diff --git a/.github/workflows/build_client.yml b/.github/workflows/build_client.yml index faf43535..52d10925 100644 --- a/.github/workflows/build_client.yml +++ b/.github/workflows/build_client.yml @@ -11,6 +11,8 @@ on: jobs: build_client: name: Build client + permissions: + contents: read strategy: matrix: include: @@ -35,11 +37,12 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out the repo - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ inputs.checkout-sha == null && github.sha || inputs.checkout-sha }} + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: '3.12' - name: Install PyInstaller and client dependencies @@ -61,14 +64,14 @@ jobs: cd software pyinstaller pyinstaller.spec - name: Upload built client - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: client-${{ matrix.name }} path: software/dist/* - name: Zip up client for release run: ${{ matrix.bundle_command }} - name: Upload release artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: release-artifacts-${{ matrix.name }} path: client-${{ matrix.name }}.zip diff --git a/.github/workflows/build_firmware.yml b/.github/workflows/build_firmware.yml index 60027059..72458a1a 100644 --- a/.github/workflows/build_firmware.yml +++ b/.github/workflows/build_firmware.yml @@ -18,26 +18,27 @@ jobs: image_hash: ${{ steps.push.outputs.digest }} steps: - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v2 + uses: docker/setup-buildx-action@v4 - name: Check out the repo - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ inputs.checkout-sha == null && github.sha || inputs.checkout-sha }} fetch-depth: 0 + persist-credentials: false - name: ghcr.io login - uses: docker/login-action@v2 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract Docker metadata id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@v6 with: images: ghcr.io/${{ github.repository }}-fw-builder - name: Build and push Docker images id: push - uses: docker/build-push-action@v4 + uses: docker/build-push-action@v7 with: context: firmware push: true @@ -49,22 +50,25 @@ jobs: name: Build firmware runs-on: ubuntu-latest needs: build_fw_builder + permissions: + contents: read strategy: matrix: device_type: [ultra, lite] steps: - name: Check out the repo - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: ref: ${{ inputs.checkout-sha == null && github.sha || inputs.checkout-sha }} fetch-depth: 0 + persist-credentials: false - name: Build firmware env: repo: ${{ github.repository }} run: | docker run --rm -v ${PWD}:/workdir -e CURRENT_DEVICE_TYPE=${{ matrix.device_type }} ghcr.io/${repo,,}-fw-builder@${{ needs.build_fw_builder.outputs.image_hash }} firmware/build.sh - name: Upload built binaries - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ matrix.device_type }}-firmware path: firmware/objects/*.hex @@ -76,17 +80,17 @@ jobs: unzip firmware/objects/${{ matrix.device_type }}-dfu-app.zip -d firmware/objects/${{ matrix.device_type }}-dfu-app unzip firmware/objects/${{ matrix.device_type }}-dfu-full.zip -d firmware/objects/${{ matrix.device_type }}-dfu-full - name: Upload dfu app image - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ matrix.device_type }}-dfu-app path: firmware/objects/${{ matrix.device_type }}-dfu-app/* - name: Upload dfu full image - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ${{ matrix.device_type }}-dfu-full path: firmware/objects/${{ matrix.device_type }}-dfu-full/* - name: Upload release artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: release-artifacts-${{ matrix.device_type }} path: firmware/objects/*.zip diff --git a/.github/workflows/changelog_reminder.yml b/.github/workflows/changelog_reminder.yml index b1cc0e0c..ad29027c 100644 --- a/.github/workflows/changelog_reminder.yml +++ b/.github/workflows/changelog_reminder.yml @@ -1,15 +1,48 @@ -on: pull_request_target name: Changelog Reminder + +on: + pull_request_target: + +permissions: + pull-requests: write + jobs: remind: name: Changelog Reminder runs-on: ubuntu-latest steps: - - uses: actions/checkout@master - - name: Changelog Reminder - uses: peterjgrainger/action-changelog-reminder@v1.2.0 - with: - changelog_regex: 'CHANGELOG.md' - customPrMessage: 'You are welcome to add an entry to the CHANGELOG.md as well' - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Changelog Reminder + uses: actions/github-script@v9 + with: + script: | + const message = 'You are welcome to add an entry to the CHANGELOG.md as well'; + const pullNumber = context.payload.pull_request.number; + const files = await github.paginate(github.rest.pulls.listFiles, { + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: pullNumber, + per_page: 100, + }); + + if (files.some((file) => file.filename === 'CHANGELOG.md')) { + return; + } + + const comments = await github.paginate(github.rest.issues.listComments, { + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: pullNumber, + per_page: 100, + }); + const alreadyReminded = comments.some((comment) => + comment.user?.login === 'github-actions[bot]' && comment.body === message + ); + + if (!alreadyReminded) { + await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: pullNumber, + body: message, + }); + } diff --git a/.github/workflows/deploy_wiki_to_pages.yml b/.github/workflows/deploy_wiki_to_pages.yml index 05c829c4..a9b230b7 100644 --- a/.github/workflows/deploy_wiki_to_pages.yml +++ b/.github/workflows/deploy_wiki_to_pages.yml @@ -5,11 +5,7 @@ on: branches: ["main"] workflow_dispatch: -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write +permissions: {} # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. @@ -21,20 +17,23 @@ jobs: # Build job build: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: repository: ${{ github.repository }}.wiki + persist-credentials: false - name: Setup Pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@v6 - name: Build with Jekyll uses: actions/jekyll-build-pages@v1 with: source: ./ destination: ./_site - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@v5 # Deployment job deploy: @@ -43,7 +42,10 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest needs: build + permissions: + pages: write + id-token: write steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@v5 diff --git a/.github/workflows/on_pr.yml b/.github/workflows/on_pr.yml index 2e55cef8..deae6756 100644 --- a/.github/workflows/on_pr.yml +++ b/.github/workflows/on_pr.yml @@ -1,6 +1,6 @@ name: PR handler on: - pull_request_target: + pull_request: jobs: firmware_pipeline: @@ -13,6 +13,8 @@ jobs: checkout-sha: "${{ github.event.pull_request.head.sha }}" client_pipeline: name: Build Firmware + permissions: + contents: read uses: ./.github/workflows/build_client.yml with: checkout-sha: "${{ github.event.pull_request.head.sha }}" @@ -25,7 +27,7 @@ jobs: permissions: pull-requests: write steps: - - uses: marocchino/sticky-pull-request-comment@v2 + - uses: marocchino/sticky-pull-request-comment@v3 with: message: | # Built artifacts for commit ${{ github.event.pull_request.head.sha }} diff --git a/.github/workflows/on_push.yml b/.github/workflows/on_push.yml index e0f1ae0f..07d484b8 100644 --- a/.github/workflows/on_push.yml +++ b/.github/workflows/on_push.yml @@ -12,6 +12,8 @@ jobs: uses: ./.github/workflows/build_firmware.yml client_pipeline: name: Build Firmware + permissions: + contents: read uses: ./.github/workflows/build_client.yml create_dev_release: permissions: @@ -24,15 +26,15 @@ jobs: - client_pipeline steps: - name: Check out the repo - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Download release artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: pattern: release-artifacts-* merge-multiple: true path: release-artifacts - name: Upload to dev release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@v3 with: body: | Auto-Generated DFU packages from latest `main` commit. @@ -49,7 +51,7 @@ jobs: - name: Fix up release tag run: | git tag -f dev - git push --tags -f + git push origin refs/tags/dev --force create_release: permissions: contents: write @@ -61,15 +63,17 @@ jobs: - client_pipeline steps: - name: Check out the repo - uses: actions/checkout@v4 + uses: actions/checkout@v7 + with: + persist-credentials: false - name: Download release artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: pattern: release-artifacts-* merge-multiple: true path: release-artifacts - name: Upload to tagged release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@v3 with: body: | Auto-Generated DFU packages for Release ${{ github.ref_name }} diff --git a/.github/workflows/python-checks.yml b/.github/workflows/python-checks.yml index 4c2bfbfb..9d808162 100644 --- a/.github/workflows/python-checks.yml +++ b/.github/workflows/python-checks.yml @@ -7,6 +7,9 @@ on: - ".github/workflows/**" workflow_dispatch: +permissions: + contents: read + jobs: lint-formatting: runs-on: ubuntu-latest @@ -17,10 +20,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: "3.13" cache: "pip" @@ -61,10 +66,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: "3.13" cache: "pip" @@ -74,7 +81,7 @@ jobs: software/script/requirements.txt - name: Set up uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - name: Install dependencies with uv (if lockfile present) if: ${{ hashFiles('software/uv.lock') != '' }}