diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml index a6993ef..7a9025f 100644 --- a/.github/workflows/R-CMD-check.yaml +++ b/.github/workflows/R-CMD-check.yaml @@ -6,6 +6,12 @@ on: name: R-CMD-check +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: R-CMD-check: runs-on: ${{ matrix.config.os }} @@ -24,13 +30,15 @@ jobs: steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - name: Set up Rust - uses: dtolnay/rust-toolchain@stable + - name: Set up Rust stable + run: rustup toolchain install stable - name: Cache Rust Compilation - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: "microbiorust-r/src/rust -> target" @@ -39,30 +47,31 @@ jobs: run: | # 1. Copy the sibling crate into the R package so it gets zipped into the tarball cp -r seqmetrics microbiorust-r/src/rust/seqmetrics - + # 2. Rewrite the path in Cargo.toml to point to this new internal folder sed -i.bak 's|path *= *"[^"]*seqmetrics"|path = "./seqmetrics"|g' microbiorust-r/src/rust/Cargo.toml - + # 3. Clean up the backup file sed creates rm microbiorust-r/src/rust/Cargo.toml.bak # --- THE FIX ENDS HERE --- - name: Set up R - uses: r-lib/actions/setup-r@v2 + uses: r-lib/actions/setup-r@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2 with: r-version: ${{ matrix.config.r }} use-public-rspm: true - name: Install R Dependencies - uses: r-lib/actions/setup-r-dependencies@v2 + uses: r-lib/actions/setup-r-dependencies@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2 with: working-directory: microbiorust-r extra-packages: any::rcmdcheck needs: check - name: Run R CMD Check - uses: r-lib/actions/check-r-package@v2 + uses: r-lib/actions/check-r-package@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2 with: working-directory: microbiorust-r + error-on: '"error"' env: _R_CHECK_CRAN_INCOMING_: false diff --git a/.github/workflows/microbiorust-py_benchmarks.yml b/.github/workflows/microbiorust-py_benchmarks.yml index 854c70c..f5e3034 100644 --- a/.github/workflows/microbiorust-py_benchmarks.yml +++ b/.github/workflows/microbiorust-py_benchmarks.yml @@ -5,32 +5,39 @@ on: branches: - main -permissions: - contents: write - pages: write - id-token: write +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true jobs: benchmark: runs-on: ubuntu-latest + name: Run Benchmarks + permissions: + contents: write # needed for Github pages + pages: write # needed for Github pages + id-token: write # needed for Github pages env: CODECARBON_OFFLINE: "True" CODECARBON_COUNTRY_ISO_CODE: "USA" CODECARBON_CONSTANT_CARBON_INTENSITY: 475 steps: - name: Checkout source - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' cache: 'pip' - - name: Set up Rust - uses: dtolnay/rust-toolchain@stable + - name: Set up Rust stable + run: rustup toolchain install stable - name: Install dependencies run: pip install asv virtualenv maturin biopython codecarbon @@ -38,10 +45,11 @@ jobs: # 1. GET OLD HISTORY - name: Load previous results continue-on-error: true - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: gh-pages path: old_pages + persist-credentials: false # set up ASV here so as to copy the history to it - name: Configure ASV working-directory: microbiorust-py @@ -52,7 +60,7 @@ jobs: #there were difficulties with a subfolder being created sometimes ASV_ROOT_RESULTS_DIR="microbiorust-py/.asv/results/" ASV_MACHINE_RESULTS_DIR="microbiorust-py/.asv/results/github-runner/" - + if [ -d "old_pages/results" ]; then echo "Restoring previous benchmark results from old_pages/results..." mkdir -p "${ASV_ROOT_RESULTS_DIR}" @@ -91,7 +99,7 @@ jobs: # 6. UPLOAD EVERYTHING - name: Deploy to GitHub Pages - uses: peaceiris/actions-gh-pages@v3 + uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} publish_dir: microbiorust-py/.asv/html diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index a2f9b90..77bd56c 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -6,7 +6,7 @@ name: microbiorust-py python tests on: push: branches: [ "main" ] - paths: + paths: - 'microbiorust-py/**' pull_request: branches: [ "main" ] @@ -16,37 +16,43 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: build: - + name: Build and Test (Python) runs-on: ubuntu-latest - + steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Python 3.12 - uses: actions/setup-python@v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" cache: 'pip' cache-dependency-path: 'microbiorust-py/pyproject.toml' - - - name: Set up Rust - uses: dtolnay/rust-toolchain@stable - + + - name: Set up Rust stable + run: rustup toolchain install stable + - name: Install dependencies run: | python -m pip install --upgrade pip pip install maturin ruff pytest pip install ./microbiorust-py - + - name: Lint with ruff run: | # stop the build for critical errors (E9, F63, F7, F82 equivalents) ruff check microbiorust-py/ --select E9,F63,F7,F82 --output-format=full # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide ruff check microbiorust-py/ --exit-zero --line-length=127 - + - name: Test with pytest run: | - pytest -v + pytest -v working-directory: microbiorust-py/tests diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 12888e8..c720694 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,6 +16,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: build: name: Build wheels @@ -35,20 +39,22 @@ jobs: - os: windows-latest target: x86_64 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' - name: Build wheels - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 with: target: ${{ matrix.target }} args: --release --out dist --find-interpreter - sccache: 'true' + sccache: false manylinux: auto working-directory: microbiorust-py - name: Upload wheels - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: wheels-${{ matrix.os }}-${{ matrix.target }} path: microbiorust-py/dist @@ -58,18 +64,20 @@ jobs: if: github.repository == 'microBioRust/microBioRust' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' - name: Build sdist - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 with: command: sdist args: --out dist working-directory: microbiorust-py - name: Upload sdist - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: wheels-sdist path: microbiorust-py/dist @@ -83,12 +91,12 @@ jobs: permissions: id-token: write # from Trusted Publishing steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: merge-multiple: true path: dist - name: Publish to PyPI - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 with: command: upload args: --non-interactive --skip-existing dist/* diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index 80f3e68..9eac6a8 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -9,14 +9,24 @@ on: env: CARGO_TERM_COLOR: always +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: build: - + name: Build and Test (Rust) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Build run: cargo build + - name: Run tests one-three run: cargo test --verbose diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..5a01baa --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,26 @@ +name: zizmor + +on: + pull_request: + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + +jobs: + lint-github-actions: + name: Run zizmor + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Check Github Workflows for security issues + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 + with: + advanced-security: false