From 22d5c97dbb9c6163605db31e40d1fc179798993b Mon Sep 17 00:00:00 2001 From: JP Cottin Date: Mon, 5 Oct 2026 19:32:35 -0700 Subject: [PATCH 1/3] Bump actions/checkout and actions/setup-python to v7 The v4 and v5 releases run on Node.js 20, which GitHub Actions has deprecated: every CI run on master currently prints a warning that they are being forced onto Node.js 24. The v7 releases target Node.js 24. --- .github/workflows/test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7faba15..ca10708 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -14,10 +14,10 @@ jobs: matrix: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python-version }} cache: pip From 661b737e346f53925d0c7eba6a941245ce3e070c Mon Sep 17 00:00:00 2001 From: JP Cottin Date: Mon, 5 Oct 2026 19:35:12 -0700 Subject: [PATCH 2/3] Pin the actions to commit SHAs The repository's workflow policy (zizmor's unpinned-uses check) requires actions to be pinned to a commit hash rather than a tag. --- .github/workflows/test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index ca10708..33cdc2e 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -14,10 +14,10 @@ jobs: matrix: python-version: ["3.10", "3.11", "3.12", "3.13"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} cache: pip From 88e1852ba7f8d994c87adfb3e49f08c9ea982770 Mon Sep 17 00:00:00 2001 From: JP Cottin Date: Mon, 5 Oct 2026 19:40:36 -0700 Subject: [PATCH 3/3] Restrict the workflow's token to read access The job only checks out the repository and runs pytest. Without a permissions block the token gets the default, broader permissions, which the workflow policy (zizmor) rejects. --- .github/workflows/test.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 33cdc2e..ee611d2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -5,6 +5,9 @@ on: push: branches: [master] +permissions: + contents: read + jobs: pytest: name: pytest (Python ${{ matrix.python-version }})