From f9c769b3dbcb047e2556a3aa77834a305c28d410 Mon Sep 17 00:00:00 2001 From: Adam Dangoor Date: Mon, 29 Dec 2025 13:07:24 +0000 Subject: [PATCH 1/4] Add zizmor for GitHub Actions security linting --- .pre-commit-config.yaml | 10 ++++++++++ pyproject.toml | 1 + 2 files changed, 11 insertions(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 5aff4c9..df434ea 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -39,6 +39,7 @@ ci: - vulture - vulture-docs - yamlfix + - zizmor # See https://pre-commit.com for more information # See https://pre-commit.com/hooks.html for more hooks @@ -384,6 +385,15 @@ repos: additional_dependencies: [uv==0.9.5] stages: [pre-commit] + - id: zizmor + name: zizmor + entry: uv run --extra=dev zizmor .github + language: python + pass_filenames: false + types_or: [yaml] + additional_dependencies: [uv==0.9.5] + stages: [pre-commit] + - id: sphinx-lint name: sphinx-lint entry: uv run --extra=dev sphinx-lint --enable=all --disable=line-too-long diff --git a/pyproject.toml b/pyproject.toml index b724805..089a90c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -72,6 +72,7 @@ optional-dependencies.dev = [ "vulture==2.14", "vws-python-mock==2025.3.10.1", "yamlfix==1.19.1", + "zizmor==1.19.0", ] optional-dependencies.release = [ "check-wheel-contents==0.6.3" ] urls.Documentation = "https://vws-python.github.io/vws-auth-tools/" From 6729629056233ba9162a235cdadfed59e50fc775 Mon Sep 17 00:00:00 2001 From: Adam Dangoor Date: Mon, 29 Dec 2025 16:30:48 +0000 Subject: [PATCH 2/4] Add zizmor config and ignore in check-manifest --- pyproject.toml | 1 + zizmor.yml | 12 ++++++++++++ 2 files changed, 13 insertions(+) create mode 100644 zizmor.yml diff --git a/pyproject.toml b/pyproject.toml index 089a90c..d9d424a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -292,6 +292,7 @@ ignore = [ "tests/**", "vuforia_secrets.env.example", "lint.mk", + "zizmor.yml", ] [tool.deptry] diff --git a/zizmor.yml b/zizmor.yml new file mode 100644 index 0000000..f63e179 --- /dev/null +++ b/zizmor.yml @@ -0,0 +1,12 @@ +--- +rules: + unpinned-uses: + disable: true + cache-poisoning: + disable: true + bot-conditions: + disable: true + dependabot-cooldown: + disable: true + template-injection: + disable: true From 61cd6512225e883e8829a011243007259dc49f05 Mon Sep 17 00:00:00 2001 From: Adam Dangoor Date: Mon, 29 Dec 2025 17:01:44 +0000 Subject: [PATCH 3/4] Fix zizmor issues in GitHub workflows --- .github/workflows/ci.yml | 7 +++++-- .github/workflows/publish-site.yml | 5 +++-- .github/workflows/release.yml | 1 + 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dedaaeb..26fb911 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,8 @@ on: # Run at 1:00 every day - cron: 0 1 * * * +permissions: {} + jobs: build: @@ -23,12 +25,13 @@ jobs: runs-on: ${{ matrix.platform }} steps: - - uses: actions/checkout@v6 - # Avoid issues with depending on a particular version of this + - uses: actions/checkout@v6 # Avoid issues with depending on a particular version of this # package from another package. # We need our tags in order to calculate the version. # See https://github.com/astral-sh/uv/issues/8148. + with: + persist-credentials: false fetch-depth: 0 fetch-tags: true diff --git a/.github/workflows/publish-site.yml b/.github/workflows/publish-site.yml index 75f300b..814e2c3 100644 --- a/.github/workflows/publish-site.yml +++ b/.github/workflows/publish-site.yml @@ -17,12 +17,13 @@ jobs: pages: write id-token: write steps: - - uses: actions/checkout@v6 - # Avoid issues with depending on a particular version of this + - uses: actions/checkout@v6 # Avoid issues with depending on a particular version of this # package from another package. # We need our tags in order to calculate the version. # See https://github.com/astral-sh/uv/issues/8148. + with: + persist-credentials: false fetch-depth: 0 fetch-tags: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4ecf780..976a14a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,6 +23,7 @@ jobs: steps: - uses: actions/checkout@v6 with: + persist-credentials: false # See # https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#push-to-protected-branches token: ${{ secrets.RELEASE_PAT }} From 0a5bdfbbd9d9c79ba994cd6b382baa177ffc4900 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci-lite[bot]" <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com> Date: Mon, 29 Dec 2025 17:03:08 +0000 Subject: [PATCH 4/4] [pre-commit.ci lite] apply automatic fixes --- .github/workflows/ci.yml | 2 +- .github/workflows/publish-site.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 26fb911..fd3210b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: runs-on: ${{ matrix.platform }} steps: - - uses: actions/checkout@v6 # Avoid issues with depending on a particular version of this + - uses: actions/checkout@v6 # Avoid issues with depending on a particular version of this # package from another package. # We need our tags in order to calculate the version. # See https://github.com/astral-sh/uv/issues/8148. diff --git a/.github/workflows/publish-site.yml b/.github/workflows/publish-site.yml index 814e2c3..352ccdd 100644 --- a/.github/workflows/publish-site.yml +++ b/.github/workflows/publish-site.yml @@ -17,7 +17,7 @@ jobs: pages: write id-token: write steps: - - uses: actions/checkout@v6 # Avoid issues with depending on a particular version of this + - uses: actions/checkout@v6 # Avoid issues with depending on a particular version of this # package from another package. # We need our tags in order to calculate the version. # See https://github.com/astral-sh/uv/issues/8148.