Skip to content

Update github workflows & precommit to use pinned hashes instead of tags #170

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rlskoeser merged 4 commits into from
Jul 2, 2026
Merged

Update github workflows & precommit to use pinned hashes instead of tags #170

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
961b158
Update github workflows & precommit to use pinned hashes instead of tags
rlskoeser Jul 2, 2026
e15710e
Configure to not persist permissions after checkout
rlskoeser Jul 2, 2026
29ea5b2
Update pre-commit hooks and copyright year in docs
rlskoeser Jul 2, 2026
bc91b1d
Remove sphinx_pyodide ext since not yet available
rlskoeser Jul 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions .github/workflows/check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,11 @@ jobs:
working-directory: .

steps:
- uses: actions/checkout@v6

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Install uv
uses: astral-sh/setup-uv@v8.1.0
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
python-version: "3.12"
enable-cache: true
Expand All @@ -32,7 +33,7 @@ jobs:
run: uv sync --group check

- name: Run Ruff linter
uses: astral-sh/ruff-action@v3
uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b # v4.0.0
with:
args: "check --output-format=github"

Expand Down
35 changes: 18 additions & 17 deletions .github/workflows/python-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,23 +19,24 @@ permissions:

jobs:
deploy:

runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v6
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: '3.x'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install build
- name: Build package
run: python -m build
- name: Publish package
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
with:
user: __token__
password: ${{ secrets.PYPI_API_TOKEN }}
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: "3.x"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install build
- name: Build package
run: python -m build
- name: Publish package
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
with:
user: __token__
password: ${{ secrets.PYPI_API_TOKEN }}
18 changes: 9 additions & 9 deletions .github/workflows/unit_tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,8 @@ on:
branches:
- "**"
paths:
- 'undate/**'
- 'tests/**'
- "undate/**"
- "tests/**"
pull_request:
branches:
- "**"
Expand All @@ -34,15 +34,16 @@ jobs:
working-directory: .

steps:
- uses: actions/checkout@v6

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
# use github python action instead of uv to take advantage of caching
- name: Set up Python ${{ matrix.python }}
uses: astral-sh/setup-uv@v8.1.0
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
python-version: ${{ matrix.python }}
cache: 'pip'
cache-dependency-path: '**/pyproject.toml'
cache: "pip"
cache-dependency-path: "**/pyproject.toml"

- name: Install package with check dependencies
run: uv sync --group test
Expand All @@ -58,8 +59,7 @@ jobs:
if: ${{ matrix.python == env.COV_PYTHON_VERSION }}

- name: Upload coverage to Codecov
uses: codecov/codecov-action@v6
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
env:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
if: ${{ matrix.python == env.COV_PYTHON_VERSION }}

15 changes: 8 additions & 7 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,13 @@ files: \.py
repos:
# ruff for linting and formatting python
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.15.12
rev: c59bba8fb259db0fec2bbb77ad8ba51ea7341b56 # frozen: v0.15.20
hooks:
- id: ruff-check
args: [ --fix, --show-fixes, --exit-non-zero-on-fix ]
args: [--fix, --show-fixes, --exit-non-zero-on-fix]
- id: ruff-format
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v6.0.0
rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
hooks:
- id: check-case-conflict
- id: check-merge-conflict
Expand All @@ -22,25 +22,26 @@ repos:
args: [--pytest-test-first]

- repo: https://github.com/pre-commit/mirrors-mypy
rev: v2.0.0
rev: d2823d321df3af8f878f7ee3414dc94d037145b9 # frozen: v2.1.0
hooks:
- id: mypy
additional_dependencies: [numpy]

# yamlfmt for formatting YAML files
- repo: https://github.com/google/yamlfmt
rev: v0.21.0
rev: b5ca1890231d5e1e5181fef75a1be609d1e25029 # frozen: v0.21.0
hooks:
- id: yamlfmt
# Codespell for spell checking
- repo: https://github.com/codespell-project/codespell
rev: v2.4.2
rev: 2ccb47ff45ad361a21071a7eedda4c37e6ae8c5a # frozen: v2.4.2
hooks:
- id: codespell
additional_dependencies:
- tomli
exclude_types: ["css", "html", "javascript", "json"]
# Validate GitHub Actions workflow files
- repo: https://github.com/mpalmer/action-validator
rev: v0.9.0
rev: 76a805bbfcba3506d6cdb4bba1810ab504e0d72b # frozen: v0.9.0
hooks:
- id: action-validator
12 changes: 7 additions & 5 deletions docs/conf.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,20 +10,22 @@
# add these directories to sys.path here. If the directory is relative to the
# documentation root, use os.path.abspath to make it absolute, like shown here.
#
# import os
# import sys
# sys.path.insert(0, os.path.abspath('.'))

import sys
from pathlib import Path

sys.path.insert(0, str(Path().resolve()))

import undate
Comment on lines +14 to 19

@coderabbitai coderabbitai Bot Jul 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check how docs are built (invocation directory) and whether undate is installed as a dependency for docs build
fd -e cfg -e yml -e yaml -e toml -e mk Makefile . 2>/dev/null
rg -n "sphinx-build|make html|docs" .readthedocs.yaml .readthedocs.yml Makefile docs/Makefile pyproject.toml 2>/dev/null

Repository: dh-tech/undate-python

Length of output: 760

Anchor the Sphinx source path to docs/conf.py

Path().resolve() depends on the current working directory, so this can add docs/ instead of the project root when Sphinx runs from that directory. That makes import undate fail unless the package is already installed.

🛠️ Suggested fix 
-sys.path.insert(0, str(Path().resolve()))
+sys.path.insert(0, str(Path(__file__).parent.parent.resolve()))
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
import sys
from pathlib import Path
sys.path.insert(0, str(Path().resolve()))
import undate
import sys
from pathlib import Path
sys.path.insert(0, str(Path(__file__).parent.parent.resolve()))
import undate
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/conf.py` around lines 14 - 19, The Sphinx import setup in conf.py is
using Path().resolve(), which depends on the current working directory and can
point at docs/ instead of the project root. Update the path bootstrap near
sys.path.insert and import undate to anchor it off the conf.py location (using
the file’s parent chain) so the repository root is added consistently regardless
of where Sphinx is run from.

@coderabbitai coderabbitai Bot Jul 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check ruff config for docs/conf.py exclusions or E402 handling
rg -n "E402|docs/conf.py|exclude" pyproject.toml .ruff.toml ruff.toml 2>/dev/null

Repository: dh-tech/undate-python

Length of output: 159

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== files ==\n'
git ls-files | sed -n '1,200p'

printf '\n== lint config search ==\n'
rg -n --hidden --glob '!**/.git/**' '(^|[^A-Za-z0-9_])E402([^A-Za-z0-9_]|$)|docs/conf\.py|exclude|extend-exclude|per-file-ignores|ignore\s*=' pyproject.toml .ruff.toml ruff.toml setup.cfg tox.ini noxfile.py .pre-commit-config.yaml .github/workflows 2>/dev/null || true

printf '\n== docs/conf.py ==\n'
if [ -f docs/conf.py ]; then
  cat -n docs/conf.py | sed -n '1,120p'
fi

printf '\n== ruff/flake8 related files ==\n'
fd -a 'pyproject.toml|.ruff.toml|ruff.toml|setup.cfg|tox.ini|noxfile.py|pre-commit-config.yaml' . 2>/dev/null || true

Repository: dh-tech/undate-python

Length of output: 7471

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== docs/conf.py path status ==\n'
if [ -f docs/conf.py ]; then
  wc -l docs/conf.py
  sed -n '1,80p' docs/conf.py | cat -n
else
  echo "docs/conf.py not found"
fi

printf '\n== search for lint config and CI lint invocations ==\n'
rg -n --hidden --glob '!**/.git/**' \
  'ruff|flake8|pyproject\.toml|\.ruff\.toml|ruff\.toml|E402|per-file-ignores|extend-exclude|exclude|docs/conf\.py' \
  .github pyproject.toml .ruff.toml ruff.toml setup.cfg tox.ini noxfile.py pre-commit-config.yaml 2>/dev/null || true

Repository: dh-tech/undate-python

Length of output: 4224

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== docs/conf.py ==\n'
if [ -f docs/conf.py ]; then
  wc -l docs/conf.py
  sed -n '1,120p' docs/conf.py | cat -n
else
  echo "docs/conf.py not found"
fi

printf '\n== config and CI search ==\n'
rg -n --hidden --glob '!**/.git/**' \
  'ruff|flake8|E402|per-file-ignores|extend-exclude|exclude|docs/conf\.py' \
  .github pyproject.toml .ruff.toml ruff.toml setup.cfg tox.ini noxfile.py .pre-commit-config.yaml 2>/dev/null || true

Repository: dh-tech/undate-python

Length of output: 4675

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== candidate config files ==\n'
git ls-files | rg '(^|/)(pyproject\.toml|\.ruff\.toml|ruff\.toml|setup\.cfg|tox\.ini|noxfile\.py|\.pre-commit-config\.yaml|\.github/workflows/.*\.(yml|yaml))$' || true

printf '\n== docs/conf.py excerpt ==\n'
if [ -f docs/conf.py ]; then
  sed -n '1,80p' docs/conf.py | cat -n
fi

Repository: dh-tech/undate-python

Length of output: 3330

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== pyproject.toml ruff section ==\n'
sed -n '100,170p' pyproject.toml | cat -n

printf '\n== workflow lint steps ==\n'
sed -n '1,220p' .github/workflows/check.yml | cat -n

printf '\n== pre-commit ruff entries ==\n'
sed -n '1,120p' .pre-commit-config.yaml | cat -n

Repository: dh-tech/undate-python

Length of output: 5062

Add an E402 exemption for this import. ruff check runs on docs/conf.py with no file-specific ignore, so import undate after sys.path mutation will be flagged unless this line gets # noqa: E402 or the file is added to per-file ignores.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/conf.py` at line 19, The standalone import in docs/conf.py is being
flagged by Ruff E402 because it comes after sys.path manipulation; update the
import of undate to either include a local E402 exemption or add docs/conf.py to
the per-file ignores so the configuration passes lint. Use the undate import as
the anchor point when making the change.


# -- Project information -----------------------------------------------------

project = "undate"
copyright = "2024, DHtech"
copyright = "2026, DHtech"
author = "DHtech Community"

# The full version, including alpha/beta/rc tags
release = undate.__version__
release = undate.__version__ # type: ignore[attr-defined]

master_doc = "index"

Expand Down
Loading