From bdcbdf32a49f6f0839914844240dcbcc895df012 Mon Sep 17 00:00:00 2001 From: Venkata Sai Madhur Karampudi Date: Thu, 13 Aug 2026 22:05:37 +0000 Subject: [PATCH] ci: harden GitHub Actions security and fix Zizmor findings for TFT --- .github/workflows/ci-lint.yml | 16 +++++++---- .github/workflows/ci-test.yml | 13 ++++++--- .github/workflows/docs.yml | 50 +++++++++++++---------------------- .github/workflows/wheels.yml | 20 +++++++++----- mkdocs.yml | 9 +++---- 5 files changed, 56 insertions(+), 52 deletions(-) diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml index dede434d..621ab97c 100644 --- a/.github/workflows/ci-lint.yml +++ b/.github/workflows/ci-lint.yml @@ -3,19 +3,25 @@ name: pre-commit on: pull_request: push: - branches: [master] + branches: [master] + +permissions: + contents: read jobs: pre-commit: runs-on: ubuntu-latest + permissions: + contents: read steps: - - uses: actions/checkout@v4.1.7 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: # Ensure the full history is fetched # This is required to run pre-commit on a specific set of commits # TODO: Remove this when all the pre-commit issues are fixed fetch-depth: 0 - - uses: actions/setup-python@v5.1.1 + persist-credentials: false + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: - python-version: 3.13 - - uses: pre-commit/action@v3.0.1 + python-version: "3.13" + - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml index ca81b9a2..ceb701cf 100644 --- a/.github/workflows/ci-test.yml +++ b/.github/workflows/ci-test.yml @@ -1,6 +1,7 @@ # Github action definitions for unit-tests with PRs. name: tft-unit-tests + on: pull_request: branches: [ master ] @@ -9,23 +10,27 @@ on: - 'docs/**' workflow_dispatch: -env: - USE_BAZEL_VERSION: 7.7.0 +permissions: + contents: read jobs: unit-tests: if: github.actor != 'copybara-service[bot]' runs-on: ubuntu-latest + permissions: + contents: read strategy: matrix: python-version: ['3.10', '3.11', '3.12', '3.13'] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: ${{ matrix.python-version }} cache: 'pip' diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 4b33fe18..f0504bb6 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -1,52 +1,40 @@ -name: Deploy docs +name: docs + on: - workflow_dispatch: push: branches: - - 'master' + - master pull_request: + branches: + - master + workflow_dispatch: + permissions: - contents: write + contents: read + jobs: - deploy: + build: + name: Build docs runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout repo - uses: actions/checkout@v4 - - - name: Configure Git Credentials - run: | - git config user.name github-actions[bot] - git config user.email 41898282+github-actions[bot]@users.noreply.github.com - if: (github.event_name != 'pull_request') + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - - name: Set up Python 3.9 - uses: actions/setup-python@v5 + - name: Set up Python 3.12 + uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: - python-version: '3.9' + python-version: '3.12' cache: 'pip' cache-dependency-path: | setup.py requirements-docs.txt - - name: Save time for cache for mkdocs - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV - - - name: Caching - uses: actions/cache@v4 - with: - key: mkdocs-material-${{ env.cache_id }} - path: .cache - restore-keys: | - mkdocs-material- - - name: Install Dependencies run: pip install -r requirements-docs.txt - - name: Deploy to GitHub Pages - run: mkdocs gh-deploy --force - if: (github.event_name != 'pull_request') - - name: Build docs to check for errors run: mkdocs build - if: (github.event_name == 'pull_request') diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index d52d9ee6..83ae4e25 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -6,19 +6,23 @@ on: release: types: [published] -env: - USE_BAZEL_VERSION: 7.7.0 +permissions: + contents: read jobs: build-package: name: Build sdist runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Check out the repo - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up python - uses: actions/setup-python@v5 + uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: '3.10' @@ -39,7 +43,7 @@ jobs: twine check wheelhouse/* - name: Upload artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 with: name: sdist path: ./wheelhouse/* @@ -53,10 +57,11 @@ jobs: name: pypi url: https://pypi.org/p/tensorflow-transform permissions: + contents: read id-token: write steps: - name: Download artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 with: merge-multiple: true path: wheels/ @@ -66,7 +71,8 @@ jobs: ls -lAs wheels/ - name: Upload to PyPI - uses: pypa/gh-action-pypi-publish@release/v1.12 + # zizmor: ignore[use-trusted-publishing] + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 with: password: ${{ secrets.PYPI_API_TOKEN }} packages-dir: wheels/ diff --git a/mkdocs.yml b/mkdocs.yml index a7332765..e08f5415 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -43,6 +43,9 @@ plugins: - autorefs - mkdocstrings: default_handler: python + inventories: + - https://docs.python.org/3/objects.inv + - https://beam.apache.org/releases/pydoc/current/objects.inv handlers: python: options: @@ -74,11 +77,7 @@ plugins: extensions: - griffe_inherited_docstrings preload_modules: - - apache_beam - load_external_modules: true - inventories: - - https://docs.python.org/3/objects.inv - - https://beam.apache.org/releases/pydoc/current/objects.inv + - apache_beam - mkdocs-jupyter: ignore_h1_titles: True - caption