Skip to content

chore(deps): Update GitHub Actions #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
williaby merged 1 commit into from
Sep 3, 2026
Merged

chore(deps): Update GitHub Actions #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ permissions:
jobs:
ci:
name: CI Pipeline
uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
python-version: '3.12'
coverage-threshold: 80
Expand All @@ -55,14 +55,14 @@ jobs:
working-directory: frontend
steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
# egress-policy: block -- enabled 2026-05-23 (compliance audit). If a CI run fails on a network call, switch this single occurrence back to audit and capture the missing endpoint in the issue tracker.
egress-policy: audit # TODO: switch to block after 2026-06-30 (compliance audit deferral)
Comment on lines 60 to 61

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow snippets =="
for f in .github/workflows/ci.yml .github/workflows/pr-validation.yml; do
  if [ -f "$f" ]; then
    echo "-- $f --"
    nl -ba "$f" | sed -n '45,65p;90,105p'
  else
    echo "MISSING $f"
  fi
done

echo
echo "== date context =="
python3 - <<'PY'
from datetime import datetime, timezone
now = datetime.now(timezone.utc).strftime("%Y-%m-%d")
print("current_utc", now)
print("expired_after_2026-06-30", now > "2026-06-30")
PY

echo
echo "== harden-runner occurrences =="
rg -n "harden-runner|egress-policy" .github/workflows || true

Repository: ByronWilliamsCPA/rag-processor

Length of output: 263

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow snippets =="
for f in .github/workflows/ci.yml .github/workflows/pr-validation.yml; do
  if [ -f "$f" ]; then
    echo "-- $f --"
    awk '{printf "%5d\t%s\n", NR, $0}' "$f" | sed -n '45,65p;90,105p'
  else
    echo "MISSING $f"
  fi
done

echo
echo "== date context =="
python3 - <<'PY'
from datetime import datetime, timezone
now = datetime.now(timezone.utc).date().isoformat()
print("current_utc", now)
print("expired_after_2026-06-30", now > "2026-06-30")
PY

echo
echo "== harden-runner occurrences =="
grep -nE "harden-runner|egress-policy" .github/workflows || true

Repository: ByronWilliamsCPA/rag-processor

Length of output: 4206

Resolve the expired harden-runner egress deferrals.

These workflow steps remain in egress-policy: audit even though the inline comments require switching to block after June 30, 2026. Enable blocking after validating required endpoints, or renew the exception with an owner and a new expiry.

Suggested patch 
-          egress-policy: audit  # TODO: switch to block after 2026-06-30 (compliance audit deferral)
+          egress-policy: block
  • .github/workflows/pr-validation.yml#L55-L56: Expired dead-code egress deferral.
  • .github/workflows/pr-validation.yml#L98-L99: Expired link-check egress deferral.
  • .github/workflows/ci.yml#L60-L61: Expired Playwright/CI egress deferral.
📍 Affects 2 files
  • .github/workflows/ci.yml#L60-L61 (this comment)
  • .github/workflows/pr-validation.yml#L55-L56
  • .github/workflows/pr-validation.yml#L98-L99
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 60 - 61, Resolve the expired
egress-policy deferrals by validating required endpoints and changing the audit
settings to block at .github/workflows/ci.yml lines 60-61,
.github/workflows/pr-validation.yml lines 55-56, and
.github/workflows/pr-validation.yml lines 98-99; if blocking cannot be enabled,
renew each exception with an owner and a new expiry.

Sources: Coding guidelines, Path instructions

- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
Comment on lines 62 to +63

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Disable credential persistence on every modified checkout.

These checkout steps still use the default credential persistence behavior. Add persist-credentials: false to each step.

Suggested patch 
       - name: Checkout repository
         uses: actions/checkout@...
+        with:
+          persist-credentials: false
  • .github/workflows/ci.yml#L62-L63: Harden the Playwright checkout.
  • .github/workflows/dependency-review.yml#L35-L36: Harden the dependency-review checkout.
  • .github/workflows/fips-compatibility.yml#L63-L64: Harden the FIPS checkout.
  • .github/workflows/fips-compatibility.yml#L200-L201: Harden the runtime-test checkout.
  • .github/workflows/performance-regression.yml#L61-L62: Harden the benchmark checkout.
  • .github/workflows/postman-api-tests.yml#L65-L66: Harden the Newman checkout.
  • .github/workflows/pr-validation.yml#L58-L59: Harden the dead-code checkout.
  • .github/workflows/pr-validation.yml#L101-L102: Harden the link-check checkout.
  • .github/workflows/pr-validation.yml#L135-L136: Harden the dependency-validation checkout.
  • .github/workflows/release-sign.yml#L25-L26: Harden the release-signing checkout.

Based on learnings: modified checkout steps in touched workflows must explicitly disable credential persistence; as per path instructions, this is required workflow security hardening, and zizmor reports the same warning.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 62-63: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 7 files
  • .github/workflows/ci.yml#L62-L63 (this comment)
  • .github/workflows/dependency-review.yml#L35-L36
  • .github/workflows/fips-compatibility.yml#L63-L64
  • .github/workflows/fips-compatibility.yml#L200-L201
  • .github/workflows/performance-regression.yml#L61-L62
  • .github/workflows/postman-api-tests.yml#L65-L66
  • .github/workflows/pr-validation.yml#L58-L59
  • .github/workflows/pr-validation.yml#L101-L102
  • .github/workflows/pr-validation.yml#L135-L136
  • .github/workflows/release-sign.yml#L25-L26
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 62 - 63, Disable credential
persistence on every listed checkout step by adding persist-credentials: false:
.github/workflows/ci.yml lines 62-63; .github/workflows/dependency-review.yml
lines 35-36; .github/workflows/fips-compatibility.yml lines 63-64 and 200-201;
.github/workflows/performance-regression.yml lines 61-62;
.github/workflows/postman-api-tests.yml lines 65-66;
.github/workflows/pr-validation.yml lines 58-59, 101-102, and 135-136; and
.github/workflows/release-sign.yml lines 25-26.

Sources: Path instructions, Learnings, Linters/SAST tools

- name: Setup Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: "22"
cache: "npm"
Expand Down Expand Up @@ -92,7 +92,7 @@ jobs:
if: always()
steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
# egress-policy: block -- enabled 2026-05-23 (compliance audit). If a CI run fails on a network call, switch this single occurrence back to audit and capture the missing endpoint in the issue tracker.
egress-policy: audit # TODO: switch to block after 2026-06-30 (compliance audit deferral)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/codecov.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
name: Upload Coverage
# Only run on successful CI completion
if: ${{ github.event.workflow_run.conclusion == 'success' }}
uses: ByronWilliamsCPA/.github/.github/workflows/python-codecov.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-codecov.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
artifact-name: 'coverage-reports'
coverage-files: '*.xml'
Expand All @@ -40,7 +40,7 @@ jobs:
if: ${{ github.event.workflow_run.conclusion == 'failure' }}
steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,36 +34,36 @@ jobs:

steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.12"

- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

- name: Install dependencies
run: uv sync --no-dev

- name: Initialize CodeQL
uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
with:
languages: python
build-mode: none
queries: security-extended,security-and-quality

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
with:
category: "/language:python"
2 changes: 1 addition & 1 deletion .github/workflows/container-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ permissions:
jobs:
container-security:
name: Container Security Scan
uses: ByronWilliamsCPA/.github/.github/workflows/python-container-security.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-container-security.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
dockerfile-path: 'Dockerfile'
build-context: '.'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
upload-coverage:
name: Upload Coverage to Qlty
if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
coverage-artifact-name: coverage-reports
coverage-file-path: coverage.xml
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,12 +28,12 @@ jobs:
timeout-minutes: 15
steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Dependency Review
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ permissions:
jobs:
docs:
name: Build & Deploy Docs
uses: ByronWilliamsCPA/.github/.github/workflows/python-docs.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-docs.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
python-version: '3.12'
# rag-processor uses hatchling as build backend, so editable installs
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/fips-compatibility.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,15 +56,15 @@ jobs:

steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

Expand Down Expand Up @@ -193,15 +193,15 @@ jobs:

steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/mutation-testing.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ permissions:
jobs:
mutation:
name: Mutation Testing
uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
python-version: '3.12'
source-directory: 'src'
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/performance-regression.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,12 +54,12 @@ jobs:
has-benchmarks: ${{ steps.check.outputs.has-benchmarks }}
steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Check for benchmark script
id: check
Expand All @@ -82,7 +82,7 @@ jobs:
name: Performance Regression
needs: check-benchmarks
if: needs.check-benchmarks.outputs.has-benchmarks == 'true'
uses: ByronWilliamsCPA/.github/.github/workflows/python-performance-regression.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-performance-regression.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
benchmark-script: 'scripts/benchmark.py'
python-version: '3.12'
Expand All @@ -106,7 +106,7 @@ jobs:
if: needs.check-benchmarks.outputs.has-benchmarks == 'false'
steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/postman-api-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ jobs:
timeout-minutes: 15
services:
redis:
image: redis:8-alpine@sha256:09160599abd229764c0fb44cb6be640294e1d360a54b19985ab4843dcf2d90f1
image: redis:8-alpine@sha256:978f0e01593e65eed801f2402944efcd936d43b5027e4908a7897baf88ed6241
ports:
- 6379:6379
options: >-
Expand All @@ -58,28 +58,28 @@ jobs:
APP_PORT: "8000"
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.12"

- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

- name: Install Python dependencies
run: uv sync --extra api --extra dev

- name: Set up Node.js (for Newman)
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version: "22"

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pr-title.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
timeout-minutes: 5
steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

Expand Down
26 changes: 13 additions & 13 deletions .github/workflows/pr-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
contents: read
pull-requests: write
checks: write
uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-ci.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
python-version: '3.12'
coverage-threshold: 80
Expand All @@ -50,21 +50,21 @@ jobs:
timeout-minutes: 15
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
# egress-policy: block -- enabled 2026-05-23 (compliance audit). If a CI run fails on a network call, switch this single occurrence back to audit and capture the missing endpoint in the issue tracker.
egress-policy: audit # TODO: switch to block after 2026-06-30 (compliance audit deferral)

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.12"

- name: Install UV
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
cache-dependency-glob: "uv.lock"
Expand Down Expand Up @@ -93,16 +93,16 @@ jobs:
timeout-minutes: 15
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
# egress-policy: block -- enabled 2026-05-23 (compliance audit). If a CI run fails on a network call, switch this single occurrence back to audit and capture the missing endpoint in the issue tracker.
egress-policy: audit # TODO: switch to block after 2026-06-30 (compliance audit deferral)

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Check documentation links
uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
with:
args: >-
--verbose
Expand All @@ -127,21 +127,21 @@ jobs:
timeout-minutes: 15
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
# egress-policy: block -- enabled 2026-05-23 (compliance audit). If a CI run fails on a network call, switch this single occurrence back to audit and capture the missing endpoint in the issue tracker.
egress-policy: audit # TODO: switch to block after 2026-06-30 (compliance audit deferral)

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.12"

- name: Install UV
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true
cache-dependency-glob: "uv.lock"
Expand Down Expand Up @@ -196,7 +196,7 @@ jobs:
if: always()
steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/publish-pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ on:
jobs:
publish:
name: Publish Package
uses: ByronWilliamsCPA/.github/.github/workflows/python-publish-pypi.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-publish-pypi.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
python-version: '3.12'
package-name: 'rag-processor'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/python-compatibility.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ permissions:
jobs:
compatibility:
name: Python Compatibility Matrix
uses: ByronWilliamsCPA/.github/.github/workflows/python-compatibility.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-compatibility.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
# Match pyproject.toml `requires-python = ">=3.11,<3.15"`. Testing 3.10
# would fail on Python-3.11+ features the project actively uses (e.g.
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/qlty.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:
# Coverage upload: runs after CI workflow completes successfully.
qlty:
if: github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success'
uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@74c633acfdd5f707ab154fd59bd212c6df663dd6 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
permissions:
contents: read
actions: read
Expand Down
Loading
Loading