From 7f1441ba0d35b8fd2683a7aa2c05da3090a12fa0 Mon Sep 17 00:00:00 2001 From: Romain Floreani Date: Wed, 29 Jul 2026 12:41:23 -0400 Subject: [PATCH 1/5] Pin GitHub Actions to commit hashes --- .github/workflows/issue_to_jira.yml | 2 +- .github/workflows/pr_jira_actions.yml | 2 +- .github/workflows/python_analysis.yml | 4 ++-- .github/workflows/python_deploy_dev.yml | 4 ++-- .github/workflows/python_deploy_prod.yml | 4 ++-- .github/workflows/security_scan.yml | 4 ++-- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml index b031676cd..7e321eee5 100644 --- a/.github/workflows/issue_to_jira.yml +++ b/.github/workflows/issue_to_jira.yml @@ -8,7 +8,7 @@ permissions: {} jobs: call-workflow-create-jira-issue: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3.9.1 permissions: contents: read issues: write diff --git a/.github/workflows/pr_jira_actions.yml b/.github/workflows/pr_jira_actions.yml index 084ddfcad..7ca5c6ace 100644 --- a/.github/workflows/pr_jira_actions.yml +++ b/.github/workflows/pr_jira_actions.yml @@ -6,7 +6,7 @@ on: jobs: call-workflow-pr_jira_actions: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3.9.1 permissions: contents: read pull-requests: write diff --git a/.github/workflows/python_analysis.yml b/.github/workflows/python_analysis.yml index 9c8479cbd..c57d2be11 100644 --- a/.github/workflows/python_analysis.yml +++ b/.github/workflows/python_analysis.yml @@ -26,7 +26,7 @@ concurrency: jobs: call-workflow-static-analysis: name: Static analysis - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v3.9.1 permissions: contents: read pull-requests: read @@ -36,7 +36,7 @@ jobs: python-version: '3.12' call-workflow-pytest: name: Pytest - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v3.9.1 permissions: contents: read pull-requests: read diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index cef6fe05f..1641a898a 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -14,7 +14,7 @@ concurrency: jobs: call-workflow-conda-publish: name: Publish development conda package on JFrog Artifactory - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3.9.1 permissions: contents: write with: @@ -29,7 +29,7 @@ jobs: JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }} call-workflow-pypi-publish: name: Publish development pypi package (JFrog Artifactory, TestPyPI) - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3.9.1 permissions: contents: write with: diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index 04345ebd2..415b1eade 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -29,7 +29,7 @@ jobs: call-workflow-conda-release: name: Publish production Conda package on JFrog Artifactory if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3.9.1 permissions: contents: write with: @@ -41,7 +41,7 @@ jobs: call-workflow-pypi-release: name: Publish production PyPI package (JFrog Artifactory, PyPI) if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3.9.1 permissions: contents: write with: diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml index bda779d45..b31466a75 100644 --- a/.github/workflows/security_scan.yml +++ b/.github/workflows/security_scan.yml @@ -31,7 +31,7 @@ jobs: security-events: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3.9.1 call-workflow-zizmor-annotate: name: Zizmor analysis (annotate) @@ -40,4 +40,4 @@ jobs: checks: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3.9.1 From bdd93ac9b9573287e875cc4b8eed1393b595cf92 Mon Sep 17 00:00:00 2001 From: Romain Floreani Date: Wed, 29 Jul 2026 13:23:35 -0400 Subject: [PATCH 2/5] Pin GitHub Actions to commit hashes (retry with explicit file list, avoids Windows glob bug) --- .github/workflows/issue_to_jira.yml | 2 +- .github/workflows/pr_jira_actions.yml | 2 +- .github/workflows/python_analysis.yml | 4 ++-- .github/workflows/python_deploy_dev.yml | 4 ++-- .github/workflows/python_deploy_prod.yml | 4 ++-- .github/workflows/security_scan.yml | 4 ++-- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml index 7e321eee5..5b2c92639 100644 --- a/.github/workflows/issue_to_jira.yml +++ b/.github/workflows/issue_to_jira.yml @@ -8,7 +8,7 @@ permissions: {} jobs: call-workflow-create-jira-issue: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: read issues: write diff --git a/.github/workflows/pr_jira_actions.yml b/.github/workflows/pr_jira_actions.yml index 7ca5c6ace..1cc12e9bb 100644 --- a/.github/workflows/pr_jira_actions.yml +++ b/.github/workflows/pr_jira_actions.yml @@ -6,7 +6,7 @@ on: jobs: call-workflow-pr_jira_actions: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: read pull-requests: write diff --git a/.github/workflows/python_analysis.yml b/.github/workflows/python_analysis.yml index c57d2be11..479f94e50 100644 --- a/.github/workflows/python_analysis.yml +++ b/.github/workflows/python_analysis.yml @@ -26,7 +26,7 @@ concurrency: jobs: call-workflow-static-analysis: name: Static analysis - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: read pull-requests: read @@ -36,7 +36,7 @@ jobs: python-version: '3.12' call-workflow-pytest: name: Pytest - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: read pull-requests: read diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index 1641a898a..782ca3e1c 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -14,7 +14,7 @@ concurrency: jobs: call-workflow-conda-publish: name: Publish development conda package on JFrog Artifactory - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: write with: @@ -29,7 +29,7 @@ jobs: JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }} call-workflow-pypi-publish: name: Publish development pypi package (JFrog Artifactory, TestPyPI) - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: write with: diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index 415b1eade..aca7206c7 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -29,7 +29,7 @@ jobs: call-workflow-conda-release: name: Publish production Conda package on JFrog Artifactory if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: write with: @@ -41,7 +41,7 @@ jobs: call-workflow-pypi-release: name: Publish production PyPI package (JFrog Artifactory, PyPI) if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 permissions: contents: write with: diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml index b31466a75..d620e06c8 100644 --- a/.github/workflows/security_scan.yml +++ b/.github/workflows/security_scan.yml @@ -31,7 +31,7 @@ jobs: security-events: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 call-workflow-zizmor-annotate: name: Zizmor analysis (annotate) @@ -40,4 +40,4 @@ jobs: checks: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3.9.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1 From 459ebc8e4c67e6097cfdda9f035ae98dfd70079d Mon Sep 17 00:00:00 2001 From: Romain Floreani Date: Tue, 4 Aug 2026 10:12:28 -0400 Subject: [PATCH 3/5] Add dependabot auto-merge workflow --- .github/workflows/dependabot-auto-merge.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 000000000..2b9a6e78c --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,14 @@ +name: Dependabot auto-merge + +on: + pull_request_target: # zizmor: ignore[dangerous-triggers] no checkout, no execution of PR-authored code; only trusted event context is read + types: [opened, synchronize, reopened] + +jobs: + call-workflow-dependabot-auto-merge: + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@DEVOPS-1061 + permissions: + contents: write + pull-requests: write + with: + dependabot-group: mirageo-ci-tools \ No newline at end of file From 7487d88a60a05bde2e5aa5519f3d71571b987baa Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 14:12:56 +0000 Subject: [PATCH 4/5] [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --- .github/workflows/dependabot-auto-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 2b9a6e78c..f0b20daec 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -11,4 +11,4 @@ jobs: contents: write pull-requests: write with: - dependabot-group: mirageo-ci-tools \ No newline at end of file + dependabot-group: mirageo-ci-tools From 4aabc1530b11a4a0fee4ee86e2129600b5474112 Mon Sep 17 00:00:00 2001 From: Romain Floreani Date: Tue, 4 Aug 2026 16:52:58 -0400 Subject: [PATCH 5/5] chore: normalize line endings to LF --- .github/workflows/dependabot-auto-merge.yml | 28 ++++++++++----------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index f0b20daec..653fc15c3 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -1,14 +1,14 @@ -name: Dependabot auto-merge - -on: - pull_request_target: # zizmor: ignore[dangerous-triggers] no checkout, no execution of PR-authored code; only trusted event context is read - types: [opened, synchronize, reopened] - -jobs: - call-workflow-dependabot-auto-merge: - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@DEVOPS-1061 - permissions: - contents: write - pull-requests: write - with: - dependabot-group: mirageo-ci-tools +name: Dependabot auto-merge + +on: + pull_request_target: # zizmor: ignore[dangerous-triggers] no checkout, no execution of PR-authored code; only trusted event context is read + types: [opened, synchronize, reopened] + +jobs: + call-workflow-dependabot-auto-merge: + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@DEVOPS-1061 + permissions: + contents: write + pull-requests: write + with: + dependabot-group: mirageo-ci-tools