diff --git a/.github/workflows/bonk.yml b/.github/workflows/bonk.yml index e3952456d2..e3e5acc5c6 100644 --- a/.github/workflows/bonk.yml +++ b/.github/workflows/bonk.yml @@ -29,7 +29,7 @@ jobs: fetch-depth: 1 - name: Run Bonk - uses: ask-bonk/ask-bonk/github@main + uses: ask-bonk/ask-bonk/github@14a1af226388b15b389a0c1b7df9168a940165b6 # v0.5.1 env: CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ vars.CLOUDFLARE_ACCOUNT_ID }}/${{ vars.CLOUDFLARE_GATEWAY_ID }}/compat diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 811b6cb555..047ed287e2 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -64,6 +64,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - run: echo "supported_pythons=$SUPPORTED_PYTHONS" - name: Check playground changes @@ -100,6 +101,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - name: Validate version @@ -161,8 +163,9 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -181,8 +184,9 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} @@ -191,7 +195,7 @@ jobs: # produces an ABI3 wheel (cp310-abi3). Without this, maturin picks up # the container's default Python (3.8), which doesn't support ABI3. - name: Build coglet wheel (ABI3) - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 with: target: x86_64-unknown-linux-gnu args: --release --out dist -m crates/coglet-python/Cargo.toml --interpreter python${{ env.MINIMUM_PYTHON }} @@ -214,8 +218,9 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -223,7 +228,7 @@ jobs: id: version run: echo "version=$(tr -d '[:space:]' < VERSION.txt)" >> "$GITHUB_OUTPUT" - name: Build cog binary - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0 with: version: '~> v2' args: build --clean --snapshot --single-target --id cog --output cog @@ -245,7 +250,9 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -272,7 +279,9 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -285,7 +294,9 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -300,7 +311,9 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -313,7 +326,9 @@ jobs: timeout-minutes: 5 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -328,6 +343,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 + with: + persist-credentials: false # setup-python provides a shared-library Python (libpython3.x.so) needed # by stub_gen at runtime (PyO3 auto-initialize). mise's # python-build-standalone is statically linked and doesn't ship the .so. @@ -335,12 +352,12 @@ jobs: id: setup-python with: python-version: ${{ env.PYTHON_VERSION }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} key: py-${{ steps.setup-python.outputs.python-version }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -364,7 +381,9 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -377,11 +396,13 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 - - uses: Swatinem/rust-cache@v2 + with: + persist-credentials: false + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -396,7 +417,9 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -414,7 +437,9 @@ jobs: continue-on-error: true steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -439,7 +464,7 @@ jobs: path: dist - name: Extract source distribution run: tar xf dist/*.tar.gz --strip-components=1 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -454,7 +479,9 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -475,7 +502,9 @@ jobs: runs-on: ${{ matrix.platform }} steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -504,7 +533,9 @@ jobs: CGO_ENABLED: "1" steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -517,11 +548,13 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 - - uses: Swatinem/rust-cache@v2 + with: + persist-credentials: false + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -545,7 +578,7 @@ jobs: merge-multiple: true - name: Extract source distribution run: tar xf dist/*.tar.gz --strip-components=1 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -566,17 +599,18 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - name: Download coglet wheel uses: actions/download-artifact@v8 with: name: CogletRustWheel path: dist - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -594,6 +628,8 @@ jobs: shards: ${{ steps.shard.outputs.shards }} steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - name: Compute shards id: shard run: | @@ -680,9 +716,10 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - name: Login to Docker Hub - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request' with: registry: index.docker.io @@ -697,7 +734,7 @@ jobs: run: | cp dist/cog ./cog chmod +x ./cog - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} @@ -858,18 +895,19 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target save-if: ${{ github.ref == 'refs/heads/main' }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} - name: Check coglet crates.io publish run: cargo publish --dry-run -p coglet --manifest-path crates/Cargo.toml - - uses: goreleaser/goreleaser-action@v7 + - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0 with: version: '~> v2' args: check diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fd36d43ddb..76b76da934 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -39,6 +39,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v7 + with: + persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index a87b7693bf..f6769f142b 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -4,6 +4,9 @@ on: push: branches: - main +permissions: + contents: write + env: MISE_LOCKED: "1" @@ -13,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-docs-${{ github.job }} diff --git a/.github/workflows/homebrew-tap.yaml b/.github/workflows/homebrew-tap.yaml index a629a82ae9..06dafa2683 100644 --- a/.github/workflows/homebrew-tap.yaml +++ b/.github/workflows/homebrew-tap.yaml @@ -24,6 +24,9 @@ on: description: "Release tag (e.g., v1.0.0)" required: true type: string + secrets: + COG_HOMEBREW_TAP_PRIVATE_KEY: + required: true permissions: contents: read diff --git a/.github/workflows/mirror-cog-base-images.yaml b/.github/workflows/mirror-cog-base-images.yaml index 008537b9cc..8ed57961fd 100644 --- a/.github/workflows/mirror-cog-base-images.yaml +++ b/.github/workflows/mirror-cog-base-images.yaml @@ -23,8 +23,10 @@ jobs: packages: write steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-mirror-${{ github.job }} diff --git a/.github/workflows/new-pr-review.yml b/.github/workflows/new-pr-review.yml index 617f9ce9f5..2afbac4ff8 100644 --- a/.github/workflows/new-pr-review.yml +++ b/.github/workflows/new-pr-review.yml @@ -21,6 +21,7 @@ jobs: - name: Checkout repository uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 30 - name: Load review prompt @@ -35,7 +36,7 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Run Bonk - uses: ask-bonk/ask-bonk/github@main + uses: ask-bonk/ask-bonk/github@14a1af226388b15b389a0c1b7df9168a940165b6 # v0.5.1 env: CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} CF_GATEWAY_BASE_URL: https://gateway.ai.cloudflare.com/v1/${{ vars.CLOUDFLARE_ACCOUNT_ID }}/${{ vars.CLOUDFLARE_GATEWAY_ID }}/compat diff --git a/.github/workflows/release-build.yaml b/.github/workflows/release-build.yaml index b510ea18ef..46333e719b 100644 --- a/.github/workflows/release-build.yaml +++ b/.github/workflows/release-build.yaml @@ -43,6 +43,7 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - name: Verify tag and version @@ -125,9 +126,10 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-rel-${{ github.job }} @@ -275,16 +277,17 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 with: workspaces: crates -> target key: release-${{ matrix.target }} # maturin-action bundles maturin, zig, and Rust inside a manylinux container - name: Build coglet wheel - uses: PyO3/maturin-action@v1 + uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0 with: target: ${{ matrix.target }} manylinux: ${{ matrix.manylinux }} @@ -310,9 +313,10 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false fetch-depth: 0 - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-rel-${{ github.job }} @@ -334,7 +338,7 @@ jobs: # Goreleaser builds CLI binaries and creates draft release - name: Build CLI and create draft release - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0 with: version: '~> v2' args: release --clean diff --git a/.github/workflows/release-publish.yaml b/.github/workflows/release-publish.yaml index dcb0e4f006..c7e1429c57 100644 --- a/.github/workflows/release-publish.yaml +++ b/.github/workflows/release-publish.yaml @@ -96,7 +96,7 @@ jobs: GH_TOKEN: ${{ github.token }} - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 publish-crates-io: name: Publish coglet to crates.io @@ -111,13 +111,14 @@ jobs: steps: - uses: actions/checkout@v7 with: + persist-credentials: false ref: ${{ github.event.release.tag_name }} - - uses: jdx/mise-action@v4 + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-pub-${{ github.job }} - - uses: rust-lang/crates-io-auth-action@v1 + - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5 id: auth - name: Publish to crates.io @@ -143,7 +144,7 @@ jobs: GH_TOKEN: ${{ github.token }} - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 update-homebrew-tap: name: Update Homebrew cask @@ -155,4 +156,5 @@ jobs: uses: ./.github/workflows/homebrew-tap.yaml with: tag: ${{ github.event.release.tag_name }} - secrets: inherit + secrets: + COG_HOMEBREW_TAP_PRIVATE_KEY: ${{ secrets.COG_HOMEBREW_TAP_PRIVATE_KEY }} diff --git a/.github/workflows/rust-advisories.yaml b/.github/workflows/rust-advisories.yaml index 6a464e2826..1e545da6c2 100644 --- a/.github/workflows/rust-advisories.yaml +++ b/.github/workflows/rust-advisories.yaml @@ -19,7 +19,9 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v7 - - uses: jdx/mise-action@v4 + with: + persist-credentials: false + - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache_key_prefix: mise-ci-${{ github.job }} diff --git a/.github/workflows/update-compatibility-matrices.yaml b/.github/workflows/update-compatibility-matrices.yaml index f27d297242..0d1e9f6dde 100644 --- a/.github/workflows/update-compatibility-matrices.yaml +++ b/.github/workflows/update-compatibility-matrices.yaml @@ -25,7 +25,7 @@ jobs: uses: actions/checkout@v7 - name: Install tools - uses: jdx/mise-action@v4 + uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 with: version: 2026.4.27 cache: true @@ -36,7 +36,7 @@ jobs: - name: Open pull request for changes id: cpr - uses: peter-evans/create-pull-request@v8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: branch: chore/update-compatibility-matrices delete-branch: true