From 149128661ad6c963b4613cdecdbaa14f63f4d709 Mon Sep 17 00:00:00 2001 From: Alasdair Wilson Date: Tue, 15 Sep 2026 16:41:35 +0100 Subject: [PATCH 1/8] add a zizmor workflow --- .github/workflows/zizmor.yml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..574c6bd7 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,29 @@ +name: GitHub Actions Security Analysis with zizmor + +on: + push: + branches: [main] + pull_request: + branches: ["**"] + workflow_dispatch: + +permissions: {} + +jobs: + zizmor: + name: Run zizmor + runs-on: ubuntu-latest + permissions: + security-events: write + contents: read + actions: read + steps: + - name: Checkout repository + uses: actions/checkout@v5 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 + with: + inputs: ./.github/ From 1984d705107fadaadb93392f3c2def90b3869b1d Mon Sep 17 00:00:00 2001 From: Alasdair Wilson Date: Tue, 15 Sep 2026 16:49:54 +0100 Subject: [PATCH 2/8] bump zizmor action --- .github/workflows/zizmor.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 574c6bd7..87216fcd 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -19,11 +19,11 @@ jobs: actions: read steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 + uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 with: inputs: ./.github/ From 79f9348d0df471104cc8edb5c05c3441f21ef3b7 Mon Sep 17 00:00:00 2001 From: Alasdair Wilson Date: Tue, 15 Sep 2026 16:51:51 +0100 Subject: [PATCH 3/8] dump fancy gha stuff to get an actual fail --- .github/workflows/zizmor.yml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 87216fcd..d3fdba9e 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -2,28 +2,29 @@ name: GitHub Actions Security Analysis with zizmor on: push: - branches: [main] + branches: ["main"] pull_request: branches: ["**"] - workflow_dispatch: permissions: {} jobs: zizmor: - name: Run zizmor runs-on: ubuntu-latest permissions: security-events: write - contents: read - actions: read + steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - name: Run zizmor + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + + # Run without the fancy github stuff to get a list of errors output + - name: Run zizmor 🌈 uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 with: - inputs: ./.github/ + advanced-security: false \ No newline at end of file From 608ae9b96af24f81a210ac82515a4c957865a068 Mon Sep 17 00:00:00 2001 From: Alasdair Wilson Date: Tue, 15 Sep 2026 16:55:38 +0100 Subject: [PATCH 4/8] autofixes --- .github/workflows/deploy.yml | 2 ++ .github/workflows/docs-build.yml | 1 + .github/workflows/pages.yml | 6 ++++-- .github/workflows/quality.yml | 2 ++ .github/workflows/test.yml | 10 +++++++++- 5 files changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 046bbef7..424deb76 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -10,6 +10,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 + with: + persist-credentials: false - name: Enable corepack shell: bash run: corepack enable diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml index fd8f5c7a..ca4554e6 100644 --- a/.github/workflows/docs-build.yml +++ b/.github/workflows/docs-build.yml @@ -19,6 +19,7 @@ jobs: uses: actions/checkout@v5 with: sparse-checkout: docs + persist-credentials: false - name: Move docs to root run: mv docs/* . - name: Setup Ruby diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 8ad48e10..06096f3e 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -33,6 +33,7 @@ jobs: uses: actions/checkout@v5 with: sparse-checkout: docs + persist-credentials: false - name: Move docs to root run: mv docs/* . - name: Setup Ruby @@ -46,9 +47,10 @@ jobs: uses: actions/configure-pages@v5 - name: Build with Jekyll # Outputs to the './_site' directory by default - run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}" + run: bundle exec jekyll build --baseurl "${STEPS_PAGES_OUTPUTS_BASE_PATH}" env: JEKYLL_ENV: production + STEPS_PAGES_OUTPUTS_BASE_PATH: ${{ steps.pages.outputs.base_path }} - name: Upload artifact # Automatically uploads an artifact from the './_site' directory by default uses: actions/upload-pages-artifact@v3 @@ -63,4 +65,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 \ No newline at end of file + uses: actions/deploy-pages@v4 diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 1cf66c5b..4b1434fa 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -11,6 +11,8 @@ jobs: runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v5 + with: + persist-credentials: false - name: Enable corepack shell: bash run: corepack enable diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 1094c12f..26e21199 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -49,6 +49,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v5 + with: + persist-credentials: false - name: Enable corepack shell: bash run: corepack enable @@ -102,6 +104,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v5 + with: + persist-credentials: false - name: Enable corepack shell: bash run: corepack enable @@ -183,6 +187,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 + with: + persist-credentials: false - name: docker compose build run: docker compose -f docker-compose.yml build - name: docker compose up @@ -199,6 +205,8 @@ jobs: needs: build-and-test steps: - uses: actions/checkout@v5 + with: + persist-credentials: false - name: Enable corepack shell: bash run: corepack enable @@ -218,7 +226,7 @@ jobs: python scripts/pull_material.py - name: Check course material shell: bash - run: ls ${{ env.MATERIAL_DIR }} + run: ls ${MATERIAL_DIR} - uses: superfly/flyctl-actions/setup-flyctl@master - run: flyctl deploy -a gutenberg-staging --remote-only --build-arg DATABASE_URL=${{secrets.DATABASE_URL_TEST}} From f2335cf7424f9765b62de3f81e21e56875acbdc2 Mon Sep 17 00:00:00 2001 From: Alasdair Wilson Date: Tue, 15 Sep 2026 17:03:01 +0100 Subject: [PATCH 5/8] unsafe fixes --- .github/workflows/deploy.yml | 6 +++--- .github/workflows/docs-build.yml | 6 +++--- .github/workflows/pages.yml | 10 +++++----- .github/workflows/quality.yml | 4 ++-- .github/workflows/test.yml | 20 ++++++++++---------- 5 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 424deb76..e3da219e 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -9,18 +9,18 @@ jobs: name: Deploy app runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: persist-credentials: false - name: Enable corepack shell: bash run: corepack enable - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc cache: "yarn" - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: Checkout course material diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml index ca4554e6..c7fe5284 100644 --- a/.github/workflows/docs-build.yml +++ b/.github/workflows/docs-build.yml @@ -16,21 +16,21 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: sparse-checkout: docs persist-credentials: false - name: Move docs to root run: mv docs/* . - name: Setup Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@bec3f19a76460dbe12f60def7d1a77585f07516c # v1.322.0 with: ruby-version: "3.3" bundler-cache: true - name: Build with Jekyll run: bundle exec jekyll build --strict_front_matter - name: Upload built site - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: docs-site-pr-${{ github.event.pull_request.number }} path: _site diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 06096f3e..6b8e5bc8 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -30,21 +30,21 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: sparse-checkout: docs persist-credentials: false - name: Move docs to root run: mv docs/* . - name: Setup Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@bec3f19a76460dbe12f60def7d1a77585f07516c # v1.322.0 with: ruby-version: '3.3' # Not needed with a .ruby-version file bundler-cache: true # runs 'bundle install' and caches installed gems automatically cache-version: 0 # Increment this number if you need to re-download cached gems - name: Setup Pages id: pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0 - name: Build with Jekyll # Outputs to the './_site' directory by default run: bundle exec jekyll build --baseurl "${STEPS_PAGES_OUTPUTS_BASE_PATH}" @@ -53,7 +53,7 @@ jobs: STEPS_PAGES_OUTPUTS_BASE_PATH: ${{ steps.pages.outputs.base_path }} - name: Upload artifact # Automatically uploads an artifact from the './_site' directory by default - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1 # Deployment job deploy: @@ -65,4 +65,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 4b1434fa..77ea5186 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -10,14 +10,14 @@ jobs: name: Format with Prettier runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: persist-credentials: false - name: Enable corepack shell: bash run: corepack enable - name: Use Node.js 22 - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc cache: 'yarn' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 26e21199..94e07da1 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -48,19 +48,19 @@ jobs: DATABASE_URL: postgresql://postgres:postgres@localhost:5432/gutenberg_test steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: persist-credentials: false - name: Enable corepack shell: bash run: corepack enable - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc cache: ${{ env.MANAGER }} - name: Restore cache - uses: actions/cache@v4 + uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 with: path: | .next/cache @@ -91,7 +91,7 @@ jobs: run: ${{ env.MANAGER }} build # Enable tmate debugging of manually-triggered workflows if the input option was provided - name: Setup tmate session - uses: mxschmitt/action-tmate@v3 + uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3.24 if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }} - name: Run e2e tests run: ${{ env.MANAGER }} ci:e2e @@ -103,14 +103,14 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: persist-credentials: false - name: Enable corepack shell: bash run: corepack enable - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc cache: ${{ env.MANAGER }} @@ -186,7 +186,7 @@ jobs: docker-build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: persist-credentials: false - name: docker compose build @@ -204,18 +204,18 @@ jobs: runs-on: ubuntu-latest needs: build-and-test steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 with: persist-credentials: false - name: Enable corepack shell: bash run: corepack enable - name: Setup Node - uses: actions/setup-node@v6 + uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version-file: .nvmrc cache: "yarn" - - uses: actions/setup-python@v6 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.12" - name: Checkout course material From babf6e0f91ac1937151e756d02e015d165e079dc Mon Sep 17 00:00:00 2001 From: Alasdair Wilson Date: Tue, 15 Sep 2026 17:12:32 +0100 Subject: [PATCH 6/8] manual fixes --- .github/workflows/deploy.yml | 5 ++++- .github/workflows/docs-build.yml | 3 +++ .github/workflows/pages.yml | 10 +++++----- .github/workflows/quality.yml | 2 ++ .github/workflows/test.yml | 12 ++++++------ 5 files changed, 20 insertions(+), 12 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index e3da219e..125b6f4c 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -4,6 +4,9 @@ name: Fly deploy on: workflow_dispatch: +permissions: + contents: read + jobs: deploy: name: Deploy app @@ -29,7 +32,7 @@ jobs: pip install --upgrade pip setuptools wheel pip install -r scripts/python_requirements.txt python scripts/pull_material.py - - uses: superfly/flyctl-actions/setup-flyctl@master + - uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # v1.5 - run: flyctl deploy --remote-only --build-arg DATABASE_URL=${{secrets.DATABASE_URL}} --build-arg NEXT_PUBLIC_PLAUSIBLE_DOMAIN=${{secrets.NEXT_PUBLIC_PLAUSIBLE_DOMAIN}} diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml index c7fe5284..620e1bf1 100644 --- a/.github/workflows/docs-build.yml +++ b/.github/workflows/docs-build.yml @@ -7,6 +7,9 @@ on: - "docs/**" - ".github/workflows/docs-build.yml" +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 6b8e5bc8..830a8761 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -14,11 +14,6 @@ on: workflow_dispatch: # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - # Allow one concurrent deployment concurrency: group: "pages" @@ -28,6 +23,8 @@ jobs: # Build job build: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 @@ -57,6 +54,9 @@ jobs: # Deployment job deploy: + permissions: + pages: write + id-token: write environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }} diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 77ea5186..3d80bc49 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -2,6 +2,8 @@ name: Quality on: pull_request: branches: [main] +permissions: + contents: read concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 94e07da1..a7289fdd 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -19,12 +19,15 @@ env: MATERIAL_REPO: "UNIVERSE-HPC/course-material" MANAGER: "yarn" +permissions: + contents: read + jobs: build-and-test: runs-on: ubuntu-latest services: postgres: - image: postgres + image: postgres:16 env: POSTGRES_USER: postgres POSTGRES_PASSWORD: postgres @@ -115,9 +118,6 @@ jobs: node-version-file: .nvmrc cache: ${{ env.MANAGER }} - - name: Install broken-link-checker - run: npm install -g broken-link-checker - - name: Start the site run: | yarn install @@ -130,7 +130,7 @@ jobs: id: blc run: | echo "Checking for broken links..." - OUTPUT=$(npx broken-link-checker http://localhost:3000/ -rof \ + OUTPUT=$(npx --yes broken-link-checker http://localhost:3000/ -rof \ --exclude "github.com" \ --exclude "discuss.python.org" \ --exclude "intel.com" \ @@ -227,7 +227,7 @@ jobs: - name: Check course material shell: bash run: ls ${MATERIAL_DIR} - - uses: superfly/flyctl-actions/setup-flyctl@master + - uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # v1.5 - run: flyctl deploy -a gutenberg-staging --remote-only --build-arg DATABASE_URL=${{secrets.DATABASE_URL_TEST}} --build-arg NEXT_PUBLIC_PLAUSIBLE_DOMAIN=${{secrets.NEXT_PUBLIC_PLAUSIBLE_DOMAIN_TEST}} From 51bfc0e11f7a6ff21643848759a8cd58b73f1011 Mon Sep 17 00:00:00 2001 From: Alasdair Wilson Date: Tue, 15 Sep 2026 17:16:02 +0100 Subject: [PATCH 7/8] changed v1.5 tagsd to 1.5 --- .github/workflows/deploy.yml | 2 +- .github/workflows/test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 125b6f4c..5c9a2f8b 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -32,7 +32,7 @@ jobs: pip install --upgrade pip setuptools wheel pip install -r scripts/python_requirements.txt python scripts/pull_material.py - - uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # v1.5 + - uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # 1.5 - run: flyctl deploy --remote-only --build-arg DATABASE_URL=${{secrets.DATABASE_URL}} --build-arg NEXT_PUBLIC_PLAUSIBLE_DOMAIN=${{secrets.NEXT_PUBLIC_PLAUSIBLE_DOMAIN}} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a7289fdd..3d372d18 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -227,7 +227,7 @@ jobs: - name: Check course material shell: bash run: ls ${MATERIAL_DIR} - - uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # v1.5 + - uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # 1.5 - run: flyctl deploy -a gutenberg-staging --remote-only --build-arg DATABASE_URL=${{secrets.DATABASE_URL_TEST}} --build-arg NEXT_PUBLIC_PLAUSIBLE_DOMAIN=${{secrets.NEXT_PUBLIC_PLAUSIBLE_DOMAIN_TEST}} From 63e9baeabe457684763985f77ac786954af5f9f6 Mon Sep 17 00:00:00 2001 From: Alasdair Wilson Date: Tue, 15 Sep 2026 17:19:45 +0100 Subject: [PATCH 8/8] update action pins to newest major v --- .github/workflows/deploy.yml | 6 +++--- .github/workflows/docs-build.yml | 2 +- .github/workflows/pages.yml | 2 +- .github/workflows/quality.yml | 4 ++-- .github/workflows/test.yml | 16 ++++++++-------- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 5c9a2f8b..c53f0ce1 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -12,18 +12,18 @@ jobs: name: Deploy app runs-on: ubuntu-latest steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Enable corepack shell: bash run: corepack enable - name: Setup Node - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: .nvmrc cache: "yarn" - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Checkout course material diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml index 620e1bf1..d3831c79 100644 --- a/.github/workflows/docs-build.yml +++ b/.github/workflows/docs-build.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: sparse-checkout: docs persist-credentials: false diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 830a8761..4fba2587 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -27,7 +27,7 @@ jobs: contents: read steps: - name: Checkout - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: sparse-checkout: docs persist-credentials: false diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 3d80bc49..b8590c32 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -12,14 +12,14 @@ jobs: name: Format with Prettier runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Enable corepack shell: bash run: corepack enable - name: Use Node.js 22 - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: .nvmrc cache: 'yarn' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 3d372d18..5faf8dcf 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -51,14 +51,14 @@ jobs: DATABASE_URL: postgresql://postgres:postgres@localhost:5432/gutenberg_test steps: - name: Checkout - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Enable corepack shell: bash run: corepack enable - name: Setup Node - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: .nvmrc cache: ${{ env.MANAGER }} @@ -106,14 +106,14 @@ jobs: steps: - name: Checkout - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Enable corepack shell: bash run: corepack enable - name: Setup Node - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: .nvmrc cache: ${{ env.MANAGER }} @@ -186,7 +186,7 @@ jobs: docker-build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: docker compose build @@ -204,18 +204,18 @@ jobs: runs-on: ubuntu-latest needs: build-and-test steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Enable corepack shell: bash run: corepack enable - name: Setup Node - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version-file: .nvmrc cache: "yarn" - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Checkout course material