From c2d83ed4bf6451fffbbd75315bf46c354c8e494a Mon Sep 17 00:00:00 2001 From: aliziel <21992503+aliziel@users.noreply.github.com> Date: Fri, 26 Jun 2026 15:28:43 -0700 Subject: [PATCH 1/4] ci: add dependabot version update config --- .github/dependabot.yml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..209fdf7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,29 @@ +version: 2 +updates: + + - package-ecosystem: "pip" + directory: "/" + cooldown: + default-days: 7 + semver-major-days: 30 + schedule: + interval: weekly + groups: + all: + patterns: + - "*" + commit-message: + prefix: "chore(deps):" + + - package-ecosystem: "github-actions" + directory: "/" + cooldown: + default-days: 7 + schedule: + interval: "weekly" + groups: + all: + patterns: + - "*" + commit-message: + prefix: "ci(deps):" From 51fa3600fdea5fcae750fe20ade4e6a7e89f8772 Mon Sep 17 00:00:00 2001 From: aliziel <21992503+aliziel@users.noreply.github.com> Date: Fri, 26 Jun 2026 15:30:04 -0700 Subject: [PATCH 2/4] ci: add OSSF scorecard workflow --- .github/workflows/scorecard.yml | 43 +++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..5c57a0d --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,43 @@ +name: OSSF Scorecard + +on: + push: + branches: + - main + schedule: + - cron: "30 16 * * 1" # Monday 10:30/11:30 CT + +permissions: read-all # Default all to readonly + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + security-events: write # Allow upload to Security dashboard + id-token: write # Access GitHub's OIDC token to verify authenticity of result for publish + + steps: + - name: Checkout code + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run analysis + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: Upload artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + - name: Upload to code-scanning + uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 + with: + sarif_file: results.sarif From a80c534b37b73a191809ee64a07701fa6a66c60d Mon Sep 17 00:00:00 2001 From: aliziel <21992503+aliziel@users.noreply.github.com> Date: Fri, 26 Jun 2026 15:34:51 -0700 Subject: [PATCH 3/4] ci: set write permissions on specific job v. top-level --- .github/workflows/pr.yml | 5 ++++- .github/workflows/promote.yml | 2 ++ .github/workflows/promotion-checker.yml | 3 ++- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 514464c..2c13445 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -22,7 +22,6 @@ on: - main permissions: - pull-requests: write contents: read jobs: @@ -34,6 +33,8 @@ jobs: published_collections: ${{ steps.publish-collections.outputs.success_collections }} comment_id: ${{ steps.init-comment.outputs.COMMENT_ID }} has_new_files_to_promote: ${{ steps.changed-files.outputs.all_changed_files_count != 0 }} + permissions: + pull-requests: write steps: - name: Checkout code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 @@ -282,6 +283,8 @@ jobs: runs-on: ubuntu-latest environment: staging needs: ['mdx-pr-flag-evaluator', 'publish-new-datasets'] + permissions: + pull-requests: write steps: - name: Checkout code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml index 559af58..d56dcaf 100644 --- a/.github/workflows/promote.yml +++ b/.github/workflows/promote.yml @@ -42,6 +42,8 @@ jobs: needs: validate-trigger-token-and-pr-number runs-on: ubuntu-latest environment: production + permissions: + id-token: write steps: - name: Checkout code uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 diff --git a/.github/workflows/promotion-checker.yml b/.github/workflows/promotion-checker.yml index c61ec12..a4025b2 100644 --- a/.github/workflows/promotion-checker.yml +++ b/.github/workflows/promotion-checker.yml @@ -9,7 +9,6 @@ on: - ingestion-data/staging/collections/*.json permissions: - actions: write contents: read jobs: @@ -62,6 +61,8 @@ jobs: trigger-promotion-workflow: runs-on: ubuntu-latest needs: check-conditions + permissions: + actions: write steps: - name: Checkout Repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 From a5fc243bd02972c33df879017a22949a760d4b14 Mon Sep 17 00:00:00 2001 From: Jamison French Date: Thu, 13 Aug 2026 13:28:26 -0500 Subject: [PATCH 4/4] chore: update after rebase --- .github/dependabot.yml | 27 ++++++++++++++++++++------- .github/workflows/pr.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 3 files changed, 23 insertions(+), 10 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 209fdf7..e1defd4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,29 +1,42 @@ version: 2 updates: - - package-ecosystem: "pip" - directory: "/" + - package-ecosystem: uv + directory: / cooldown: default-days: 7 semver-major-days: 30 schedule: interval: weekly groups: - all: + python-dependencies: patterns: - "*" commit-message: prefix: "chore(deps):" - - package-ecosystem: "github-actions" - directory: "/" + - package-ecosystem: github-actions + directory: / cooldown: default-days: 7 schedule: - interval: "weekly" + interval: weekly groups: - all: + github-actions: patterns: - "*" commit-message: prefix: "ci(deps):" + + - package-ecosystem: pre-commit + directory: / + cooldown: + default-days: 7 + schedule: + interval: weekly + groups: + pre-commit: + patterns: + - "*" + commit-message: + prefix: "chore(deps):" diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 2c13445..c9ffbee 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -229,7 +229,7 @@ jobs: run: ls -lah /tmp/upload-artifacts - name: Upload published collections files as directory artifact - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 env: ARTIFACT_RETENTION_DAYS: ${{ vars.ARTIFACT_RETENTION_DAYS }} with: @@ -243,7 +243,7 @@ jobs: echo "${{ github.run_id }}" > run_id.txt - name: Upload Workflow Run ID - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 env: ARTIFACT_RETENTION_DAYS: ${{ vars.ARTIFACT_RETENTION_DAYS }} with: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 5c57a0d..d42ee8a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false