From bc1278d25e73778f863ae3bd57d6f36692d31dfb Mon Sep 17 00:00:00 2001 From: Alexandre FLAMENT Date: Fri, 4 Nov 2022 08:37:31 +0000 Subject: [PATCH 1/4] GH workflow: use actions/setup-python@v4 GitHub displays this warning with the actions/setup-python@2 : Warning: The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/ --- .github/workflows/integration.yml | 10 +++++----- .github/workflows/translations-update.yml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index f43f467e..4d4b1c3d 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -22,7 +22,7 @@ jobs: sudo ./utils/searxng.sh install packages sudo apt install firefox - name: Set up Python - uses: actions/setup-python@v2 + uses: actions/setup-python@v4 with: python-version: ${{ matrix.python-version }} architecture: 'x64' @@ -57,7 +57,7 @@ jobs: - name: Install Ubuntu packages run: sudo ./utils/searxng.sh install buildhost - name: Set up Python - uses: actions/setup-python@v2 + uses: actions/setup-python@v4 with: python-version: '3.9' architecture: 'x64' @@ -84,7 +84,7 @@ jobs: - name: Install Ubuntu packages run: sudo ./utils/searxng.sh install buildhost - name: Set up Python - uses: actions/setup-python@v2 + uses: actions/setup-python@v4 with: python-version: '3.9' architecture: 'x64' @@ -123,7 +123,7 @@ jobs: fetch-depth: '0' token: ${{ secrets.WEBLATE_GITHUB_TOKEN }} - name: Set up Python - uses: actions/setup-python@v2 + uses: actions/setup-python@v4 with: python-version: '3.9' architecture: 'x64' @@ -165,7 +165,7 @@ jobs: # make sure "make docker.push" can get the git history fetch-depth: '0' - name: Set up Python - uses: actions/setup-python@v2 + uses: actions/setup-python@v4 with: python-version: '3.9' architecture: 'x64' diff --git a/.github/workflows/translations-update.yml b/.github/workflows/translations-update.yml index c3120ce1..60a06791 100644 --- a/.github/workflows/translations-update.yml +++ b/.github/workflows/translations-update.yml @@ -16,7 +16,7 @@ jobs: fetch-depth: '0' token: ${{ secrets.WEBLATE_GITHUB_TOKEN }} - name: Set up Python - uses: actions/setup-python@v2 + uses: actions/setup-python@v4 with: python-version: '3.9' architecture: 'x64' From 46aaa57cfe97cac6330dad6df6e483981d734a0a Mon Sep 17 00:00:00 2001 From: Alexandre FLAMENT Date: Fri, 4 Nov 2022 14:22:30 +0000 Subject: [PATCH 2/4] GH workflow: use actions/cache@v3 Also cache ./.nvm and ./node_modules --- .github/workflows/integration.yml | 43 +++++++++++++++-------- .github/workflows/translations-update.yml | 9 +++-- 2 files changed, 35 insertions(+), 17 deletions(-) diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index 4d4b1c3d..474d69ff 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -28,9 +28,12 @@ jobs: architecture: 'x64' - name: Cache Python dependencies id: cache-python - uses: actions/cache@v2 + uses: actions/cache@v3 with: - path: ./local + path: | + ./local + ./.nvm + ./node_modules key: python-${{ matrix.os }}-${{ matrix.python-version }}-${{ hashFiles('requirements*.txt', 'setup.py') }} - name: Install Python dependencies if: steps.cache-python.outputs.cache-hit != 'true' @@ -63,10 +66,13 @@ jobs: architecture: 'x64' - name: Cache Python dependencies id: cache-python - uses: actions/cache@v2 + uses: actions/cache@v3 with: - path: ./local - key: python-ubuntu-20.04-3.9-${{ hashFiles('requirements*.txt', 'setup.py') }} + path: | + ./local + ./.nvm + ./node_modules + key: python-ubuntu-20.04-3.9-${{ hashFiles('requirements*.txt', 'setup.py','.nvmrc', 'package.json') }} - name: Install node dependencies run: make V=1 node.env - name: Build themes @@ -90,10 +96,13 @@ jobs: architecture: 'x64' - name: Cache Python dependencies id: cache-python - uses: actions/cache@v2 + uses: actions/cache@v3 with: - path: ./local - key: python-ubuntu-20.04-3.9-${{ hashFiles('requirements*.txt', 'setup.py') }} + path: | + ./local + ./.nvm + ./node_modules + key: python-ubuntu-20.04-3.9-${{ hashFiles('requirements*.txt', 'setup.py','.nvmrc', 'package.json') }} - name: Build documentation run: | make V=1 docs.clean docs.html @@ -129,10 +138,13 @@ jobs: architecture: 'x64' - name: Cache Python dependencies id: cache-python - uses: actions/cache@v2 + uses: actions/cache@v3 with: - path: ./local - key: python-ubuntu-20.04-3.9-${{ hashFiles('requirements*.txt', 'setup.py') }} + path: | + ./local + ./.nvm + ./node_modules + key: python-ubuntu-20.04-3.9-${{ hashFiles('requirements*.txt', 'setup.py','.nvmrc', 'package.json') }} - name: weblate & git setup env: WEBLATE_CONFIG: ${{ secrets.WEBLATE_CONFIG }} @@ -171,10 +183,13 @@ jobs: architecture: 'x64' - name: Cache Python dependencies id: cache-python - uses: actions/cache@v2 + uses: actions/cache@v3 with: - path: ./local - key: python-ubuntu-20.04-3.9-${{ hashFiles('requirements*.txt', 'setup.py') }} + path: | + ./local + ./.nvm + ./node_modules + key: python-ubuntu-20.04-3.9-${{ hashFiles('requirements*.txt', 'setup.py','.nvmrc', 'package.json') }} - name: Set up QEMU if: env.DOCKERHUB_USERNAME != null uses: docker/setup-qemu-action@v1 diff --git a/.github/workflows/translations-update.yml b/.github/workflows/translations-update.yml index 60a06791..bf1e1181 100644 --- a/.github/workflows/translations-update.yml +++ b/.github/workflows/translations-update.yml @@ -22,10 +22,13 @@ jobs: architecture: 'x64' - name: Cache Python dependencies id: cache-python - uses: actions/cache@v2 + uses: actions/cache@v3 with: - path: ./local - key: python-ubuntu-20.04-3.9-${{ hashFiles('requirements*.txt', 'setup.py') }} + path: | + ./local + ./.nvm + ./node_modules + key: python-ubuntu-20.04-3.9-${{ hashFiles('requirements*.txt', 'setup.py','.nvmrc', 'package.json') }} - name: weblate & git setup env: WEBLATE_CONFIG: ${{ secrets.WEBLATE_CONFIG }} From 7101c5ecf2bcdc17b9050512c83c57cf721a451d Mon Sep 17 00:00:00 2001 From: Alexandre FLAMENT Date: Fri, 4 Nov 2022 14:28:46 +0000 Subject: [PATCH 3/4] GH workflow: add Python 3.11 --- .github/workflows/integration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index 474d69ff..1b3085a5 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -13,7 +13,7 @@ jobs: strategy: matrix: os: [ubuntu-20.04] - python-version: ["3.7", "3.8", "3.9", "3.10"] + python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"] steps: - name: Checkout uses: actions/checkout@v2 From b5ce39b5368f755329c3b0c4daa4245247deaa73 Mon Sep 17 00:00:00 2001 From: nathannaveen <42319948+nathannaveen@users.noreply.github.com> Date: Tue, 24 May 2022 14:07:23 -0500 Subject: [PATCH 4/4] chore: Set permissions for GitHub actions (#3225) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much. - Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) Signed-off-by: nathannaveen <42319948+nathannaveen@users.noreply.github.com> --- .github/workflows/integration.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index 1b3085a5..b66b5f86 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -6,6 +6,9 @@ on: pull_request: branches: ["master"] +permissions: + contents: read + jobs: python: name: Python ${{ matrix.python-version }} @@ -81,6 +84,8 @@ jobs: documentation: name: Documentation runs-on: ubuntu-20.04 + permissions: + contents: write # for JamesIves/github-pages-deploy-action to push changes in repo steps: - name: Checkout uses: actions/checkout@v2 @@ -125,6 +130,8 @@ jobs: - python - themes - documentation + permissions: + contents: write # for make V=1 weblate.push.translations steps: - name: Checkout uses: actions/checkout@v2