Upgrade GitHub Actions - #2106
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/checkout@v7 |
| persist-credentials: false | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| uses: actions/setup-python@v7 |
| run: python3 -m build | ||
| - name: Store the distribution packages | ||
| uses: actions/upload-artifact@v5 | ||
| uses: actions/upload-artifact@v7 |
| steps: | ||
| - name: Download all the dists | ||
| uses: actions/download-artifact@v6 | ||
| uses: actions/download-artifact@v8 |
Head branch was pushed to by a user without write access
There was a problem hiding this comment.
% GH_TOKEN=$(gh auth token) zizmor --fix=all source/guides/github-actions-ci-cd-sample/publish-to-pypi.yml
The review comments were fixed, but should we go full-zizmor or leave the other violations as is?
Unfortunately, zizmor cannot autofix:
uses: pypa/gh-action-pypi-publish@release/v1
but perhaps these docs want to continue to advocate that.
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | ||
| with: | ||
| name: python-package-distributions | ||
| path: dist/ |
There was a problem hiding this comment.
zizmor: warning[excessive-permissions]: overly broad permissions
| - name: Publish distribution 📦 to TestPyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 | ||
| with: | ||
| repository-url: https://test.pypi.org/legacy/ |
There was a problem hiding this comment.
zizmor: warning[excessive-permissions]: overly broad permissions
| name: python-package-distributions | ||
| path: dist/ | ||
| - name: Publish distribution 📦 to PyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
| name: python-package-distributions | ||
| path: dist/ | ||
| - name: Publish distribution 📦 to TestPyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
There was a problem hiding this comment.
This one especially is intentional.
webknjaz
left a comment
webknjaz
left a comment
There was a problem hiding this comment.
Major versions in examples are intentional due to our maintainability needs. I've already mentioned this somewhere. The end-users should be encouraged to pin, of course, but it's unsustainable to have this in the example snippet.
Do not encourage visitors to rely on out-of-date GitHub Actions.
3 participants
Do not encourage visitors to rely on out-of-date GitHub Actions.
📚 Documentation preview 📚: https://python-packaging-user-guide--2106.org.readthedocs.build/en/2106/