From 57604137e382ca5e92ee3644f8f5a37f756d00b8 Mon Sep 17 00:00:00 2001 From: Claudio Pilotti Date: Wed, 29 Jul 2026 18:02:58 +0200 Subject: [PATCH 1/2] Check GitHub actions with zizmor (SEA-2065) --- .github/workflows/python-pr.yaml | 15 ++++++++---- .github/workflows/python-publish.yaml | 8 ++++--- .github/workflows/python-tox.yaml | 15 ++++++++---- .github/workflows/zizmor.yml | 33 +++++++++++++++++++++++++++ .pre-commit-config.yaml | 4 ++++ 5 files changed, 64 insertions(+), 11 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/python-pr.yaml b/.github/workflows/python-pr.yaml index 2a5fea1..16efe90 100644 --- a/.github/workflows/python-pr.yaml +++ b/.github/workflows/python-pr.yaml @@ -3,21 +3,28 @@ name: tests (pull_request) on: pull_request: +permissions: {} + jobs: build: runs-on: ubuntu-latest + permissions: + contents: read + strategy: matrix: - python-version: [3.8, 3.9, '3.10', '3.11', '3.12', '3.13'] + python-version: ['3.10', '3.11', '3.12', '3.13'] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} allow-prereleases: true diff --git a/.github/workflows/python-publish.yaml b/.github/workflows/python-publish.yaml index 0d471c5..4b007e1 100644 --- a/.github/workflows/python-publish.yaml +++ b/.github/workflows/python-publish.yaml @@ -17,10 +17,12 @@ jobs: id-token: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.x" @@ -33,4 +35,4 @@ jobs: run: python -m build -s -w - name: Publish package distributions to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1 diff --git a/.github/workflows/python-tox.yaml b/.github/workflows/python-tox.yaml index a06803a..6d39a99 100644 --- a/.github/workflows/python-tox.yaml +++ b/.github/workflows/python-tox.yaml @@ -3,15 +3,22 @@ name: tests on: push: +permissions: {} + jobs: build: runs-on: ubuntu-latest + permissions: + contents: read + strategy: matrix: - python-version: [3.8, 3.9, '3.10', '3.11', '3.12', '3.13'] + python-version: ['3.10', '3.11', '3.12', '3.13'] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Get branch name (merge) if: github.event_name != 'pull_request' @@ -28,10 +35,10 @@ jobs: >> $GITHUB_ENV - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} allow-prereleases: true diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..6d0b1ea --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,33 @@ +# https://docs.zizmor.sh/integrations/#github-actions +name: Zizmor (GitHub Actions Security) + +on: + push: + paths: + - '.github/workflows/**' + pull_request: + paths: + - '.github/workflows/**' + +permissions: {} + +concurrency: + group: zizmor-${{ github.ref }} + cancel-in-progress: true + +jobs: + zizmor: + runs-on: ubuntu-latest + permissions: + contents: read # Required for private repos + actions: read # Required for private repos + steps: + - name: Checkout repository + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0 + with: + advanced-security: false diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 8d78c94..47de0ab 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -38,3 +38,7 @@ repos: pass_filenames: false args: ["-p", "pytest_codecov", "-p", "tests"] + - repo: https://github.com/zizmorcore/zizmor-pre-commit + rev: v1.28.0 + hooks: + - id: zizmor From 630838e42a12fd9174f87fc6cea6be78989b1410 Mon Sep 17 00:00:00 2001 From: Claudio Pilotti Date: Wed, 29 Jul 2026 18:13:26 +0200 Subject: [PATCH 2/2] Drop EOL Python versions. --- pyproject.toml | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 8907749..324e786 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -9,7 +9,7 @@ name = "pytest-codecov" dynamic = ["version"] description = "Pytest plugin for uploading pytest-cov results to codecov.io" readme = "README.rst" -requires-python = ">=3.8" +requires-python = ">=3.10" authors = [ { name = "David Salvisberg", email = "david.salvisberg@seantis.ch" }, ] @@ -24,12 +24,11 @@ classifiers = [ "Topic :: Software Development :: Testing", "Operating System :: OS Independent", "Programming Language :: Python", - "Programming Language :: Python :: 3.8", - "Programming Language :: Python :: 3.9", "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", "Programming Language :: Python :: 3.13", + "Programming Language :: Python :: 3.14", "Programming Language :: Python :: 3 :: Only", "Programming Language :: Python :: Implementation :: CPython", "Programming Language :: Python :: Implementation :: PyPy", @@ -80,7 +79,7 @@ exclude_lines = [ ] [tool.mypy] -python_version = "3.8" +python_version = "3.10" follow_imports = "silent" namespace_packages = true explicit_package_bases = true @@ -200,20 +199,19 @@ docstring-code-line-length = "dynamic" [tool.tox] legacy_tox_ini = """ [tox] - envlist = py38,py39,py310,py311,py312,py313,mypy,ruff,report + envlist = py310,py311,py312,py313,mypy,ruff,report [gh-actions] python = - 3.8: py38 - 3.9: py39 3.10: py310 3.11: py311,ruff,mypy 3.12: py312 3.13: py313 + 3.13: py314 [testenv] setenv = - py{38,39,310,311,312,313}: COVERAGE_FILE = .coverage.{envname} + py{310,311,312,313}: COVERAGE_FILE = .coverage.{envname} commands = pytest --cov --cov-report= {posargs:tests} pytest -n2 --cov --cov-report= {posargs:tests} @@ -232,11 +230,11 @@ legacy_tox_ini = """ mypy types-requests commands = - mypy -p pytest_codecov -p tests --python-version 3.9 mypy -p pytest_codecov -p tests --python-version 3.10 mypy -p pytest_codecov -p tests --python-version 3.11 mypy -p pytest_codecov -p tests --python-version 3.12 mypy -p pytest_codecov -p tests --python-version 3.13 + mypy -p pytest_codecov -p tests --python-version 3.14 [testenv:ruff] skip_install = true