Skip to content

updates pre-commit and github action versions #174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rlskoeser merged 35 commits into from
Jul 30, 2026
Merged

updates pre-commit and github action versions #174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
35 commits
Select commit Hold shift + click to select a range
5131193
Preliminary sphinx-pyodide integration
rlskoeser Jan 16, 2026
0fcd8c1
Merge branch 'main' into develop
rlskoeser May 7, 2026
6743623
Set next release version to 0.8
rlskoeser May 7, 2026
a250380
Bump the actions group with 3 updates
dependabot[bot] May 7, 2026
276de83
Merge pull request #166 from dh-tech/dependabot/github_actions/action…
rlskoeser May 7, 2026
b39382e
Merge branch 'develop' into feature/sphinx-pyodide
rlskoeser May 21, 2026
961b158
Update github workflows & precommit to use pinned hashes instead of tags
rlskoeser Jul 2, 2026
e15710e
Configure to not persist permissions after checkout
rlskoeser Jul 2, 2026
29ea5b2
Update pre-commit hooks and copyright year in docs
rlskoeser Jul 2, 2026
363293a
Switch docs theme to furo, add light/dark mode logo
rlskoeser Jul 2, 2026
bc91b1d
Remove sphinx_pyodide ext since not yet available
rlskoeser Jul 2, 2026
320a13a
Merge pull request #170 from dh-tech/feature/pin-cmmit-hashes
rlskoeser Jul 2, 2026
76af22e
Add live examples based on the readme
rlskoeser Jul 2, 2026
fe0dc8e
Convert remaining examples from readme to live pyodide examples
rlskoeser Jul 2, 2026
f4fc9d6
Revise examples ported from readme
rlskoeser Jul 2, 2026
f3300e6
Clean up examples and highlight new features
rlskoeser Jul 2, 2026
59b5f40
Add editable examples & make them nicer to play with
rlskoeser Jul 2, 2026
d597eac
Restructure docs to provide brief overview; move examples to new page
rlskoeser Jul 2, 2026
fdd26f1
Add sphinx-pyodide to dependencies
rlskoeser Jul 3, 2026
1849db5
Merge branch 'develop' into feature/sphinx-pyodide
rlskoeser Jul 3, 2026
04bc5a9
Remove sphinx-pyodide from dev deps
rlskoeser Jul 3, 2026
885605f
Fix py dep caching discrepancy - everything uv
rlskoeser Jul 4, 2026
92450b0
Switch publish workflow to uv as well
rlskoeser Jul 4, 2026
4a78125
Comment out local path used for sphinx-pyodide dev
rlskoeser Jul 4, 2026
7e2f703
Use light/dark mode logo for docs index
rlskoeser Jul 4, 2026
d2d942e
Fix before/after to match the actual comparison
rlskoeser Jul 7, 2026
4cb5a65
Consolidate and shorten readme to avoid redundancy with docs
rlskoeser Jul 8, 2026
51fe17f
Merge pull request #171 from dh-tech/feature/sphinx-pyodide
rlskoeser Jul 30, 2026
8bb3cc0
Update pre-commit hooks with precommit auto-update
rlskoeser Jul 30, 2026
393ec92
Update github action versions
rlskoeser Jul 30, 2026
5b7b97a
Update with fixes flagged by latest version of ruff
rlskoeser Jul 30, 2026
e16b522
More fixes from ruff
rlskoeser Jul 30, 2026
cbe41cc
Updates flagged by coderabbit
rlskoeser Jul 30, 2026
3bd0a3b
Add mypy flag to work around missing types
rlskoeser Jul 30, 2026
0ee5d8c
Try testing against py3.14
rlskoeser Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions .github/workflows/check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,20 +19,21 @@ jobs:
working-directory: .

steps:
- uses: actions/checkout@v5

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Install uv
uses: astral-sh/setup-uv@v8.1.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
python-version: "3.12"
enable-cache: true
cache-dependency-glob: "pyproject.toml"
cache-dependency-glob: "uv.lock"

- name: Install package with check dependencies
run: uv sync --group check

- name: Run Ruff linter
uses: astral-sh/ruff-action@v3
uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89b # v4.1.0
with:
args: "check --output-format=github"

Expand All @@ -48,7 +49,7 @@ jobs:

# check types with mypy
- name: Check types in python src directory; install needed types
run: uv run mypy --install-types --non-interactive src
run: uv run mypy --install-types --non-interactive src --follow-untyped-imports

# use treon to make sure that example notebooks run
- name: Check jupyter notebooks with treon
Expand Down
31 changes: 14 additions & 17 deletions .github/workflows/python-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,23 +19,20 @@ permissions:

jobs:
deploy:

runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v5
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: '3.x'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install build
- name: Build package
run: python -m build
- name: Publish package
uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29
with:
user: __token__
password: ${{ secrets.PYPI_API_TOKEN }}
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Set up uv
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
python-version: "3.12"
Comment on lines +29 to +31

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpt =="
sed -n '1,120p' .github/workflows/python-publish.yml 2>/dev/null || true

echo
echo "== setup-uv references =="
rg -n "astral-sh/setup-uv|enable-cache|cache" .github/workflows -S || true

echo
echo "== setup-uv repo README default snippets from available commit/tag if network ok =="
if command -v gh >/dev/null 2>&1; then
  TAG="v9.0.0"
  echo "Fetching tag ref for astral-sh/setup-uv @ $TAG"
  gh api repos/astral-sh/setup-uv/git/ref "tags/$TAG" 2>/dev/null | jq -r '.object.sha, .object.type' || true
  COMMIT=$(gh api repos/astral-sh/setup-uv/git/ref "tags/$TAG" 2>/dev/null | jq -r 'if .object.type=="tag" then .object.sha else .object.object.shasum end' 2>/dev/null || true)
  echo "Resolved commit-ish: $COMMIT"
  if [ -n "$COMMIT" ]; then
    gh api repos/astral-sh/setup-uv/git/trees/"$COMMIT?recursive=1" 2>/dev/null \
      | jq -r '.tree[]? | select(.path|test("README\\.md|README.md|dist/index.js|input\\.jsonschema|package\\.json")) | .path, .type, .sha' || true
    gh api repos/astral-sh/setup-uv/contents/README.md?ref="$COMMIT" 2>/dev/null \
      | jq -r '.content | `@base64d`' | rg -n -C 2 "enable-cache|cache|cache-default|cache" || true
  fi
else
  echo "gh CLI not available"
fi

Repository: dh-tech/undate-python

Length of output: 2189

🌐 Web query:

astral-sh/setup-uv v9.0.0 enable-cache default auto README

💡 Result:

In astral-sh/setup-uv v9.0.0, the enable-cache input retains its default value of "auto" [1][2]. This setting enables caching on GitHub-hosted runners and disables it on self-hosted runners [1][3]. The primary change to caching behavior in v9.0.0 was a breaking change to the prune-cache input, which now defaults to false (previously true) [4][5]. This change was implemented to reduce unnecessary load on PyPI infrastructure by preventing the premature removal of pre-built wheels from the cache [4][6]. Key details regarding caching configuration: - enable-cache: Default is "auto", with options for "true", "false", or "auto" [7][1]. - prune-cache: Default is now "false" [4][2]. - Official documentation provides further details on managing cache dependencies and behavior in the docs/caching.md file [8].

Citations:

🌐 Web query:

GitHub Actions third-party action cached variables poisoned cache trusted workflows

💡 Result:

Cache poisoning in GitHub Actions is a supply-chain attack where an attacker injects malicious content into the shared action cache, which is subsequently executed by a more privileged workflow (such as a release or deployment pipeline) [1][2][3]. Because cache entries are repository-scoped rather than workflow-scoped, they can be read by any workflow triggered on the same branch [1][3]. As of June 26, 2026, GitHub has implemented a significant security mitigation: workflows triggered by untrusted events (e.g., pull_request_target, issue_comment, and fork-PR workflow_run cascades) now receive read-only access to the default-branch cache [4][5]. This prevents these untrusted contexts from overwriting or poisoning cache entries intended for use by trusted workflows like push or schedule [4]. Key security considerations include: 1. Trusted Workflows and Triggers: While the recent read-only change mitigates the most common public-to-private poisoning vectors, trusted workflows themselves remain a risk [5]. If a workflow that has write access to the cache is itself influenced by untrusted inputs (e.g., a workflow on the default branch that checks out untrusted PR code), it can still serve as a vehicle for cache poisoning [6][4][5]. 2. Third-Party Actions: Using third-party actions introduces the risk that a compromised action could manipulate cache writes [7]. All third-party actions should be pinned to a specific commit SHA, not a mutable tag or branch, to prevent attackers from injecting malicious code by re-tagging (e.g., moving a v4 tag) [8][7][9]. 3. Defense-in-Depth: - Segregate Cache Keys: Use distinct prefixes for cache keys based on the trust level of the workflow (e.g., pr- vs. release-) to ensure that PR-triggered workflows cannot overwrite or satisfy the cache keys used by release workflows [5][10][3]. - Disable Caching in Critical Jobs: For highly sensitive jobs like publishing or releases, consider disabling caching entirely or using lookup-only mode to prevent the accidental execution of potentially malicious cached dependencies [5][9][11]. - Audit and Governance: Regularly audit workflows for the use of privileged triggers (pull_request_target) combined with untrusted checkout commands [6][10]. Automated tools and linters (such as CodeQL or custom security policies) can help identify these patterns [10][12][11]. While the June 2026 update addresses the most direct cross-boundary poisoning paths, the fundamental principle remains: treat the cache as an unsigned, potentially untrusted input that should never be implicitly trusted in high-privilege execution contexts [5][9].

Citations:

Disable uv caching in the publishing job.

The release workflow uses astral-sh/setup-uv with its default enable-cache: auto, which enables caching on GitHub-hosted runners. Keep cache-free for release builds by setting enable-cache: false explicitly.

🧰 Tools
🪛 zizmor (1.28.0)

[error] 29-29: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/python-publish.yml around lines 29 - 31, Disable caching
for the publishing job by adding the explicit enable-cache: false setting to the
with configuration of astral-sh/setup-uv, while preserving the existing Python
version.

Sources: MCP tools, Linters/SAST tools

- name: Build package
run: uv build
- name: Publish package
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
with:
user: __token__
password: ${{ secrets.PYPI_API_TOKEN }}
Comment on lines +35 to +38

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Changed/workflow files:"
git ls-files '.github/workflows/*' || true

echo
echo "python-publish.yml:"
if [ -f .github/workflows/python-publish.yml ]; then
  nl -ba .github/workflows/python-publish.yml | sed -n '1,140p'
else
  echo "missing .github/workflows/python-publish.yml"
fi

echo
echo "Search for PYPI_API_TOKEN and python-publish reference:"
rg -n "PYPI_API_TOKEN|gh-action-pypi-publish|pypa|workflow_dispatch|environment:" .github workflows 2>/dev/null || true

echo
echo "Tag/sha check if remote available:"
if command -v gh >/dev/null 2>&1; then
  set +e
  gh api --method GET -H "Accept: application/vnd.github+json" repos/dh-tech/undate-python/git/ref/heads/feature/updates >/tmp/feature_ref.json 2>/tmp/feature_ref.err || true
  cat /tmp/feature_ref.err >&2
  gh api -H "Accept: application/vnd.github+json" /tmp/feature_ref.json && true
  set -e
  echo
  tag_ref=$(gh api -H "Accept: application/vnd.github+json" repos/dh-tech/undate-python/git/ref/tags/v1.14.2 2>/tmp/tag_ref.err || cat /tmp/tag_ref.err)
  echo "tag_ref=$tag_ref"
  gh api -H "Accept: application/vnd.github+json" "repos/dh-tech/undate-python/git/ref/tags/v1.14.2" || true
else
  echo "gh not available"
fi

Repository: dh-tech/undate-python

Length of output: 343

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,180p' .github/workflows/python-publish.yml

echo
echo "Search for publishing inputs/secrets:"
rg -n "PYPI_API_TOKEN|gh-action-pypi-publish|pypa|workflow_dispatch|environment:|permissions:|on:|release|if:" .github/workflows/python-publish.yml .github/workflows 2>/dev/null || true

Repository: dh-tech/undate-python

Length of output: 3631

Gate manual publishing and remove the long-lived PyPI token.

workflow_dispatch can launch this workflow from branches, and PYPI_API_TOKEN is still passed into gh-action-pypi-publish. Only publish on release or enforced workflow_dispatch protection (e.g. protected environment/restriction), and migrate to PyPI Trusted Publishing with id-token: write instead of user/password.

🧰 Tools
🪛 zizmor (1.28.0)

[info] 35-35: prefer trusted publishing for authentication (use-trusted-publishing): this step

(use-trusted-publishing)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/python-publish.yml around lines 35 - 38, Update the
publishing job around the PyPI publish action to restrict execution to releases
or an enforced protected environment for manual workflow_dispatch runs,
preventing unrestricted branch-triggered publishing. Configure the job
permissions with id-token: write and migrate pypa/gh-action-pypi-publish to
Trusted Publishing by removing the user and password inputs, including
PYPI_API_TOKEN.

Source: MCP tools

23 changes: 12 additions & 11 deletions .github/workflows/unit_tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,10 @@ on:
branches:
- "**"
paths:
- 'undate/**'
- 'tests/**'
- "src/undate/**"
- "tests/**"
- "pyproject.toml"
- "uv.lock"
pull_request:
branches:
- "**"
Expand All @@ -28,21 +30,21 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
python: ["3.10", "3.11", "3.12", "3.13"]
python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
defaults:
run:
working-directory: .

steps:
- uses: actions/checkout@v5

# use github python action instead of uv to take advantage of caching
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Set up Python ${{ matrix.python }}
uses: astral-sh/setup-uv@v8.1.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
python-version: ${{ matrix.python }}
cache: 'pip'
cache-dependency-path: '**/pyproject.toml'
enable-cache: true
cache-dependency-glob: "uv.lock"

- name: Install package with check dependencies
run: uv sync --group test
Expand All @@ -58,8 +60,7 @@ jobs:
if: ${{ matrix.python == env.COV_PYTHON_VERSION }}

- name: Upload coverage to Codecov
uses: codecov/codecov-action@v5
uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
env:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
if: ${{ matrix.python == env.COV_PYTHON_VERSION }}

15 changes: 8 additions & 7 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,13 @@ files: \.py
repos:
# ruff for linting and formatting python
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.15.12
rev: cb8c523fd4835aba42af70f4cad5568db4df0b6c # frozen: v0.16.0
hooks:
- id: ruff-check
args: [ --fix, --show-fixes, --exit-non-zero-on-fix ]
args: [--fix, --show-fixes, --exit-non-zero-on-fix]
- id: ruff-format
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v6.0.0
rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
hooks:
- id: check-case-conflict
- id: check-merge-conflict
Expand All @@ -22,25 +22,26 @@ repos:
args: [--pytest-test-first]

- repo: https://github.com/pre-commit/mirrors-mypy
rev: v2.0.0
rev: 41e691678310dfd3833f7ab4e180ddb014310356 # frozen: v2.3.0
hooks:
- id: mypy
additional_dependencies: [numpy]

# yamlfmt for formatting YAML files
- repo: https://github.com/google/yamlfmt
rev: v0.21.0
rev: b5ca1890231d5e1e5181fef75a1be609d1e25029 # frozen: v0.21.0
hooks:
- id: yamlfmt
# Codespell for spell checking
- repo: https://github.com/codespell-project/codespell
rev: v2.4.2
rev: 57b21406f092110c18776e39b0bda50d37c945c8 # frozen: v2.4.3
hooks:
- id: codespell
additional_dependencies:
- tomli
exclude_types: ["css", "html", "javascript", "json"]
# Validate GitHub Actions workflow files
- repo: https://github.com/mpalmer/action-validator
rev: v0.9.0
rev: 76a805bbfcba3506d6cdb4bba1810ab504e0d72b # frozen: v0.9.0
hooks:
- id: action-validator
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
# Change Log

## 0.8

-
Comment on lines +3 to +5

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Replace the empty placeholder with actual release notes.

Line [5] leaves a malformed, content-free changelog entry. Add the 0.8 changes, or omit the bullet until they are ready.

Suggested fix 
 ## 0.8
 
--
+- Document the changes included in the 0.8 development cycle.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
## 0.8
-
## 0.8
- Document the changes included in the 0.8 development cycle.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CHANGELOG.md` around lines 3 - 5, Replace the empty bullet under the “0.8”
changelog heading with the actual release notes for version 0.8, or remove the
bullet entirely until those notes are available. Keep the changelog entry valid
and contentful.


## 0.7

Expand Down
Loading
Loading