From bbb7eb859b4b35db30f9ddddbc0b18b7c358a604 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 14 Oct 2026 23:13:15 +0500 Subject: test: upgrade test-harness --- .github/workflows/ci.yml | 4 ++-- test/runner | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4fc1792..b595609 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,9 +42,9 @@ jobs: with: python-version: '${{ matrix.python-version }}' - name: Run tests as root - run: sudo ./test/runner/main.sh + run: sudo ./test/runner/harness - name: Run tests - run: ./test/runner/main.sh + run: ./test/runner/harness aur: name: Publish to AUR diff --git a/test/runner b/test/runner index a8e017f..882b380 160000 --- a/test/runner +++ b/test/runner @@ -1 +1 @@ -Subproject commit a8e017fedcae615576f61d28ac273449053f6f8b +Subproject commit 882b380fe94ef7670c7aa13aa4435351e05acbfd -- cgit v1.3 From 5128d8bb4cacce5e0ec0d62d7fa4ad62c8d3df92 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Thu, 15 Oct 2026 10:57:43 +0500 Subject: test: upgrade test-harness --- test/runner | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/runner b/test/runner index 882b380..5dd19d7 160000 --- a/test/runner +++ b/test/runner @@ -1 +1 @@ -Subproject commit 882b380fe94ef7670c7aa13aa4435351e05acbfd +Subproject commit 5dd19d7079304f6a79e8ddfcc942360f1d1dcf97 -- cgit v1.3 From 14624dee99683b218fd281bca9f06a67c65007b6 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Thu, 15 Oct 2026 15:41:04 +0500 Subject: ditch .git-blame-ignore-revs, who cares --- .git-blame-ignore-revs | 1 - 1 file changed, 1 deletion(-) delete mode 100644 .git-blame-ignore-revs diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs deleted file mode 100644 index eeec97d..0000000 --- a/.git-blame-ignore-revs +++ /dev/null @@ -1 +0,0 @@ -fd32c6ae8ad6c8ac4329d1b6e9796fa843e684a9 -- cgit v1.3 From b0ee873b9e836319639ab1a7c7afe2af6b388910 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Thu, 15 Oct 2026 23:56:26 +0500 Subject: dependabot: check git submodules --- .github/dependabot.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e65fe41..5f2637a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,3 +9,8 @@ updates: schedule: interval: weekly target-branch: debian + - package-ecosystem: gitsubmodule + directories: + - '**/*' + schedule: + interval: weekly -- cgit v1.3 From 863f7703e2da5cfe3ac44961829ad1c65f6a4037 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 21 Oct 2026 11:36:00 +0300 Subject: fix zizmor warnings & some linting --- .github/dependabot.yml | 6 ++++++ .github/workflows/ci.yml | 18 ++++++++++++------ 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5f2637a..6542be1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,13 +4,19 @@ updates: directory: / schedule: interval: weekly + cooldown: + default-days: 7 - package-ecosystem: github-actions directory: / schedule: interval: weekly target-branch: debian + cooldown: + default-days: 7 - package-ecosystem: gitsubmodule directories: - '**/*' schedule: interval: weekly + cooldown: + default-days: 7 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b595609..305df3c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,8 @@ on: push: workflow_dispatch: +permissions: {} + jobs: lint: runs-on: ubuntu-latest @@ -12,6 +14,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@v7 with: @@ -31,16 +35,17 @@ jobs: - '3.14' - '3.x' runs-on: ubuntu-latest - name: 'Python ${{ matrix.python-version }}' + name: Python ${{ matrix.python-version }} steps: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: false submodules: recursive - name: Set up Python uses: actions/setup-python@v7 with: - python-version: '${{ matrix.python-version }}' + python-version: ${{ matrix.python-version }} - name: Run tests as root run: sudo ./test/runner/harness - name: Run tests @@ -57,9 +62,8 @@ jobs: && !startsWith(github.ref, 'refs/tags/debian/') container: image: archlinux:base-devel - env: - SSH_KEY: | - ${{ secrets.SSH_KEY }} + permissions: + contents: write steps: # This step must be done before actions/checkout. From the latter's # output: @@ -72,9 +76,11 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: true ref: aur submodules: recursive - token: '${{ secrets.GH_TOKEN }}' - name: Run maintenance + env: + SSH_KEY: ${{ secrets.SSH_KEY }} run: | make -C "$GITHUB_WORKSPACE" ci -- cgit v1.3 From fb729769ad7bf4705395d1d297b36a02efcbcd5b Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Wed, 21 Oct 2026 11:39:07 +0300 Subject: workflows/ci: run zizmor --- .github/workflows/ci.yml | 4 ++++ .github/zizmor.yml | 5 +++++ 2 files changed, 9 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 305df3c..739b82e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,6 +11,8 @@ jobs: runs-on: ubuntu-latest name: Linting continue-on-error: "${{ github.ref != 'refs/heads/master' }}" + permissions: + security-events: write steps: - name: Checkout uses: actions/checkout@v7 @@ -22,6 +24,8 @@ jobs: python-version: '3.x' - name: Run black uses: psf/black@stable + - name: Run zizmor + uses: zizmorcore/zizmor-action@v0.7.1 test: strategy: diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..2ef0d8f --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,5 @@ +rules: + unpinned-uses: + config: + policies: + '*': ref-pin -- cgit v1.3