Merge pull request #875 from rgommers/ci-improvements

CI: improve security, add zizmor and trusted publishing

Author: rgommers

.github/dependabot.yml

@@ -11,3 +11,5 @@ updates:
           - "*" # Group all Actions updates into a single larger pull request
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 7

.github/workflows/emscripten.yml

@@ -23,6 +23,13 @@ on:
     # Run at 0300 hours on days 3 and 17 of the month
     - cron: "0 3 3,17 * *"
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 env:
   FORCE_COLOR: 3
 
@@ -34,7 +41,9 @@ jobs:
     if: github.repository == 'PyWavelets/pywt'
     steps:
       - name: Check out repository
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Build and test PyWavelets
         uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c # v4.1.1
@@ -47,11 +56,11 @@ jobs:
         # WARNING: this job will overwrite existing wheels.
       - name: Push wheels to Anaconda PyPI index
         if: >-
-          (github.repository == 'PyWavelets/pywt') &&
-          (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+          github.repository == 'PyWavelets/pywt' &&
+          ((github.event_name == 'push' && github.ref == 'refs/heads/main') ||
           (github.event_name == 'workflow_dispatch' && github.event.inputs.push_wheels == 'true') ||
-          (github.event_name == 'schedule')
-        uses: scientific-python/upload-nightly-action@e76cfec8a4611fd02808a801b0ff5a7d7c1b2d99 # v0.6.4
+          github.event_name == 'schedule')
+        uses: scientific-python/upload-nightly-action@e76cfec8a4611fd02808a801b0ff5a7d7c1b2d99 # 0.6.4
         with:
           artifacts_path: wheelhouse/
           anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }}

.github/workflows/lint.yml

@@ -9,6 +9,9 @@ on:
       - main
       - v1.**
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -21,10 +24,12 @@ jobs:
         python-version: ["3.13"]
 
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/tests.yml

@@ -9,9 +9,11 @@ on:
       - main
       - v1.**
 
+permissions:
+  contents: read # to fetch code (actions/checkout)
+
 concurrency:
-  # avoid duplicate runs on both pushes and PRs
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 env:
@@ -70,8 +72,10 @@ jobs:
             python-version: "3.14"
             OPTIONS_NAME: "editable-install"
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version}}
           allow-prereleases: true
@@ -160,8 +164,10 @@ jobs:
       matrix:
         python-version: ["3.14t", "3.15t-dev"]
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version}}
 
@@ -199,8 +205,10 @@ jobs:
             OPTIONS_NAME: "pre-releases"
 
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version}}
           allow-prereleases: true
@@ -281,7 +289,7 @@ jobs:
       # the test run itself is configured in the "Test" step below.
       ASAN_OPTIONS: detect_leaks=0
     steps:
-      - uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: recursive
           fetch-tags: true