}
@@ -33,7 +33,7 @@ jobs:
         run: poetry self add poetry-plugin-export
 
       - name: Cache poetry virtualenv
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cache/pypoetry/virtualenvs
           key: ${{ runner.os }}-poetry-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}

.github/workflows/license-scanning-python.yml

@@ -15,8 +15,8 @@ jobs:
     name: Scan for licenses
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: "3.10"
       - name: Install pip-licenses

.github/workflows/linting.yaml

@@ -12,18 +12,18 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
 
       - name: Set up Python 3.9
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: 3.9
 
       - name: Install Poetry
         run: pip install poetry
 
       - name: Cache poetry virtualenv
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cache/pypoetry/virtualenvs
           key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
@@ -34,7 +34,7 @@ jobs:
         run: poetry install
 
       - name: Cache ruff
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .ruff_cache
           key: ${{ runner.os }}-ruff-${{ github.ref_name }}-${{ hashFiles('poetry.lock') }}

.github/workflows/push.yml

@@ -8,7 +8,7 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
       - name: Run Snyk to check for vulnerabilities
         uses: snyk/actions/python@b98d498629f1c368650224d6d212bf7dfa89e4bf
         env:
@@ -20,13 +20,13 @@ jobs:
   documentation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
         with:
           fetch-depth: 0
 
       - name: Set up Python 3.9
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: 3.9
 
@@ -41,7 +41,7 @@ jobs:
           echo "::set-output name=dir::$(pip cache dir)"
 
       - name: Cache pip dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.pip-cache.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ steps.setup-python.outputs.python-version }}
@@ -50,7 +50,7 @@ jobs:
         run: pip install poetry
 
       - name: Cache poetry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cache/pypoetry/virtualenvs
           key: ${{ runner.os }}-poetry-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}

.github/workflows/release.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
 
       - name: Set up Python 3.9
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: 3.9
 

.github/workflows/security.yml

@@ -13,11 +13,11 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
 
       - name: Set up Python 3.9
         id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: 3.9
 
@@ -27,7 +27,7 @@ jobs:
           echo "::set-output name=dir::$(pip cache dir)"
 
       - name: Cache pip dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.pip-cache.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ steps.setup-python.outputs.python-version }}
@@ -36,7 +36,7 @@ jobs:
         run: pip install poetry
 
       - name: Cache poetry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cache/pypoetry/virtualenvs
           key: ${{ runner.os }}-poetry-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
@@ -53,4 +53,23 @@ jobs:
         run: poetry run liccheck
 
       - name: Run CVE checks
-        run: poetry run safety check -r requirements.txt
+        # IDs below are all urllib3/aiohttp findings whose fix requires a version that
+        # dropped Python 3.9 support (this project's floor, see pyproject.toml). Passing
+        # -i here (rather than relying only on .safety-policy.yml) because the -i flag
+        # replaces, rather than merges with, the policy file's ignore-vulnerabilities list
+        # when both are used together. Revisit when Python 3.9 support is dropped.
+        run: >
+          poetry run safety check -r requirements.txt
+          -i 96886
+          -i SFTY-20260511-47957
+          -i SFTY-20260615-39401
+          -i SFTY-20260615-18154
+          -i SFTY-20260615-56865
+          -i SFTY-20260615-97789
+          -i SFTY-20260615-89136
+          -i SFTY-20260615-16622
+          -i SFTY-20260615-53053
+          -i SFTY-20260615-28483
+          -i SFTY-20260603-52923
+          -i SFTY-20260603-52285
+          -i SFTY-20260615-45392

.github/workflows/semgrep.yml

@@ -9,7 +9,7 @@ jobs:
     container:
       image: returntocorp/semgrep
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
     - run: semgrep scan --error --config auto
       env:
         SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

MAINTAINERS.md

@@ -0,0 +1,27 @@
+# Maintainers
+
+This file lists the maintainers of this repository.
+
+## Current maintainers
+
+| GitHub Username | Name | Organization | Email (optional) |
+|----------------|------|--------------|------------------|
+| @Yannick-Malins | Yannick | @SymphonyOSF |  |
+| @benoit-sy | Benoit Charbonnier | @SymphonyOSF |  |
+| @broHeryk | Bohdan Heryk | @SymphonyOSF |  |
+| @catalinsymphony | Catalin Ghimici | @SymphonyOSF |  |
+| @sbenmoussati | Salah Benmoussati | @SymphonyOSF |  |
+| @thibauult | Thibault Pensec | @SymphonyOSF  |  |
+| @vladokrsymphony | Vlado Kragujevski | @SymphonyOSF |  |
+
+For information about maintainer responsibilities and resources, see the [FINOS Maintainers Cheatsheet](https://community.finos.org/docs/finos-maintainers-cheatsheet).
+
+## Updating this file
+
+All changes to the maintainer list are managed openly:
+
+- **Submit a Pull Request** to this file for any addition, removal, or update.
+- **If your project's governance requires a vote**, document or link to the vote outcome in the PR description or comments.
+- This process creates a public audit trail of project leadership over time.
+
+Please email **help@finos.org** whenever this file is updated with a change to maintainership.