From cb67c89617f46dd925eb4245a22d9a352f94ae22 Mon Sep 17 00:00:00 2001 From: aliziel <21992503+aliziel@users.noreply.github.com> Date: Fri, 26 Jun 2026 13:32:52 -0700 Subject: [PATCH 1/3] ci: add dependabot version update config --- .github/dependabot.yml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..209fdf7a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,29 @@ +version: 2 +updates: + + - package-ecosystem: "pip" + directory: "/" + cooldown: + default-days: 7 + semver-major-days: 30 + schedule: + interval: weekly + groups: + all: + patterns: + - "*" + commit-message: + prefix: "chore(deps):" + + - package-ecosystem: "github-actions" + directory: "/" + cooldown: + default-days: 7 + schedule: + interval: "weekly" + groups: + all: + patterns: + - "*" + commit-message: + prefix: "ci(deps):" From 4669823b8d4d13bd305547d1e667bb25385ae131 Mon Sep 17 00:00:00 2001 From: aliziel <21992503+aliziel@users.noreply.github.com> Date: Fri, 26 Jun 2026 13:35:38 -0700 Subject: [PATCH 2/3] ci: add OSSF scorecard workflow --- .github/workflows/scorecard.yml | 43 +++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 00000000..5c57a0d2 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,43 @@ +name: OSSF Scorecard + +on: + push: + branches: + - main + schedule: + - cron: "30 16 * * 1" # Monday 10:30/11:30 CT + +permissions: read-all # Default all to readonly + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + security-events: write # Allow upload to Security dashboard + id-token: write # Access GitHub's OIDC token to verify authenticity of result for publish + + steps: + - name: Checkout code + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run analysis + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: Upload artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + - name: Upload to code-scanning + uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 + with: + sarif_file: results.sarif From 27aa99fcbcd08c7ded7059fb29bc355b85010a19 Mon Sep 17 00:00:00 2001 From: aliziel <21992503+aliziel@users.noreply.github.com> Date: Fri, 26 Jun 2026 13:48:25 -0700 Subject: [PATCH 3/3] ci: pin actions to commit SHAs --- .github/workflows/build-to-binder.yml | 3 ++- .github/workflows/preview.yml | 8 ++++---- .github/workflows/quarto-publish.yml | 8 ++++---- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-to-binder.yml b/.github/workflows/build-to-binder.yml index b11ece62..b9f32254 100644 --- a/.github/workflows/build-to-binder.yml +++ b/.github/workflows/build-to-binder.yml @@ -8,7 +8,8 @@ jobs: runs-on: ubuntu-latest steps: - name: Build and cache on mybinder.org - uses: jupyterhub/repo2docker-action@master + # Action does not use versioned releases, refer to default branch + uses: jupyterhub/repo2docker-action@92fefcbd2b46dd9716f5263a9e740cbc972f6dd9 #2026-02-23 with: NO_PUSH: true MYBINDERORG_TAG: ${{ github.event.ref }} \ No newline at end of file diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml index adf59f32..8e36ce1f 100644 --- a/.github/workflows/preview.yml +++ b/.github/workflows/preview.yml @@ -10,13 +10,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 #v3.6.0 - name: Set up Quarto - uses: quarto-dev/quarto-actions/setup@v2 + uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b #v2.2.0 - name: Install Python and Dependencies - uses: actions/setup-python@v4 + uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c #v4.9.1 with: python-version: '3.12' cache: 'pip' @@ -26,6 +26,6 @@ jobs: - run: quarto render --to html - name: Deploy preview - uses: rossjrw/pr-preview-action@v1 + uses: rossjrw/pr-preview-action@ffa7509e91a3ec8dfc2e5536c4d5c1acdf7a6de9 #v1.8.1 with: source-dir: _site diff --git a/.github/workflows/quarto-publish.yml b/.github/workflows/quarto-publish.yml index aa244452..32eb3256 100644 --- a/.github/workflows/quarto-publish.yml +++ b/.github/workflows/quarto-publish.yml @@ -9,13 +9,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out repository - uses: actions/checkout@v2 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 #v3.6.0 - name: Set up Quarto - uses: quarto-dev/quarto-actions/setup@v2 + uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b #v2.2.0 - name: Install Python and Dependencies - uses: actions/setup-python@v4 + uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c #v4.9.1 with: python-version: '3.12' cache: 'pip' @@ -25,7 +25,7 @@ jobs: - run: quarto render --to html - name: Publish to GitHub Pages (and render) - uses: quarto-dev/quarto-actions/publish@v2 + uses: quarto-dev/quarto-actions/publish@8a96df13519ee81fd526f2dfca5962811136661b #v2.2.0 with: target: gh-pages env: