From 974f92b194238fbca67da388fab73183e66911ef Mon Sep 17 00:00:00 2001 From: Andrew Ma <136692+ajma@users.noreply.github.com> Date: Sat, 12 Sep 2026 14:17:50 -0700 Subject: [PATCH 1/3] fix: update GitHub Actions to Node 24 runtime versions actions/checkout, actions/setup-python, actions/cache, and the google-github-actions auth/setup-gcloud actions were pinned to versions that still target the deprecated Node 20 runtime, which GitHub now force-upgrades with a warning on every run. Bump each to the latest major that declares node24 in its own action metadata. --- .github/workflows/integration-tests.yaml | 10 +++++----- .github/workflows/lint-readme.yaml | 4 ++-- .github/workflows/pyink.yaml | 4 ++-- .github/workflows/tests.yaml | 6 +++--- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/integration-tests.yaml b/.github/workflows/integration-tests.yaml index e2573e7b..a11aa527 100644 --- a/.github/workflows/integration-tests.yaml +++ b/.github/workflows/integration-tests.yaml @@ -40,17 +40,17 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Setup Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Cache pip dependencies - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-integration-${{ hashFiles('requirements-dev.txt', 'requirements-test.txt') }} @@ -64,12 +64,12 @@ jobs: pip install -r requirements-test.txt - name: Authenticate to Google Cloud - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2 + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 with: credentials_json: ${{ secrets.GCP_SA_KEY }} - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2 + uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 - name: Extract service account details env: diff --git a/.github/workflows/lint-readme.yaml b/.github/workflows/lint-readme.yaml index a585ec91..5500c00d 100644 --- a/.github/workflows/lint-readme.yaml +++ b/.github/workflows/lint-readme.yaml @@ -28,12 +28,12 @@ jobs: steps: - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7.0.0 with: python-version: "3.12" - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v7.0.1 - name: Install dependencies run: pip install build twine diff --git a/.github/workflows/pyink.yaml b/.github/workflows/pyink.yaml index 1632abac..c250725e 100644 --- a/.github/workflows/pyink.yaml +++ b/.github/workflows/pyink.yaml @@ -26,7 +26,7 @@ jobs: steps: - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7.0.0 with: python-version: "3.12" @@ -34,7 +34,7 @@ jobs: run: pip install pyink - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v7.0.1 - name: Run pyink check run: pyink . --check \ No newline at end of file diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 00d5b09a..0c7eb5e8 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -25,15 +25,15 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v7.0.1 - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7.0.0 with: python-version: "3.12" - name: Cache pip dependencies - uses: actions/cache@v4 + uses: actions/cache@v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'requirements-test.txt') }} From 25cee14748d12ebd58cf74ad5a4788216faea285 Mon Sep 17 00:00:00 2001 From: Andrew Ma <136692+ajma@users.noreply.github.com> Date: Sat, 12 Sep 2026 14:31:10 -0700 Subject: [PATCH 2/3] fix: pin actions to commit SHA to satisfy org zizmor policy The org's zizmor security scan mandatorily requires every action reference to be pinned to a full commit SHA, not a floating tag. Apply the same SHA + version-comment pattern already used in integration-tests.yaml to the remaining three workflows. --- .github/workflows/lint-readme.yaml | 4 ++-- .github/workflows/pyink.yaml | 4 ++-- .github/workflows/tests.yaml | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/lint-readme.yaml b/.github/workflows/lint-readme.yaml index 5500c00d..560f3abd 100644 --- a/.github/workflows/lint-readme.yaml +++ b/.github/workflows/lint-readme.yaml @@ -28,12 +28,12 @@ jobs: steps: - name: Setup Python - uses: actions/setup-python@v7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Checkout code - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install dependencies run: pip install build twine diff --git a/.github/workflows/pyink.yaml b/.github/workflows/pyink.yaml index c250725e..ea47526d 100644 --- a/.github/workflows/pyink.yaml +++ b/.github/workflows/pyink.yaml @@ -26,7 +26,7 @@ jobs: steps: - name: Setup Python - uses: actions/setup-python@v7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" @@ -34,7 +34,7 @@ jobs: run: pip install pyink - name: Checkout code - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run pyink check run: pyink . --check \ No newline at end of file diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 0c7eb5e8..9c8a051c 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -25,15 +25,15 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Python - uses: actions/setup-python@v7.0.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Cache pip dependencies - uses: actions/cache@v6.1.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.cache/pip key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'requirements-test.txt') }} From 9cd053dc79f0455f909a267f38e828ffaab6eeaf Mon Sep 17 00:00:00 2001 From: Andrew Ma <136692+ajma@users.noreply.github.com> Date: Sat, 12 Sep 2026 14:34:35 -0700 Subject: [PATCH 3/3] fix: scope workflow token permissions to contents:read zizmor flags the missing permissions block as overly broad (Medium severity), since the default GITHUB_TOKEN grants broader access than these jobs need. Both only checkout and run tests/lint, so contents:read matches lint-readme.yaml and integration-tests.yaml. --- .github/workflows/pyink.yaml | 2 ++ .github/workflows/tests.yaml | 3 +++ 2 files changed, 5 insertions(+) diff --git a/.github/workflows/pyink.yaml b/.github/workflows/pyink.yaml index ea47526d..0a104116 100644 --- a/.github/workflows/pyink.yaml +++ b/.github/workflows/pyink.yaml @@ -18,6 +18,8 @@ on: pull_request: branches: [ main ] +permissions: + contents: read jobs: pyink: diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 9c8a051c..abaa39f5 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -18,6 +18,9 @@ on: branches: [ main ] workflow_dispatch: +permissions: + contents: read + jobs: test: name: Run unit tests