Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 1891bf0

Browse files
greglucasgreglucas
authored
Merge pull request #29266 from meeseeksmachine/auto-backport-of-pr-29251-on-v3.10.x
Backport PR #29251 on branch v3.10.x (Zizmor audit)
2 parents cf36b82 + 1840162 commit 1891bf0

15 files changed

+74
-55
lines changed

‎.github/workflows/cibuildwheel.yml

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,12 @@ jobs:
3939
SDIST_NAME: ${{ steps.sdist.outputs.SDIST_NAME }}
4040

4141
steps:
42-
- uses: actions/checkout@v4
42+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4343
with:
4444
fetch-depth: 0
45+
persist-credentials: false
4546

46-
- uses: actions/setup-python@v5
47+
- uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
4748
name: Install Python
4849
with:
4950
python-version: '3.10'
@@ -69,7 +70,7 @@ jobs:
6970
run: twine check dist/*
7071

7172
- name: Upload sdist result
72-
uses: actions/upload-artifact@v4
73+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
7374
with:
7475
name: cibw-sdist
7576
path: dist/*.tar.gz
@@ -132,12 +133,12 @@ jobs:
132133
steps:
133134
- name: Set up QEMU
134135
if: matrix.cibw_archs == 'aarch64'
135-
uses: docker/setup-qemu-action@v3
136+
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
136137
with:
137138
platforms: arm64
138139

139140
- name: Download sdist
140-
uses: actions/download-artifact@v4
141+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
141142
with:
142143
name: cibw-sdist
143144
path: dist/
@@ -201,7 +202,7 @@ jobs:
201202
unset PIP_CONSTRAINT
202203
if: matrix.cibw_archs != 'aarch64' && matrix.os != 'windows-latest'
203204

204-
- uses: actions/upload-artifact@v4
205+
- uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
205206
with:
206207
name: cibw-wheels-${{ runner.os }}-${{ matrix.cibw_archs }}
207208
path: ./wheelhouse/*.whl
@@ -219,7 +220,7 @@ jobs:
219220
contents: read
220221
steps:
221222
- name: Download packages
222-
uses: actions/download-artifact@v4
223+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
223224
with:
224225
pattern: cibw-*
225226
path: dist

‎.github/workflows/circleci.yml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,16 +28,20 @@ jobs:
2828
runs-on: ubuntu-latest
2929
name: Post warnings/errors as review
3030
steps:
31-
- uses: actions/checkout@v4
31+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
32+
with:
33+
persist-credentials: false
3234

3335
- name: Fetch result artifacts
3436
id: fetch-artifacts
37+
env:
38+
target_url: "${{ github.event.target_url }}"
3539
run: |
36-
python .circleci/fetch_doc_logs.py "${{ github.event.target_url }}"
40+
python .circleci/fetch_doc_logs.py "${target_url}"
3741
3842
- name: Set up reviewdog
3943
if: "${{ steps.fetch-artifacts.outputs.count != 0 }}"
40-
uses: reviewdog/action-setup@v1
44+
uses: reviewdog/action-setup@3f401fe1d58fe77e10d665ab713057375e39b887 # v1.3.0
4145
with:
4246
reviewdog_version: latest
4347

‎.github/workflows/clean_pr.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,10 @@ jobs:
1010
runs-on: ubuntu-latest
1111

1212
steps:
13-
- uses: actions/checkout@v4
13+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1414
with:
1515
fetch-depth: '0'
16+
persist-credentials: false
1617
- name: Check for added-and-deleted files
1718
run: |
1819
git fetch --quiet origin "$GITHUB_BASE_REF"

‎.github/workflows/codeql-analysis.yml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,12 @@ jobs:
2626

2727
steps:
2828
- name: Checkout repository
29-
uses: actions/checkout@v4
29+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
30+
with:
31+
persist-credentials: false
3032

3133
- name: Initialize CodeQL
32-
uses: github/codeql-action/init@v3
34+
uses: github/codeql-action/init@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
3335
with:
3436
languages: ${{ matrix.language }}
3537

@@ -40,4 +42,4 @@ jobs:
4042
pip install --user -v .
4143
4244
- name: Perform CodeQL Analysis
43-
uses: github/codeql-action/analyze@v3
45+
uses: github/codeql-action/analyze@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6

‎.github/workflows/conflictcheck.yml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,11 @@ on:
99
pull_request_target:
1010
types: [synchronize]
1111

12-
permissions:
13-
pull-requests: write
14-
1512
jobs:
1613
main:
1714
runs-on: ubuntu-latest
15+
permissions:
16+
pull-requests: write
1817
steps:
1918
- name: Check if PRs have merge conflicts
2019
uses: eps1lon/actions-label-merge-conflict@1b1b1fcde06a9b3d089f3464c96417961dde1168 # v3.0.2

‎.github/workflows/cygwin.yml

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,12 @@ jobs:
7979
- name: Fix line endings
8080
run: git config --global core.autocrlf input
8181

82-
- uses: actions/checkout@v4
82+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8383
with:
8484
fetch-depth: 0
85+
persist-credentials: false
8586

86-
- uses: cygwin/cygwin-install-action@v4
87+
- uses: cygwin/cygwin-install-action@006ad0b0946ca6d0a3ea2d4437677fa767392401 # v4
8788
with:
8889
packages: >-
8990
ccache gcc-g++ gdb git graphviz libcairo-devel libffi-devel
@@ -139,21 +140,21 @@ jobs:
139140
# FreeType build fails with bash, succeeds with dash
140141

141142
- name: Cache pip
142-
uses: actions/cache@v4
143+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
143144
with:
144145
path: C:\cygwin\home\runneradmin\.cache\pip
145146
key: Cygwin-py3.${{ matrix.python-minor-version }}-pip-${{ hashFiles('requirements/*/*.txt') }}
146147
restore-keys: ${{ matrix.os }}-py3.${{ matrix.python-minor-version }}-pip-
147148

148149
- name: Cache ccache
149-
uses: actions/cache@v4
150+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
150151
with:
151152
path: C:\cygwin\home\runneradmin\.ccache
152153
key: Cygwin-py3.${{ matrix.python-minor-version }}-ccache-${{ hashFiles('src/*') }}
153154
restore-keys: Cygwin-py3.${{ matrix.python-minor-version }}-ccache-
154155

155156
- name: Cache Matplotlib
156-
uses: actions/cache@v4
157+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
157158
with:
158159
path: |
159160
C:\cygwin\home\runneradmin\.cache\matplotlib

‎.github/workflows/do_not_merge.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ jobs:
2323
echo "This PR cannot be merged because it has one of the following labels: "
2424
echo "* status: needs comment/discussion"
2525
echo "* status: waiting for other PR"
26-
echo "${{env.has_tag}}"
2726
exit 1
2827
- name: Allow merging
2928
if: ${{'false' == env.has_tag}}

‎.github/workflows/good-first-issue.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
issues: write
1313
steps:
1414
- name: Add comment
15-
uses: peter-evans/create-or-update-comment@v4
15+
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
1616
with:
1717
issue-number: ${{ github.event.issue.number }}
1818
body: |

‎.github/workflows/labeler.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,6 @@ jobs:
1010
pull-requests: write
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/labeler@v5
13+
- uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
1414
with:
1515
sync-labels: true

‎.github/workflows/mypy-stubtest.yml

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,25 @@ on: [pull_request]
44

55
permissions:
66
contents: read
7-
checks: write
87

98
jobs:
109
mypy-stubtest:
1110
name: mypy-stubtest
1211
runs-on: ubuntu-latest
12+
permissions:
13+
checks: write
1314
steps:
14-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
16+
with:
17+
persist-credentials: false
1518

1619
- name: Set up Python 3
17-
uses: actions/setup-python@v5
20+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
1821
with:
1922
python-version: '3.10'
2023

2124
- name: Set up reviewdog
22-
uses: reviewdog/action-setup@v1
25+
uses: reviewdog/action-setup@3f401fe1d58fe77e10d665ab713057375e39b887 # v1.3.9
2326

2427
- name: Install tox
2528
run: python -m pip install tox

‎.github/workflows/pr_welcome.yml

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,13 @@ name: PR Greetings
33

44
on: [pull_request_target]
55

6-
permissions:
7-
pull-requests: write
8-
96
jobs:
107
greeting:
118
runs-on: ubuntu-latest
12-
9+
permissions:
10+
pull-requests: write
1311
steps:
14-
- uses: actions/first-interaction@v1
12+
- uses: actions/first-interaction@34f15e814fe48ac9312ccf29db4e74fa767cbab7 # v1.3.0
1513
with:
1614
repo-token: ${{ secrets.GITHUB_TOKEN }}
1715
pr-message: >+

‎.github/workflows/reviewdog.yml

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,26 +4,28 @@ on: [pull_request]
44

55
permissions:
66
contents: read
7-
checks: write
8-
pull-requests: write
97

108
jobs:
119
flake8:
1210
name: flake8
1311
runs-on: ubuntu-latest
12+
permissions:
13+
checks: write
1414
steps:
15-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
16+
with:
17+
persist-credentials: false
1618

1719
- name: Set up Python 3
18-
uses: actions/setup-python@v5
20+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
1921
with:
2022
python-version: '3.10'
2123

2224
- name: Install flake8
2325
run: pip3 install -r requirements/testing/flake8.txt
2426

2527
- name: Set up reviewdog
26-
uses: reviewdog/action-setup@v1
28+
uses: reviewdog/action-setup@3f401fe1d58fe77e10d665ab713057375e39b887 # v1.3.9
2729

2830
- name: Run flake8
2931
env:
@@ -36,19 +38,23 @@ jobs:
3638
mypy:
3739
name: mypy
3840
runs-on: ubuntu-latest
41+
permissions:
42+
checks: write
3943
steps:
40-
- uses: actions/checkout@v4
44+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
45+
with:
46+
persist-credentials: false
4147

4248
- name: Set up Python 3
43-
uses: actions/setup-python@v5
49+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
4450
with:
4551
python-version: '3.10'
4652

4753
- name: Install mypy
4854
run: pip3 install -r requirements/testing/mypy.txt -r requirements/testing/all.txt
4955

5056
- name: Set up reviewdog
51-
uses: reviewdog/action-setup@v1
57+
uses: reviewdog/action-setup@3f401fe1d58fe77e10d665ab713057375e39b887 # v1.3.9
5258

5359
- name: Run mypy
5460
env:
@@ -63,11 +69,15 @@ jobs:
6369
eslint:
6470
name: eslint
6571
runs-on: ubuntu-latest
72+
permissions:
73+
checks: write
6674
steps:
67-
- uses: actions/checkout@v4
75+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
76+
with:
77+
persist-credentials: false
6878

6979
- name: eslint
70-
uses: reviewdog/action-eslint@v1
80+
uses: reviewdog/action-eslint@9b5b0150e399e1f007ee3c27bc156549810a64e3 # v1.33.0
7181
with:
7282
filter_mode: nofilter
7383
github_token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/stale-tidy.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
if: github.repository == 'matplotlib/matplotlib'
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: actions/stale@v9
12+
- uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
1313
with:
1414
repo-token: ${{ secrets.GITHUB_TOKEN }}
1515
operations-per-run: 300

‎.github/workflows/stale.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
if: github.repository == 'matplotlib/matplotlib'
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: actions/stale@v9
12+
- uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
1313
with:
1414
repo-token: ${{ secrets.GITHUB_TOKEN }}
1515
operations-per-run: 20

0 commit comments

Comments
 (0)