diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..82d1743aa --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,26 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + commit-message: + prefix: "ci" + - package-ecosystem: pip + directory: /packages/data-designer-config + schedule: + interval: weekly + commit-message: + prefix: "chore" + - package-ecosystem: pip + directory: /packages/data-designer-engine + schedule: + interval: weekly + commit-message: + prefix: "chore" + - package-ecosystem: pip + directory: /packages/data-designer + schedule: + interval: weekly + commit-message: + prefix: "chore" diff --git a/.github/workflows/agentic-ci-pr-review.yml b/.github/workflows/agentic-ci-pr-review.yml index feea767f9..2247151c8 100644 --- a/.github/workflows/agentic-ci-pr-review.yml +++ b/.github/workflows/agentic-ci-pr-review.yml @@ -123,7 +123,7 @@ jobs: echo "sha=$SHA" >> "$GITHUB_OUTPUT" - name: Checkout PR branch - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: ref: ${{ steps.head.outputs.sha }} fetch-depth: 0 diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml index 04cb835e2..4924208a4 100644 --- a/.github/workflows/build-docs.yml +++ b/.github/workflows/build-docs.yml @@ -10,6 +10,8 @@ on: types: - published +permissions: {} + jobs: build-notebooks: uses: ./.github/workflows/build-notebooks.yml @@ -23,9 +25,9 @@ jobs: contents: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "0.9.5" - name: Set up Python @@ -33,7 +35,7 @@ jobs: - name: Install dependencies for docs run: uv sync --all-packages --group docs - name: Download artifact from previous step - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: notebooks path: docs/notebooks diff --git a/.github/workflows/build-notebooks.yml b/.github/workflows/build-notebooks.yml index 961deb0c3..618c6e181 100644 --- a/.github/workflows/build-notebooks.yml +++ b/.github/workflows/build-notebooks.yml @@ -14,6 +14,8 @@ on: schedule: - cron: "0 12 * * MON" +permissions: {} + jobs: build: runs-on: ubuntu-latest @@ -25,9 +27,9 @@ jobs: OPENROUTER_API_KEY: ${{ secrets.TEST_OPENROUTER_API_KEY }} steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "0.9.5" - name: Set up Python @@ -35,7 +37,7 @@ jobs: - name: Restore notebook cache if: inputs.use_cache id: cache - uses: actions/cache@v5 + uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5 with: path: .notebook-cache key: notebooks-${{ hashFiles('docs/notebook_source/*.py') }} @@ -80,7 +82,7 @@ jobs: - name: Convert and execute notebooks run: make convert-execute-notebooks ${{ inputs.use_cache && 'USE_CACHE=1' || '' }} - name: Upload notebooks as artifacts - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: notebooks path: docs/notebooks diff --git a/.github/workflows/check-colab-notebooks.yml b/.github/workflows/check-colab-notebooks.yml index 5d3a06af1..a7e839675 100644 --- a/.github/workflows/check-colab-notebooks.yml +++ b/.github/workflows/check-colab-notebooks.yml @@ -11,6 +11,8 @@ on: - 'docs/notebook_source/*.py' workflow_dispatch: +permissions: {} + jobs: check-colab-notebooks: name: Check Colab Notebooks @@ -18,10 +20,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "latest" python-version: "3.11" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4ad6048db..f7bdf8172 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,6 +7,8 @@ on: branches: [ main ] workflow_dispatch: +permissions: {} + jobs: # =========================================================================== # Independent Package Tests @@ -24,10 +26,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "latest" python-version: ${{ matrix.python-version }} @@ -55,10 +57,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "latest" python-version: ${{ matrix.python-version }} @@ -86,10 +88,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "latest" python-version: ${{ matrix.python-version }} @@ -125,10 +127,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "latest" python-version: ${{ matrix.python-version }} @@ -163,10 +165,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "latest" python-version: ${{ matrix.python-version }} @@ -185,10 +187,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "latest" python-version: "3.11" @@ -209,12 +211,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: fetch-depth: 0 # Full history needed for file creation dates - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "latest" python-version: "3.11" diff --git a/.github/workflows/docs-preview.yml b/.github/workflows/docs-preview.yml index d287349de..eb11f09db 100644 --- a/.github/workflows/docs-preview.yml +++ b/.github/workflows/docs-preview.yml @@ -8,6 +8,8 @@ on: - "mkdocs.yml" - ".github/workflows/docs-preview.yml" +permissions: {} + jobs: build-and-deploy: runs-on: ubuntu-latest @@ -16,10 +18,10 @@ jobs: pull-requests: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "0.9.5" @@ -77,14 +79,14 @@ jobs: - name: Deploy to Cloudflare Pages id: deploy - uses: cloudflare/wrangler-action@v3 + uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} command: pages deploy site/ --project-name=dd-docs-preview --branch=pr-${{ github.event.pull_request.number }} - name: Find existing comment - uses: peter-evans/find-comment@v4 + uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4 id: find-comment with: issue-number: ${{ github.event.pull_request.number }} @@ -92,7 +94,7 @@ jobs: body-includes: "" - name: Post or update PR comment - uses: peter-evans/create-or-update-comment@v5 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5 with: comment-id: ${{ steps.find-comment.outputs.comment-id }} issue-number: ${{ github.event.pull_request.number }} diff --git a/.github/workflows/health-checks.yml b/.github/workflows/health-checks.yml index dbccbf12e..223764a07 100644 --- a/.github/workflows/health-checks.yml +++ b/.github/workflows/health-checks.yml @@ -8,6 +8,8 @@ on: types: [published] workflow_dispatch: +permissions: {} + jobs: health-checks: name: Provider Health Checks @@ -15,10 +17,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 with: version: "latest" python-version: "3.11" diff --git a/.github/workflows/pack-tutorials.yml b/.github/workflows/pack-tutorials.yml index fc4b536a3..8bb289bba 100644 --- a/.github/workflows/pack-tutorials.yml +++ b/.github/workflows/pack-tutorials.yml @@ -5,6 +5,8 @@ on: release: types: [published] +permissions: {} + jobs: build-notebooks: uses: ./.github/workflows/build-notebooks.yml @@ -17,7 +19,7 @@ jobs: steps: - name: Download artifact from previous step - uses: actions/download-artifact@v7 + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: name: notebooks path: data_designer_tutorial @@ -27,7 +29,7 @@ jobs: run: | echo "SOURCE_FOLDER_PATH=data_designer_tutorial" >> $GITHUB_ENV echo "ZIP_FILE_NAME=data_designer_tutorial.zip" >> $GITHUB_ENV - + - name: Check if source folder exists run: | if [ ! -d "${{ env.SOURCE_FOLDER_PATH }}" ]; then @@ -58,20 +60,17 @@ jobs: exit 1 fi fi - + echo "Latest release tag found: $LATEST_TAG" echo "tag=$LATEST_TAG" >> $GITHUB_OUTPUT env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload zip file as release asset - uses: softprops/action-gh-release@v2 - with: - tag_name: ${{ steps.get_release.outputs.tag }} - files: ${{ env.ZIP_FILE_NAME }} - draft: false - prerelease: false - + env: + GH_TOKEN: ${{ github.token }} + run: gh release upload "${{ steps.get_release.outputs.tag }}" "${{ env.ZIP_FILE_NAME }}" + - name: Cleanup if: always() run: rm -f ${{ env.ZIP_FILE_NAME }} diff --git a/.github/workflows/semantic-pull-requests.yml b/.github/workflows/semantic-pull-requests.yml index 2c22ea086..5f355deec 100644 --- a/.github/workflows/semantic-pull-requests.yml +++ b/.github/workflows/semantic-pull-requests.yml @@ -23,4 +23,4 @@ permissions: jobs: semantic-pull-request: - uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_semantic_pull_request.yml@v0.65.12 + uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_semantic_pull_request.yml@21f18ae8b669fd0de1a25ff0e82a1660ec1aa517 # v0.65.12