diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 000000000..fccccb217 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,2 @@ +# @stbenjam owns everything. Enforced once main requires a Code Owner review. +* @stbenjam diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..e85219609 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,20 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + groups: + actions: + patterns: ["*"] # all action bumps in ONE PR + commit-message: + prefix: ci + open-pull-requests-limit: 5 + + - package-ecosystem: pip + directory: / + schedule: + interval: monthly + groups: + python: + patterns: ["*"] diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5b1af069c..605be7011 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,17 +19,17 @@ jobs: language: [python, javascript] steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3 with: category: /language:${{ matrix.language }} diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 36f147673..a6ff05144 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -20,11 +20,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v5 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: Log in to Container registry if: github.event_name != 'pull_request' - uses: docker/login-action@v4 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -32,7 +32,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v6 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -44,7 +44,7 @@ jobs: type=sha - name: Build and push Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: . push: ${{ github.event_name != 'pull_request' }} diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 1521eb55c..8dda908a7 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -18,10 +18,10 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" @@ -35,7 +35,7 @@ jobs: run: mkdocs build - name: Upload artifact - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5 with: path: site/ @@ -48,4 +48,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 753ae7530..28d095201 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,10 +12,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.11" @@ -28,7 +28,7 @@ jobs: run: python -m build - name: Upload build artifacts - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 with: name: dist path: dist/ @@ -45,11 +45,11 @@ jobs: steps: - name: Download build artifacts - uses: actions/download-artifact@v5 + uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5 with: name: dist path: dist/ - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 diff --git a/.github/workflows/rule-impact.yml b/.github/workflows/rule-impact.yml index 9939adad9..525fa0205 100644 --- a/.github/workflows/rule-impact.yml +++ b/.github/workflows/rule-impact.yml @@ -25,13 +25,13 @@ jobs: pull-requests: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: persist-credentials: false fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" diff --git a/.github/workflows/skillsaw-ecosystem-scout.yml b/.github/workflows/skillsaw-ecosystem-scout.yml index 243d4c0d9..cdb7b0a6a 100644 --- a/.github/workflows/skillsaw-ecosystem-scout.yml +++ b/.github/workflows/skillsaw-ecosystem-scout.yml @@ -6,15 +6,14 @@ on: permissions: contents: read issues: write - id-token: write jobs: scout: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - - uses: anthropics/claude-code-action@v1 + - uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1 with: prompt: | Use the skillsaw-ecosystem-scout skill. Follow every step in the skill. @@ -27,7 +26,7 @@ jobs: - name: Upload execution log if: always() - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 with: name: claude-execution-log-${{ github.run_id }} path: /home/runner/work/_temp/claude-execution-output.json diff --git a/.github/workflows/skillsaw-issue-solver.yml b/.github/workflows/skillsaw-issue-solver.yml index 17b3863c9..50fbd37af 100644 --- a/.github/workflows/skillsaw-issue-solver.yml +++ b/.github/workflows/skillsaw-issue-solver.yml @@ -13,13 +13,12 @@ permissions: contents: write pull-requests: write issues: write - id-token: write jobs: issue-solver: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: Get labeled issues with trusted content only id: activity @@ -72,7 +71,7 @@ jobs: echo "Prepared issues with trusted comments:" cat /tmp/issues-with-comments.json | jq '[.[] | {number, title, comment_count: (.trusted_comments | length)}]' - - uses: anthropics/claude-code-action@v1 + - uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1 if: steps.activity.outputs.has_issues == 'true' with: prompt: | @@ -97,7 +96,7 @@ jobs: - name: Upload execution log if: always() - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 with: name: claude-execution-log-${{ github.run_id }} path: /home/runner/work/_temp/claude-execution-output.json diff --git a/.github/workflows/skillsaw-maintenance.yml b/.github/workflows/skillsaw-maintenance.yml index e6cd7426d..1abdae7eb 100644 --- a/.github/workflows/skillsaw-maintenance.yml +++ b/.github/workflows/skillsaw-maintenance.yml @@ -7,15 +7,14 @@ permissions: contents: write pull-requests: write issues: write - id-token: write jobs: maintenance: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - - uses: anthropics/claude-code-action@v1 + - uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1 with: prompt: | Use the skillsaw-maintenance skill. Follow every step in the skill. @@ -28,7 +27,7 @@ jobs: - name: Upload execution log if: always() - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 with: name: claude-execution-log-${{ github.run_id }} path: /home/runner/work/_temp/claude-execution-output.json diff --git a/.github/workflows/skillsaw-pr-review.yml b/.github/workflows/skillsaw-pr-review.yml index 8c634503f..995236d5a 100644 --- a/.github/workflows/skillsaw-pr-review.yml +++ b/.github/workflows/skillsaw-pr-review.yml @@ -13,16 +13,15 @@ permissions: contents: write pull-requests: write issues: write - id-token: write jobs: pr-review: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: Restore last run timestamp - uses: actions/cache/restore@v5 + uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: .last-pr-review-run key: pr-review-last-run @@ -73,7 +72,7 @@ jobs: echo "New PR comments from collaborators since $SINCE:" cat /tmp/new-pr-comments.json | jq length - - uses: anthropics/claude-code-action@v1 + - uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1 if: steps.activity.outputs.has_prs == 'true' with: prompt: | @@ -107,14 +106,14 @@ jobs: - name: Cache last run timestamp if: always() - uses: actions/cache/save@v5 + uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: .last-pr-review-run key: pr-review-last-run-${{ github.run_id }} - name: Upload execution log if: always() - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 with: name: claude-execution-log-${{ github.run_id }} path: /home/runner/work/_temp/claude-execution-output.json diff --git a/.github/workflows/skillsaw-review-panel.yml b/.github/workflows/skillsaw-review-panel.yml index ce07bf28c..047067c36 100644 --- a/.github/workflows/skillsaw-review-panel.yml +++ b/.github/workflows/skillsaw-review-panel.yml @@ -12,7 +12,6 @@ permissions: contents: read pull-requests: write issues: write - id-token: write jobs: panel-review: @@ -24,11 +23,11 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: gh pr edit ${{ github.event.pull_request.number }} --remove-label panel-review --repo ${{ github.repository }} || true - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: fetch-depth: 0 - - uses: anthropics/claude-code-action@v1 + - uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1 with: prompt: | Use the skillsaw-review-panel skill. Follow every step in the skill. @@ -44,7 +43,7 @@ jobs: - name: Upload execution log if: always() - uses: actions/upload-artifact@v5 + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 with: name: panel-review-log-${{ github.run_id }} path: /home/runner/work/_temp/claude-execution-output.json diff --git a/.github/workflows/test-action-review.yml b/.github/workflows/test-action-review.yml index 2e7f2e531..9930a7051 100644 --- a/.github/workflows/test-action-review.yml +++ b/.github/workflows/test-action-review.yml @@ -13,7 +13,7 @@ jobs: pull-requests: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: persist-credentials: false diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml index 3d07ddf91..3de9b7251 100644 --- a/.github/workflows/test-action.yml +++ b/.github/workflows/test-action.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: persist-credentials: false diff --git a/.github/workflows/test-promptfoo-compat.yml b/.github/workflows/test-promptfoo-compat.yml index fa5121535..92711144e 100644 --- a/.github/workflows/test-promptfoo-compat.yml +++ b/.github/workflows/test-promptfoo-compat.yml @@ -10,10 +10,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.11" diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d6d47d17c..5443d958e 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -20,12 +20,12 @@ jobs: python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: ${{ matrix.python-version }} @@ -40,7 +40,7 @@ jobs: pytest tests/ -v --cov=src/skillsaw --cov-report=xml --cov-report=term - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 if: matrix.python-version == '3.11' with: token: ${{ secrets.CODECOV_TOKEN }} @@ -50,12 +50,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.11" @@ -78,12 +78,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.11" @@ -94,7 +94,7 @@ jobs: .venv/bin/pip install -e '.[dev]' - name: Install uv (for APM) - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6 - name: Run make update run: make update @@ -119,12 +119,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.11"