From 974c06edca0ce1f5d1e3e687c3aad5347a4c5ef3 Mon Sep 17 00:00:00 2001 From: Gil Forsyth Date: Wed, 14 May 2025 14:09:36 -0400 Subject: [PATCH 1/4] feat: add zizmor static checks and fix warnings fix up build-in-devcontainer chore: add more ignores to various expected unpinned images fix(project-set): stop inheriting blanket secrets fix(wheels): address zizmor concerns in wheel files feat: add zizmor pre-commit hook fix: commit zizmor config file --- .github/workflows/breaking-change-alert.yaml | 2 +- .github/workflows/build-in-devcontainer.yaml | 16 ++++++++++------ .github/workflows/checks.yaml | 7 +++++-- .github/workflows/conda-cpp-build.yaml | 9 ++++++--- .../workflows/conda-cpp-post-build-checks.yaml | 6 ++++-- .github/workflows/conda-cpp-tests.yaml | 7 ++++--- .github/workflows/conda-python-build.yaml | 9 ++++++--- .github/workflows/conda-python-tests.yaml | 7 ++++--- .github/workflows/conda-upload-packages.yaml | 5 +++-- .github/workflows/custom-job.yaml | 11 +++++++---- .../project-get-set-iteration-field.yaml | 3 ++- .../project-get-set-single-select-field.yaml | 3 ++- .../project-set-text-date-numeric-field.yaml | 3 ++- .github/workflows/wheels-build.yaml | 15 +++++++++------ .github/workflows/wheels-publish.yaml | 8 +++++--- .github/workflows/wheels-test.yaml | 8 ++++---- .github/zizmor.yml | 7 +++++++ .pre-commit-config.yaml | 6 ++++++ 18 files changed, 87 insertions(+), 45 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/breaking-change-alert.yaml b/.github/workflows/breaking-change-alert.yaml index 6c81c933..6e1702dc 100644 --- a/.github/workflows/breaking-change-alert.yaml +++ b/.github/workflows/breaking-change-alert.yaml @@ -124,7 +124,7 @@ jobs: fi - name: Send Slack notification - uses: slackapi/slack-github-action@v2.0.0 + uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d with: payload: | { diff --git a/.github/workflows/build-in-devcontainer.yaml b/.github/workflows/build-in-devcontainer.yaml index ce10680e..a2cbd805 100644 --- a/.github/workflows/build-in-devcontainer.yaml +++ b/.github/workflows/build-in-devcontainer.yaml @@ -73,6 +73,7 @@ jobs: repository: ${{ inputs.repo }} ref: ${{ inputs.sha }} fetch-depth: 0 + persist-credentials: true # This provides an initial set of metadata tags. Jobs are free to add to the RAPIDS_JOB_ATTRIBUTES # environment variable as they see fit - but remember to export the variable to ${GITHUB_ENV} @@ -84,15 +85,18 @@ jobs: extra_attributes: "rapids.PACKAGER=${{ matrix.PACKAGER }},rapids.CUDA_VER=${{ matrix.CUDA_VER }},rapids.ARCH=${{ matrix.ARCH }}" - name: Check if repo has devcontainer + env: + CUDA_VER: ${{ matrix.CUDA_VER }} + PACKAGER: ${{ matrix.PACKAGER }} run: | echo "REPOSITORY=$(basename "$(pwd)")" | tee -a "${GITHUB_ENV}" - if test -f .devcontainer/cuda${{ matrix.CUDA_VER }}-${{ matrix.PACKAGER }}/devcontainer.json; then + if test -f ".devcontainer/cuda${CUDA_VER}-${PACKAGER}/devcontainer.json"; then echo "HAS_DEVCONTAINER=true" >> "${GITHUB_ENV}" else echo "HAS_DEVCONTAINER=false" >> "${GITHUB_ENV}" fi - if: ${{ env.HAS_DEVCONTAINER == 'true' }} - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -109,7 +113,7 @@ jobs: - if: ${{ env.HAS_DEVCONTAINER == 'true' }} name: Run build in devcontainer - uses: devcontainers/ci@v0.3 + uses: devcontainers/ci@8bf61b26e9c3a98f69cb6ce2f88d24ff59b785c6 with: push: never configFile: .devcontainer/cuda${{ matrix.CUDA_VER }}-${{ matrix.PACKAGER }}/devcontainer.json @@ -121,7 +125,7 @@ jobs: AWS_ACCESS_KEY_ID=${{ env.AWS_ACCESS_KEY_ID }} AWS_SESSION_TOKEN=${{ env.AWS_SESSION_TOKEN }} AWS_SECRET_ACCESS_KEY=${{ env.AWS_SECRET_ACCESS_KEY }} - RAPIDS_AUX_SECRET_1=${{ inputs.rapids-aux-secret-1 != '' && secrets[inputs.rapids-aux-secret-1] || '' }} + RAPIDS_AUX_SECRET_1=${{ inputs.rapids-aux-secret-1 != '' && secrets[inputs.rapids-aux-secret-1] || '' }} # zizmor: ignore[overprovisioned-secrets] TRACEPARENT=${{ env.TRACEPARENT }} OTEL_SERVICE_NAME=${{ env.OTEL_SERVICE_NAME }} OTEL_EXPORTER_OTLP_ENDPOINT=${{ env.OTEL_EXPORTER_OTLP_ENDPOINT }} @@ -142,10 +146,10 @@ jobs: || test -n '${{ inputs.extra-repo-deploy-key-2 }}'; then if ! pgrep ssh-agent >/dev/null 2>&1; then eval "$(ssh-agent -s)"; fi; if test -n '${{ inputs.extra-repo-deploy-key }}'; then - ssh-add - <<< '${{ secrets[inputs.extra-repo-deploy-key] }}'; + ssh-add - <<< '${{ secrets[inputs.extra-repo-deploy-key] }}'; # zizmor: ignore[overprovisioned-secrets] fi if test -n '${{ inputs.extra-repo-deploy-key-2 }}'; then - ssh-add - <<< '${{ secrets[inputs.extra-repo-deploy-key-2] }}'; + ssh-add - <<< '${{ secrets[inputs.extra-repo-deploy-key-2] }}'; # zizmor: ignore[overprovisioned-secrets] fi devcontainer-utils-init-ssh-deploy-keys || true; fi diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml index 39301479..0f49a897 100644 --- a/.github/workflows/checks.yaml +++ b/.github/workflows/checks.yaml @@ -40,12 +40,14 @@ jobs: other-checks: runs-on: ubuntu-latest container: - image: rapidsai/ci-conda:latest + image: rapidsai/ci-conda:latest # zizmor: ignore[unpinned-images] env: RAPIDS_GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - name: Checkout code uses: actions/checkout@v4 + with: + persist-credentials: true - name: Telemetry setup uses: rapidsai/shared-actions/telemetry-dispatch-setup@main continue-on-error: true @@ -72,12 +74,13 @@ jobs: if: ${{ inputs.enable_check_style }} runs-on: ubuntu-latest container: - image: rapidsai/ci-conda:latest + image: rapidsai/ci-conda:latest # zizmor: ignore[unpinned-images] steps: - name: Checkout code uses: actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: true - name: Telemetry setup uses: rapidsai/shared-actions/telemetry-dispatch-setup@main continue-on-error: true diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 778a015c..13a12503 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -94,7 +94,7 @@ jobs: env: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -104,6 +104,7 @@ jobs: repository: ${{ inputs.repo }} ref: ${{ inputs.sha }} fetch-depth: 0 + persist-credentials: true - name: Standardize repository information env: RAPIDS_REPOSITORY: ${{ inputs.repo || github.repository }} @@ -131,7 +132,7 @@ jobs: extra_attributes: "rapids.PACKAGER=conda,rapids.CUDA_VER=${{ matrix.CUDA_VER }},rapids.PY_VER=${{ matrix.PY_VER }},rapids.ARCH=${{ matrix.ARCH }},rapids.LINUX_VER=${{ matrix.LINUX_VER }}" - name: C++ build - run: ${{ inputs.script }} + run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: STEP_NAME: "C++ build" GH_TOKEN: ${{ github.token }} @@ -143,9 +144,11 @@ jobs: id: package-name - name: Show files to be uploaded if: ${{ inputs.upload-artifacts }} + env: + CONDA_OUTPUT_DIR: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} run: | echo "Contents of directory to be uploaded:" - ls -R ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} + ls -R "${CONDA_OUTPUT_DIR}" - uses: actions/upload-artifact@v4 if: ${{ inputs.upload-artifacts }} with: diff --git a/.github/workflows/conda-cpp-post-build-checks.yaml b/.github/workflows/conda-cpp-post-build-checks.yaml index 3d44a77a..d62cbe7d 100644 --- a/.github/workflows/conda-cpp-post-build-checks.yaml +++ b/.github/workflows/conda-cpp-post-build-checks.yaml @@ -44,11 +44,11 @@ jobs: if: ${{ inputs.enable_check_symbols }} runs-on: linux-amd64-cpu4 container: - image: rapidsai/ci-wheel:latest + image: rapidsai/ci-wheel:latest # zizmor: ignore[unpinned-images] env: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -59,6 +59,7 @@ jobs: ref: ${{ inputs.sha }} path: "./src/" fetch-depth: 0 + persist-credentials: true - name: Telemetry setup uses: rapidsai/shared-actions/telemetry-dispatch-setup@main continue-on-error: true @@ -89,6 +90,7 @@ jobs: ref: refs/heads/main path: "./tool/" fetch-depth: 0 + persist-credentials: true - name: Verify CUDA libraries have no public kernel entry points env: SYMBOL_EXCLUSIONS: ${{ inputs.symbol_exclusions }} diff --git a/.github/workflows/conda-cpp-tests.yaml b/.github/workflows/conda-cpp-tests.yaml index 7d483816..d720e5f5 100644 --- a/.github/workflows/conda-cpp-tests.yaml +++ b/.github/workflows/conda-cpp-tests.yaml @@ -135,7 +135,7 @@ jobs: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }} steps: - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -146,6 +146,7 @@ jobs: repository: ${{ inputs.repo }} ref: ${{ inputs.sha }} fetch-depth: 0 + persist-credentials: true # This has to be AFTER the checkout step. It creates a telemetry-artifacts directory, # and the checkout step would destroy it. - name: Telemetry setup @@ -173,11 +174,11 @@ jobs: continue-on-error: true - name: C++ tests - run: ${{ inputs.script }} + run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: GH_TOKEN: ${{ github.token }} - name: Generate test report - uses: test-summary/action@v2.4 + uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 with: paths: "${{ env.RAPIDS_TESTS_DIR }}/*.xml" if: always() diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 96257106..c955a441 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -105,7 +105,7 @@ jobs: env: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -115,6 +115,7 @@ jobs: repository: ${{ inputs.repo }} ref: ${{ inputs.sha }} fetch-depth: 0 + persist-credentials: true - name: Standardize repository information env: RAPIDS_REPOSITORY: ${{ inputs.repo || github.repository }} @@ -136,7 +137,7 @@ jobs: - name: Setup proxy cache uses: nv-gha-runners/setup-proxy-cache@main - name: Python build - run: ${{ inputs.script }} + run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: GH_TOKEN: ${{ github.token }} - name: Get Package Name and Location @@ -147,9 +148,11 @@ jobs: id: package-name - name: Show files to be uploaded if: ${{ inputs.upload-artifacts }} + env: + CONDA_OUTPUT_DIR: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} run: | echo "Contents of directory to be uploaded:" - ls -R ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }} + ls -R "${CONDA_OUTPUT_DIR}" - uses: actions/upload-artifact@v4 if: ${{ inputs.upload-artifacts }} with: diff --git a/.github/workflows/conda-python-tests.yaml b/.github/workflows/conda-python-tests.yaml index 1b5aaa52..f0a1da5b 100644 --- a/.github/workflows/conda-python-tests.yaml +++ b/.github/workflows/conda-python-tests.yaml @@ -139,7 +139,7 @@ jobs: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }} steps: - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -150,6 +150,7 @@ jobs: repository: ${{ inputs.repo }} ref: ${{ inputs.sha }} fetch-depth: 0 + persist-credentials: true - name: Standardize repository information env: @@ -178,11 +179,11 @@ jobs: continue-on-error: true - name: Python tests - run: ${{ inputs.script }} + run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: GH_TOKEN: ${{ github.token }} - name: Generate test report - uses: test-summary/action@v2.4 + uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 with: paths: "${{ env.RAPIDS_TESTS_DIR }}/*.xml" if: always() diff --git a/.github/workflows/conda-upload-packages.yaml b/.github/workflows/conda-upload-packages.yaml index 6b8086b6..01bdaf40 100644 --- a/.github/workflows/conda-upload-packages.yaml +++ b/.github/workflows/conda-upload-packages.yaml @@ -43,7 +43,7 @@ jobs: upload: runs-on: linux-amd64-cpu4 container: - image: rapidsai/ci-conda:latest + image: rapidsai/ci-conda:latest # zizmor: ignore[unpinned-images] env: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: @@ -51,7 +51,7 @@ jobs: uses: rapidsai/shared-actions/telemetry-dispatch-setup@main continue-on-error: true if: ${{ vars.TELEMETRY_ENABLED == 'true' && github.run_attempt == '1' }} - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -61,6 +61,7 @@ jobs: repository: ${{ inputs.repo }} ref: ${{ inputs.sha }} fetch-depth: 0 + persist-credentials: true - name: Standardize repository information env: diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 0cfc51ba..31ebac32 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -59,12 +59,12 @@ jobs: runs-on: "linux-${{ inputs.arch }}-${{ inputs.node_type }}" continue-on-error: ${{ inputs.continue-on-error }} container: - image: ${{ inputs.container_image }} + image: ${{ inputs.container_image }} # zizmor: ignore[unpinned-images] env: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }} steps: - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -74,6 +74,7 @@ jobs: repository: ${{ inputs.repo }} ref: ${{ inputs.sha }} fetch-depth: 0 + persist-credentials: true - name: Telemetry setup uses: rapidsai/shared-actions/telemetry-dispatch-setup@main continue-on-error: true @@ -84,8 +85,10 @@ jobs: uses: nv-gha-runners/get-pr-info@main - name: Add PR Info if: startsWith(github.ref_name, 'pull-request/') + env: + RAPIDS_BASE_BRANCH: ${{ fromJSON(steps.get-pr-info.outputs.pr-info).base.ref }} run: | - echo "RAPIDS_BASE_BRANCH=${{ fromJSON(steps.get-pr-info.outputs.pr-info).base.ref }}" >> "${GITHUB_ENV}" + echo "${RAPIDS_BASE_BRANCH}" >> "${GITHUB_ENV}" - name: Standardize repository information env: RAPIDS_REPOSITORY: ${{ inputs.repo || github.repository }} @@ -99,7 +102,7 @@ jobs: echo "RAPIDS_NIGHTLY_DATE=${RAPIDS_NIGHTLY_DATE}" } >> "${GITHUB_ENV}" - name: Run script - run: ${{ inputs.run_script }} + run: ${{ inputs.run_script }} # zizmor: ignore[template-injection] env: GH_TOKEN: ${{ github.token }} - name: Upload file to GitHub Artifact diff --git a/.github/workflows/project-get-set-iteration-field.yaml b/.github/workflows/project-get-set-iteration-field.yaml index 4f0ece7f..7c854c43 100644 --- a/.github/workflows/project-get-set-iteration-field.yaml +++ b/.github/workflows/project-get-set-iteration-field.yaml @@ -142,4 +142,5 @@ jobs: UPDATE_FIELD_TYPE: "iteration" UPDATE_FIELD_ID: ${{ inputs.ITERATION_FIELD_ID }} UPDATE_FIELD_VALUE: ${{ needs.get_set_iteration_option_id.outputs.ITERATION_OPTION_ID }} - secrets: inherit + secrets: + ADD_TO_PROJECT_GITHUB_TOKEN: ${{ secrets.ADD_TO_PROJECT_GITHUB_TOKEN }} diff --git a/.github/workflows/project-get-set-single-select-field.yaml b/.github/workflows/project-get-set-single-select-field.yaml index 6c3f7188..20841a7f 100644 --- a/.github/workflows/project-get-set-single-select-field.yaml +++ b/.github/workflows/project-get-set-single-select-field.yaml @@ -164,4 +164,5 @@ jobs: UPDATE_FIELD_TYPE: "single_select" UPDATE_FIELD_ID: ${{ inputs.SINGLE_SELECT_FIELD_ID }} UPDATE_FIELD_VALUE: ${{ needs.get_set_single_select_option_id.outputs.SINGLE_SELECT_OPTION_ID }} - secrets: inherit + secrets: + ADD_TO_PROJECT_GITHUB_TOKEN: ${{ secrets.ADD_TO_PROJECT_GITHUB_TOKEN }} diff --git a/.github/workflows/project-set-text-date-numeric-field.yaml b/.github/workflows/project-set-text-date-numeric-field.yaml index f2e486c8..2df3aa46 100644 --- a/.github/workflows/project-set-text-date-numeric-field.yaml +++ b/.github/workflows/project-set-text-date-numeric-field.yaml @@ -134,4 +134,5 @@ jobs: UPDATE_FIELD_TYPE: ${{inputs.FIELD_TYPE}} UPDATE_FIELD_ID: ${{ inputs.FIELD_ID }} UPDATE_FIELD_VALUE: ${{ inputs.SET_VALUE }} - secrets: inherit + secrets: + ADD_TO_PROJECT_GITHUB_TOKEN: ${{ secrets.ADD_TO_PROJECT_GITHUB_TOKEN }} diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index e3701250..750e725a 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -146,7 +146,7 @@ jobs: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -171,8 +171,10 @@ jobs: - name: Preprocess extra repos id: preprocess-extras if: ${{ inputs.extra-repo != '' }} + env: + EXTRA_REPO: ${{ inputs.extra-repo }} run: | - EXTRA_REPO_PATH=$(echo ${{ inputs.extra-repo }} | cut -d "/" -f 2) + EXTRA_REPO_PATH=$(echo "$EXTRA_REPO" | cut -d "/" -f 2) echo "EXTRA_REPO_PATH=${EXTRA_REPO_PATH}" >> "${GITHUB_OUTPUT}" - name: checkout extra repos @@ -182,7 +184,7 @@ jobs: repository: ${{ inputs.extra-repo }} ref: ${{ inputs.extra-repo-sha }} path: "./${{ steps.preprocess-extras.outputs.EXTRA_REPO_PATH }}" - ssh-key: ${{ secrets[inputs.extra-repo-deploy-key] }} + ssh-key: ${{ secrets[inputs.extra-repo-deploy-key] }} # zizmor: ignore[overprovisioned-secrets] persist-credentials: false - name: Setup proxy cache @@ -197,8 +199,7 @@ jobs: extra_attributes: "rapids.PACKAGER=wheel,rapids.CUDA_VER=${{ matrix.CUDA_VER }},rapids.PY_VER=${{ matrix.PY_VER }},rapids.ARCH=${{ matrix.ARCH }},rapids.LINUX_VER=${{ matrix.LINUX_VER }}" - name: Build and repair the wheel - run: | - ${{ inputs.script }} + run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: GH_TOKEN: ${{ github.token }} # Use a shell that loads the rc file so that we get the compiler settings @@ -230,9 +231,11 @@ jobs: - name: Show files to be uploaded if: ${{ inputs.upload-artifacts }} + env: + WHEEL_OUTPUT_DIR: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }} run: | echo "Contents of directory to be uploaded:" - ls -R ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }} + ls -R "$WHEEL_OUTPUT_DIR" - uses: actions/upload-artifact@v4 if: ${{ inputs.upload-artifacts }} diff --git a/.github/workflows/wheels-publish.yaml b/.github/workflows/wheels-publish.yaml index 868cc8d1..5cf994c2 100644 --- a/.github/workflows/wheels-publish.yaml +++ b/.github/workflows/wheels-publish.yaml @@ -55,11 +55,11 @@ jobs: container: # CUDA toolkit version of the container is irrelevant in the publish step. # This just uploads already-built wheels to remote storage. - image: "rapidsai/ci-wheel:latest" + image: "rapidsai/ci-wheel:latest" # zizmor: ignore[unpinned-images] env: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -87,9 +87,11 @@ jobs: sha: ${{ inputs.sha }} - name: Download wheels from artifact storage and publish to anaconda repository - run: rapids-wheels-anaconda "${{ inputs.package-name }}" "${{ inputs.package-type }}" + run: rapids-wheels-anaconda "$PACKAGENAME" "$PACKAGETYPE" env: RAPIDS_CONDA_TOKEN: ${{ secrets.CONDA_RAPIDSAI_WHEELS_NIGHTLY_TOKEN }} + PACKAGENAME: ${{ inputs.package-name }} + PACKAGETYPE: ${{ inputs.package-type }} - name: Check if build is release id: check_if_release diff --git a/.github/workflows/wheels-test.yaml b/.github/workflows/wheels-test.yaml index fd10bc46..799388db 100644 --- a/.github/workflows/wheels-test.yaml +++ b/.github/workflows/wheels-test.yaml @@ -145,7 +145,7 @@ jobs: NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }} # GPU jobs must set this container env variable RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@v4 + - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -181,13 +181,13 @@ jobs: continue-on-error: true - name: Run tests - run: ${{ inputs.script }} + run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: GH_TOKEN: ${{ github.token }} - RAPIDS_AUX_SECRET_1: ${{ inputs.rapids-aux-secret-1 != '' && secrets[inputs.rapids-aux-secret-1] || '' }} + RAPIDS_AUX_SECRET_1: ${{ inputs.rapids-aux-secret-1 != '' && secrets[inputs.rapids-aux-secret-1] || '' }} # zizmor: ignore[overprovisioned-secrets] - name: Generate test report - uses: test-summary/action@v2.4 + uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 with: paths: "${{ env.RAPIDS_TESTS_DIR }}/*.xml" show: ${{ inputs.test_summary_show }} diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000..d7371b03 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,7 @@ +rules: + unpinned-uses: + config: + policies: + rapidsai/shared-actions/*: ref-pin + nv-gha-runners/*: ref-pin + actions/*: ref-pin diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index e07bc91d..cf7d2d82 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -26,3 +26,9 @@ repos: rev: v0.6.0 hooks: - id: verify-copyright + - repo: https://github.com/zizmorcore/zizmor-pre-commit + # Zizmor version. + rev: v1.7.0 + hooks: + # Run the linter. + - id: zizmor From 17bcd2ec8d006d104800091a0698e2c626c363e1 Mon Sep 17 00:00:00 2001 From: Gil Forsyth Date: Mon, 30 Jun 2025 14:50:10 -0400 Subject: [PATCH 2/4] chore: ignore template injection warning (not a high confidence attack) --- .github/workflows/custom-job.yaml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index 44c95fb8..cf1d73a6 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -109,10 +109,8 @@ jobs: uses: nv-gha-runners/get-pr-info@main - name: Add PR Info if: startsWith(github.ref_name, 'pull-request/') - env: - RAPIDS_BASE_BRANCH: ${{ fromJSON(steps.get-pr-info.outputs.pr-info).base.ref }} - run: | - echo "${RAPIDS_BASE_BRANCH}" >> "${GITHUB_ENV}" + run: | # zizmor: ignore[template-injection] + echo "RAPIDS_BASE_BRANCH=${{ fromJSON(steps.get-pr-info.outputs.pr-info).base.ref }}" >> "${GITHUB_ENV}" - name: Standardize repository information uses: rapidsai/shared-actions/rapids-github-info@main with: From 2358653dd75bf1aae18eba9fc2f2ebd661392096 Mon Sep 17 00:00:00 2001 From: Gil Forsyth Date: Mon, 30 Jun 2025 14:51:23 -0400 Subject: [PATCH 3/4] fix: template-injection fixes and ignore overprovisioned secrets --- .github/workflows/conda-cpp-build.yaml | 4 ++-- .github/workflows/conda-cpp-tests.yaml | 4 ++-- .github/workflows/conda-python-build.yaml | 4 ++-- .github/workflows/conda-python-tests.yaml | 4 ++-- .github/workflows/custom-job.yaml | 7 ++++--- .github/workflows/pr-builder.yaml | 1 + .github/workflows/wheels-build.yaml | 4 ++-- .github/workflows/wheels-publish.yaml | 4 +++- .github/workflows/wheels-test.yaml | 9 +++++---- 9 files changed, 23 insertions(+), 18 deletions(-) diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 17b93a29..9c92b648 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -161,13 +161,13 @@ jobs: fi env: # NEEDS alternative-gh-token-secret-name - API limits need to be for whatever token is used for upload/download. Repo token may be a different pool for rate limits. - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: C++ build run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: STEP_NAME: "C++ build" # NEEDS alternative-gh-token-secret-name - may require a token with more permissions - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Get Package Name and Location if: ${{ inputs.upload-artifacts }} run: | diff --git a/.github/workflows/conda-cpp-tests.yaml b/.github/workflows/conda-cpp-tests.yaml index e3a55a86..17244701 100644 --- a/.github/workflows/conda-cpp-tests.yaml +++ b/.github/workflows/conda-cpp-tests.yaml @@ -205,12 +205,12 @@ jobs: fi env: # NEEDS alternative-gh-token-secret_name - API limits need to be for whatever token is used for upload/download. Repo token may be a different pool for rate limits. - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: C++ tests run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: # NEEDS alternative-gh-token-secret-name - may require a token with more permissions - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Generate test report uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 with: diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index c9cabbc7..26f90660 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -159,12 +159,12 @@ jobs: fi env: # NEEDS alternative-gh-token-secret_name - API limits need to be for whatever token is used for upload/download. Repo token may be a different pool for rate limits. - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Python build run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: # NEEDS alternative-gh-token-secret-name - may require a token with more permissions - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Get Package Name and Location if: ${{ inputs.upload-artifacts }} run: | diff --git a/.github/workflows/conda-python-tests.yaml b/.github/workflows/conda-python-tests.yaml index 15cef725..230bc2dd 100644 --- a/.github/workflows/conda-python-tests.yaml +++ b/.github/workflows/conda-python-tests.yaml @@ -210,12 +210,12 @@ jobs: fi env: # NEEDS alternative-gh-token-secret_name - API limits need to be for whatever token is used for upload/download. Repo token may be a different pool for rate limits. - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Python tests run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: # NEEDS alternative-gh-token-secret-name - may require a token with more permissions - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Generate test report uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 with: diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index cf1d73a6..cfba2d90 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -132,12 +132,13 @@ jobs: fi env: # NEEDS alternative-gh-token-secret_name - API limits need to be for whatever token is used for upload/download. Repo token may be a different pool for rate limits. - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Run script - run: ${{ inputs.script }} + run: ${INPUTS_SCRIPT} env: # NEEDS alternative-gh-token-secret-name - may require a token with more permissions - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] + INPUTS_SCRIPT: ${{ inputs.script }} - name: Upload file to GitHub Artifact uses: actions/upload-artifact@v4 with: diff --git a/.github/workflows/pr-builder.yaml b/.github/workflows/pr-builder.yaml index 51d19a94..3686a211 100644 --- a/.github/workflows/pr-builder.yaml +++ b/.github/workflows/pr-builder.yaml @@ -19,6 +19,7 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 1 + persist-credentials: false - name: Check for private token usage env: ERROR_MSG: "PR validation failed: Private token access is not allowed to be merged onto the development branch. Remove any uses of input 'alternative-gh-token-secret-name'." diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index 03043790..c3d9a40f 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -220,12 +220,12 @@ jobs: fi env: # NEEDS alternative-gh-token-secret_name - API limits need to be for whatever token is used for upload/download. Repo token may be a different pool for rate limits. - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Build and repair the wheel run: ${{ inputs.script }} # zizmor: ignore[template-injection] env: # NEEDS alternative-gh-token-secret-name - may require a token with more permissions - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] # Use a shell that loads the rc file so that we get the compiler settings shell: bash -leo pipefail {0} diff --git a/.github/workflows/wheels-publish.yaml b/.github/workflows/wheels-publish.yaml index f6fb5d02..3b150ded 100644 --- a/.github/workflows/wheels-publish.yaml +++ b/.github/workflows/wheels-publish.yaml @@ -100,12 +100,14 @@ jobs: GH_TOKEN: ${{ github.token }} - name: Download wheels from artifact storage and publish to anaconda repository - run: rapids-wheels-anaconda-github "${{ inputs.package-name }}" "${{ inputs.package-type }}" + run: rapids-wheels-anaconda-github "${INPUTS_PACKAGE_NAME}" "${INPUTS_PACKAGE_TYPE}" env: GH_TOKEN: ${{ github.token }} RAPIDS_CONDA_TOKEN: ${{ secrets.CONDA_RAPIDSAI_WHEELS_NIGHTLY_TOKEN }} PACKAGENAME: ${{ inputs.package-name }} PACKAGETYPE: ${{ inputs.package-type }} + INPUTS_PACKAGE_NAME: ${{ inputs.package-name }} + INPUTS_PACKAGE_TYPE: ${{ inputs.package-type }} - name: Check if build is release id: check_if_release diff --git a/.github/workflows/wheels-test.yaml b/.github/workflows/wheels-test.yaml index 84df5b76..0d7dcbed 100644 --- a/.github/workflows/wheels-test.yaml +++ b/.github/workflows/wheels-test.yaml @@ -217,14 +217,15 @@ jobs: fi env: # NEEDS alternative-gh-token-secret_name - API limits need to be for whatever token is used for upload/download. Repo token may be a different pool for rate limits. - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Run tests - run: ${{ inputs.script }} # zizmor: ignore[template-injection] + run: ${INPUTS_SCRIPT} env: # NEEDS alternative-gh-token-secret-name - may require a token with more permissions - GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} - RAPIDS_AUX_SECRET_1: ${{ inputs.rapids-aux-secret-1 != '' && secrets[inputs.rapids-aux-secret-1] || '' }} + GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] + RAPIDS_AUX_SECRET_1: ${{ inputs.rapids-aux-secret-1 != '' && secrets[inputs.rapids-aux-secret-1] || '' }} # zizmor: ignore[overprovisioned-secrets] + INPUTS_SCRIPT: ${{ inputs.script }} - name: Generate test report uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 From 7488764acec75d2db0557918a65baa97ac44740e Mon Sep 17 00:00:00 2001 From: Gil Forsyth Date: Mon, 30 Jun 2025 15:07:19 -0400 Subject: [PATCH 4/4] chore: add commented version identifiers for all full-hash containers --- .github/workflows/breaking-change-alert.yaml | 2 +- .github/workflows/build-in-devcontainer.yaml | 4 ++-- .github/workflows/conda-cpp-build.yaml | 2 +- .github/workflows/conda-cpp-post-build-checks.yaml | 2 +- .github/workflows/conda-cpp-tests.yaml | 4 ++-- .github/workflows/conda-python-build.yaml | 2 +- .github/workflows/conda-python-tests.yaml | 4 ++-- .github/workflows/custom-job.yaml | 2 +- .github/workflows/wheels-build.yaml | 2 +- .github/workflows/wheels-test.yaml | 4 ++-- 10 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/breaking-change-alert.yaml b/.github/workflows/breaking-change-alert.yaml index 6e1702dc..4df27965 100644 --- a/.github/workflows/breaking-change-alert.yaml +++ b/.github/workflows/breaking-change-alert.yaml @@ -124,7 +124,7 @@ jobs: fi - name: Send Slack notification - uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d + uses: slackapi/slack-github-action@485a9d42d3a73031f12ec201c457e2162c45d02d # v2.0.0 with: payload: | { diff --git a/.github/workflows/build-in-devcontainer.yaml b/.github/workflows/build-in-devcontainer.yaml index c3f23148..e2ece498 100644 --- a/.github/workflows/build-in-devcontainer.yaml +++ b/.github/workflows/build-in-devcontainer.yaml @@ -99,7 +99,7 @@ jobs: echo "HAS_DEVCONTAINER=false" >> "${GITHUB_ENV}" fi - if: ${{ env.HAS_DEVCONTAINER == 'true' }} - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -116,7 +116,7 @@ jobs: - if: ${{ env.HAS_DEVCONTAINER == 'true' }} name: Run build in devcontainer - uses: devcontainers/ci@8bf61b26e9c3a98f69cb6ce2f88d24ff59b785c6 + uses: devcontainers/ci@8bf61b26e9c3a98f69cb6ce2f88d24ff59b785c6 # v0.3.1900000417 with: push: never configFile: .devcontainer/cuda${{ matrix.CUDA_VER }}-${{ matrix.PACKAGER }}/devcontainer.json diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml index 9c92b648..7a6270c9 100644 --- a/.github/workflows/conda-cpp-build.yaml +++ b/.github/workflows/conda-cpp-build.yaml @@ -107,7 +107,7 @@ jobs: env: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} diff --git a/.github/workflows/conda-cpp-post-build-checks.yaml b/.github/workflows/conda-cpp-post-build-checks.yaml index 8e23cd32..e581609e 100644 --- a/.github/workflows/conda-cpp-post-build-checks.yaml +++ b/.github/workflows/conda-cpp-post-build-checks.yaml @@ -59,7 +59,7 @@ jobs: env: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} diff --git a/.github/workflows/conda-cpp-tests.yaml b/.github/workflows/conda-cpp-tests.yaml index 17244701..2d9dac94 100644 --- a/.github/workflows/conda-cpp-tests.yaml +++ b/.github/workflows/conda-cpp-tests.yaml @@ -155,7 +155,7 @@ jobs: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }} steps: - - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -212,7 +212,7 @@ jobs: # NEEDS alternative-gh-token-secret-name - may require a token with more permissions GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Generate test report - uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 + uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 # v2.4 with: paths: "${{ env.RAPIDS_TESTS_DIR }}/*.xml" if: always() diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml index 26f90660..354ce5cb 100644 --- a/.github/workflows/conda-python-build.yaml +++ b/.github/workflows/conda-python-build.yaml @@ -112,7 +112,7 @@ jobs: env: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} diff --git a/.github/workflows/conda-python-tests.yaml b/.github/workflows/conda-python-tests.yaml index 230bc2dd..0ca6c4e6 100644 --- a/.github/workflows/conda-python-tests.yaml +++ b/.github/workflows/conda-python-tests.yaml @@ -159,7 +159,7 @@ jobs: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }} steps: - - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -217,7 +217,7 @@ jobs: # NEEDS alternative-gh-token-secret-name - may require a token with more permissions GH_TOKEN: ${{ inputs.alternative-gh-token-secret-name && secrets[inputs.alternative-gh-token-secret-name] || github.token }} # zizmor: ignore[overprovisioned-secrets] - name: Generate test report - uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 + uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 # v2.4 with: paths: "${{ env.RAPIDS_TESTS_DIR }}/*.xml" if: always() diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml index cfba2d90..a516e199 100644 --- a/.github/workflows/custom-job.yaml +++ b/.github/workflows/custom-job.yaml @@ -85,7 +85,7 @@ jobs: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }} steps: - - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml index c3d9a40f..b6cfd9bf 100644 --- a/.github/workflows/wheels-build.yaml +++ b/.github/workflows/wheels-build.yaml @@ -152,7 +152,7 @@ jobs: RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} diff --git a/.github/workflows/wheels-test.yaml b/.github/workflows/wheels-test.yaml index 0d7dcbed..b585de7a 100644 --- a/.github/workflows/wheels-test.yaml +++ b/.github/workflows/wheels-test.yaml @@ -165,7 +165,7 @@ jobs: NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }} # GPU jobs must set this container env variable RAPIDS_BUILD_TYPE: ${{ inputs.build_type }} steps: - - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + - uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1 with: role-to-assume: ${{ vars.AWS_ROLE_ARN }} aws-region: ${{ vars.AWS_REGION }} @@ -228,7 +228,7 @@ jobs: INPUTS_SCRIPT: ${{ inputs.script }} - name: Generate test report - uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 + uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 # v2.4 with: paths: "${{ env.RAPIDS_TESTS_DIR }}/*.xml" show: ${{ inputs.test_summary_show }}