ci: adopt conda-actions v2.0 (grype scan + drop anaconda-client)

.github/workflows/test_and_deploy.yaml

@@ -58,6 +58,10 @@ jobs:
   conda-build:
     name: Build conda package
     runs-on: ubuntu-latest
+    permissions:
+      contents: read          # for actions/checkout
+      security-events: write  # for github/codeql-action/upload-sarif to upload results
+      actions: read           # for upload-sarif to read run status (private repos)
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -90,18 +94,25 @@ jobs:
       # installed (and micromamba on PATH); pkg-install sets both up.
       - name: Install built conda package
         id: install
-        uses: neutrons/conda-actions/pkg-install@89794e4e2c37b1f13f04a8f1073b972a4813976b
+        uses: neutrons/conda-actions/pkg-install@v2
         with:
           package-name: ${{ env.PKG_NAME }}
           local-channel: /tmp/local-channel
 
       - name: Verify conda package
-        uses: neutrons/conda-actions/pkg-verify@89794e4e2c37b1f13f04a8f1073b972a4813976b
+        uses: neutrons/conda-actions/pkg-verify@v2
         with:
           package-name: ${{ env.PKG_NAME }}
           module-name: ${{ env.MODULE_NAME }}
           conda-env-name: ${{ steps.install.outputs.conda_env }}
 
+      # Audit the dependencies of the conda package we just installed. SARIF
+      # results are uploaded to GitHub code scanning by the grype action.
+      - name: Scan installed environment with Grype
+        uses: neutrons/conda-actions/grype@v2
+        with:
+          path: ${{ steps.install.outputs.conda_install_dir }}
+
       - name: Upload conda package as artifact
         uses: actions/upload-artifact@v7
         with:
@@ -138,15 +149,15 @@ jobs:
           name: artifact-conda-package
 
       - name: Upload package to anaconda
-        uses: neutrons/conda-actions/publish@main
+        uses: neutrons/conda-actions/publish@v2
         with:
           anaconda-token: ${{ secrets.ANACONDA_TOKEN }}
           organization: neutrons
           package-path: ${{ env.PKG_NAME }}-*.conda
 
       - name: Remove old packages
         if: github.ref == 'refs/heads/next'
-        uses: neutrons/conda-actions/pkg-remove@v1
+        uses: neutrons/conda-actions/pkg-remove@v2
         with:
           anaconda_token: ${{ secrets.ANACONDA_TOKEN }}
           organization: neutrons