From f4f869023f4393e64c863a1219e21fddcb90441a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 17:56:38 -0800 Subject: [PATCH 1/5] =?UTF-8?q?=F0=9F=91=B7=20ci:=20pin=20shared=20workflo?= =?UTF-8?q?ws=20to=20gw=206.4.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/news.yaml | 4 ++-- .github/workflows/prepare-release.yaml | 2 +- .github/workflows/release.yaml | 12 ++++++------ .github/workflows/scorecard.yaml | 2 +- .github/workflows/upgrade-release-tools.yaml | 2 +- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/news.yaml b/.github/workflows/news.yaml index 1a71c84..9aca015 100644 --- a/.github/workflows/news.yaml +++ b/.github/workflows/news.yaml @@ -22,9 +22,9 @@ jobs: python-version: "3.15" enable-cache: false - name: ๐Ÿ“ฆ Install locked release tools - uses: tox-dev/github-workflows/install-locked-tools@99024bcb5749b178c5514f86acfcf1e80c865e75 # 6.3.0 + uses: tox-dev/github-workflows/install-locked-tools@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 with: groups: release-news venv: ${{ runner.temp }}/release-tools - name: ๐Ÿ” Validate news fragments - uses: tox-dev/github-workflows/validate-news@99024bcb5749b178c5514f86acfcf1e80c865e75 # 6.3.0 + uses: tox-dev/github-workflows/validate-news@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 diff --git a/.github/workflows/prepare-release.yaml b/.github/workflows/prepare-release.yaml index 204f142..29ffc8d 100644 --- a/.github/workflows/prepare-release.yaml +++ b/.github/workflows/prepare-release.yaml @@ -12,7 +12,7 @@ permissions: {} jobs: prepare: name: ๐Ÿท๏ธ Prepare Towncrier release - uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 permissions: contents: read pull-requests: read diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 653a5ad..f50036a 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -10,7 +10,7 @@ concurrency: jobs: build: name: ๐Ÿ—๏ธ Build - uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 permissions: contents: read notes: @@ -33,17 +33,17 @@ jobs: python-version: "3.15" enable-cache: false - name: ๐Ÿ“ฆ Install locked release tools - uses: tox-dev/github-workflows/install-locked-tools@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/install-locked-tools@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 with: groups: release-notes venv: ${{ runner.temp }}/release-tools - name: ๐Ÿท๏ธ Select previous tag id: previous - uses: tox-dev/github-workflows/select-previous-tag@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/select-previous-tag@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 with: tag: ${{ github.ref_name }} - name: ๐Ÿ“ Render release notes - uses: tox-dev/github-workflows/render-release-notes@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/render-release-notes@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 with: tag: ${{ github.ref_name }} previous: ${{ steps.previous.outputs.previous }} @@ -101,13 +101,13 @@ jobs: artifact-ids: ${{ needs.notes.outputs.artifact-id }} path: ${{ runner.temp }} - name: ๐Ÿ” Verify PyPI artifacts - uses: tox-dev/github-workflows/reconcile-pypi-artifacts@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/reconcile-pypi-artifacts@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 with: project: python-discovery version: ${{ github.ref_name }} dist: dist - name: ๐Ÿš€ Publish GitHub release - uses: tox-dev/github-workflows/publish-github-release@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/publish-github-release@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 env: GH_TOKEN: ${{ github.token }} with: diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml index 525bd61..7db2360 100644 --- a/.github/workflows/scorecard.yaml +++ b/.github/workflows/scorecard.yaml @@ -23,4 +23,4 @@ jobs: pull-requests: read # read reviews for the Code-Review check security-events: write # upload the SARIF results to code scanning statuses: read # read commit statuses for the CI-Tests check - uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@cfb6d637a10b70da576575790eb3c806f57cd0b5 + uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 diff --git a/.github/workflows/upgrade-release-tools.yaml b/.github/workflows/upgrade-release-tools.yaml index ef33f41..72f4c8a 100644 --- a/.github/workflows/upgrade-release-tools.yaml +++ b/.github/workflows/upgrade-release-tools.yaml @@ -10,7 +10,7 @@ concurrency: jobs: upgrade: name: ๐Ÿ”€ Upgrade release tools - uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@57a765127aae73adf7d0e24a7fe0f067f2d3ea3e # 6.2.1 + uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 permissions: contents: read secrets: From fed228235e699c879e0eaf9e5776eb023f2bddef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 17:56:45 -0800 Subject: [PATCH 2/5] =?UTF-8?q?=F0=9F=91=B7=20ci:=20bump=20setup-uv=20to?= =?UTF-8?q?=20v10.3.3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/check.yaml | 4 ++-- .github/workflows/news.yaml | 2 +- .github/workflows/release.yaml | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml index 28b7a25..7e64c42 100644 --- a/.github/workflows/check.yaml +++ b/.github/workflows/check.yaml @@ -40,7 +40,7 @@ jobs: fetch-depth: 0 persist-credentials: false - name: ๐Ÿ Install uv - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: latest-known python-version: "3.15" @@ -69,7 +69,7 @@ jobs: fetch-depth: 0 persist-credentials: false - name: ๐Ÿ Install uv - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: latest-known python-version: "3.15" diff --git a/.github/workflows/news.yaml b/.github/workflows/news.yaml index 9aca015..70b7f1b 100644 --- a/.github/workflows/news.yaml +++ b/.github/workflows/news.yaml @@ -16,7 +16,7 @@ jobs: fetch-depth: 0 persist-credentials: false - name: ๐Ÿ Install uv - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: latest-known python-version: "3.15" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index f50036a..a8e0b40 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -27,7 +27,7 @@ jobs: fetch-depth: 0 persist-credentials: false - name: ๐Ÿ Install uv - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: latest-known python-version: "3.15" @@ -84,7 +84,7 @@ jobs: contents: write steps: - name: ๐Ÿ Install uv - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 + uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 with: version: latest-known python-version: "3.15" From b713ef9e86adf90bb0376c0432b023ba90d7a374 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 20:03:58 -0800 Subject: [PATCH 3/5] =?UTF-8?q?=F0=9F=91=B7=20ci:=20run=20check=20and=20Co?= =?UTF-8?q?deQL=20through=20gw=206.5.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Move the tox matrix and the CodeQL analysis onto the shared check and CodeQL workflows so every tox library runs the same test and analysis steps. The old-target job stays local because it builds the wheel and checks interpreter discovery, which only this project needs. The caller keeps its triggers, its schedule, and the gate job name that branch protection requires. --- .github/workflows/check.yaml | 69 ++++++++++++----------------------- .github/workflows/codeql.yaml | 29 +++------------ 2 files changed, 28 insertions(+), 70 deletions(-) diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml index 7e64c42..1c972a2 100644 --- a/.github/workflows/check.yaml +++ b/.github/workflows/check.yaml @@ -16,49 +16,25 @@ permissions: jobs: test: name: ๐Ÿงช Test - runs-on: ubuntu-26.04 - strategy: - fail-fast: false - matrix: - env: - - "3.15" - - "3.15t" - - "3.14" - - "3.13" - - "3.12" - - "3.11" - - "3.10" - - "3.9" - - type-3.9 - - type-3.15 - - dev - - pkg_meta - steps: - - name: ๐Ÿ“ฅ Check out code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - persist-credentials: false - - name: ๐Ÿ Install uv - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 - with: - version: latest-known - python-version: "3.15" - enable-cache: false - cache-dependency-glob: "pyproject.toml" - github-token: ${{ secrets.GITHUB_TOKEN }} - - name: ๐Ÿ“ฆ Install tox - run: uv tool install --python-preference only-managed --python 3.15 tox --with tox-uv - - name: ๐Ÿ Install Python - if: startsWith(matrix.env, '3.') && matrix.env != '3.15' - run: uv python install --python-preference only-managed ${{ matrix.env }} - - name: ๐Ÿ“ฆ Set up test suite - run: tox run -vv --notest --skip-missing-interpreters false -e ${{ matrix.env }} - - name: ๐Ÿงช Run test suite - run: tox run --skip-pkg-install -e ${{ matrix.env }} - env: - PYTEST_ADDOPTS: "-vv --durations=20" - DIFF_AGAINST: HEAD + uses: tox-dev/github-workflows/.github/workflows/check.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 + permissions: + contents: read + with: + include: | + [ + {"env": "3.15"}, + {"env": "3.15t", "python": "3.15t"}, + {"env": "3.14", "python": "3.14"}, + {"env": "3.13", "python": "3.13"}, + {"env": "3.12", "python": "3.12"}, + {"env": "3.11", "python": "3.11"}, + {"env": "3.10", "python": "3.10"}, + {"env": "3.9", "python": "3.9"}, + {"env": "type-3.9"}, + {"env": "type-3.15"}, + {"env": "dev"}, + {"env": "pkg_meta"} + ] old-target: name: ๐Ÿงช Test on old target runs-on: ubuntu-26.04 @@ -92,8 +68,9 @@ jobs: if: ${{ !cancelled() }} # codespell:ignore cancelled needs: [test, old-target] runs-on: ubuntu-26.04 + permissions: {} steps: - name: ๐Ÿšฆ Require all needed jobs to pass - env: - NEEDS_JSON: ${{ toJSON(needs) }} - run: jq -e 'all(to_entries[]; .value.result == "success")' <<<"$NEEDS_JSON" + uses: tox-dev/github-workflows/required-checks@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 + with: + needs: ${{ toJSON(needs) }} diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 8613bb5..a3ec67d 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -12,30 +12,11 @@ concurrency: permissions: {} jobs: analyze: - name: ๐Ÿ›ก๏ธ Analyze ${{ matrix.language }} - runs-on: ubuntu-26.04 + name: ๐Ÿ›ก๏ธ Analyze + uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 permissions: contents: read security-events: write - strategy: - fail-fast: false - matrix: - language: [actions, python] - steps: - - name: ๐Ÿ“ฅ Check out code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - name: ๐Ÿ›ก๏ธ Initialize CodeQL - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - with: - languages: ${{ matrix.language }} - build-mode: none - queries: security-extended - config: | - paths-ignore: - - tests - - name: ๐Ÿ›ก๏ธ Analyze - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - with: - category: "/language:${{ matrix.language }}" + with: + languages: '["actions","python"]' + paths-ignore: '["tests"]' From b8b023a5ef51e8e7c88a6208c99ae2aa4ff4d98b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 20:03:58 -0800 Subject: [PATCH 4/5] =?UTF-8?q?=F0=9F=91=B7=20ci(release):=20use=20shared?= =?UTF-8?q?=20release=20reusables?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The shared release notes and GitHub Release workflows replace the local notes and release jobs, which repeated the same reconciliation steps. The PyPI upload stays in the caller because trusted publishing cannot run inside a reusable workflow. --- .github/workflows/release.yaml | 89 ++++++---------------------------- 1 file changed, 14 insertions(+), 75 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index a8e0b40..78f5d72 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -10,52 +10,18 @@ concurrency: jobs: build: name: ๐Ÿ—๏ธ Build - uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 permissions: contents: read notes: name: ๐Ÿ“ Render GitHub Release notes - runs-on: ubuntu-26.04 + uses: tox-dev/github-workflows/.github/workflows/release-notes.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 permissions: contents: read - outputs: - artifact-id: ${{ steps.upload.outputs.artifact-id }} - steps: - - name: ๐Ÿ“ฅ Check out code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - persist-credentials: false - - name: ๐Ÿ Install uv - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 - with: - version: latest-known - python-version: "3.15" - enable-cache: false - - name: ๐Ÿ“ฆ Install locked release tools - uses: tox-dev/github-workflows/install-locked-tools@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 - with: - groups: release-notes - venv: ${{ runner.temp }}/release-tools - - name: ๐Ÿท๏ธ Select previous tag - id: previous - uses: tox-dev/github-workflows/select-previous-tag@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 - with: - tag: ${{ github.ref_name }} - - name: ๐Ÿ“ Render release notes - uses: tox-dev/github-workflows/render-release-notes@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 - with: - tag: ${{ github.ref_name }} - previous: ${{ steps.previous.outputs.previous }} - changelog: docs/changelog.rst - artifact-url: https://pypi.org/project/python-discovery/${{ github.ref_name }}/ - - name: ๐Ÿ“ค Upload release notes - id: upload - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 - with: - name: release-notes - path: ${{ runner.temp }}/release-notes.md - if-no-files-found: error + with: + tag: ${{ github.ref_name }} + changelog: docs/changelog.rst + artifact-url: https://pypi.org/project/python-discovery/${{ github.ref_name }}/ release: name: ๐Ÿš€ Publish to PyPI needs: [build, notes] @@ -78,40 +44,13 @@ jobs: github-release: name: ๐Ÿš€ Publish GitHub Release needs: [build, notes, release] - runs-on: ubuntu-26.04 - environment: release + uses: tox-dev/github-workflows/.github/workflows/github-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 permissions: contents: write - steps: - - name: ๐Ÿ Install uv - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 - with: - version: latest-known - python-version: "3.15" - enable-cache: false - ignore-empty-workdir: true - - name: ๐Ÿ“ฉ Download distributions - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 - with: - artifact-ids: ${{ needs.build.outputs.distributions-artifact-id }} - path: dist/ - - name: ๐Ÿ“ฉ Download release notes - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 - with: - artifact-ids: ${{ needs.notes.outputs.artifact-id }} - path: ${{ runner.temp }} - - name: ๐Ÿ” Verify PyPI artifacts - uses: tox-dev/github-workflows/reconcile-pypi-artifacts@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 - with: - project: python-discovery - version: ${{ github.ref_name }} - dist: dist - - name: ๐Ÿš€ Publish GitHub release - uses: tox-dev/github-workflows/publish-github-release@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 - env: - GH_TOKEN: ${{ github.token }} - with: - tag: ${{ github.ref_name }} - commit: ${{ github.sha }} - title: v${{ github.ref_name }} - notes-file: ${{ runner.temp }}/release-notes.md + with: + project: python-discovery + version: ${{ github.ref_name }} + tag: ${{ github.ref_name }} + artifact-pattern: python-package-distributions + notes-artifact-id: ${{ needs.notes.outputs.artifact-id }} + title-prefix: v From ee3a0c558aff7a37b20d064e2d3f4ab18756b017 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= Date: Tue, 3 Nov 2026 20:03:58 -0800 Subject: [PATCH 5/5] =?UTF-8?q?=F0=9F=91=B7=20ci:=20pin=20github-workflows?= =?UTF-8?q?=20to=206.5.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/news.yaml | 4 ++-- .github/workflows/prepare-release.yaml | 2 +- .github/workflows/scorecard.yaml | 2 +- .github/workflows/upgrade-release-tools.yaml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/news.yaml b/.github/workflows/news.yaml index 70b7f1b..88f1eb4 100644 --- a/.github/workflows/news.yaml +++ b/.github/workflows/news.yaml @@ -22,9 +22,9 @@ jobs: python-version: "3.15" enable-cache: false - name: ๐Ÿ“ฆ Install locked release tools - uses: tox-dev/github-workflows/install-locked-tools@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/install-locked-tools@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 with: groups: release-news venv: ${{ runner.temp }}/release-tools - name: ๐Ÿ” Validate news fragments - uses: tox-dev/github-workflows/validate-news@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/validate-news@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 diff --git a/.github/workflows/prepare-release.yaml b/.github/workflows/prepare-release.yaml index 29ffc8d..ff82588 100644 --- a/.github/workflows/prepare-release.yaml +++ b/.github/workflows/prepare-release.yaml @@ -12,7 +12,7 @@ permissions: {} jobs: prepare: name: ๐Ÿท๏ธ Prepare Towncrier release - uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 permissions: contents: read pull-requests: read diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml index 7db2360..99f5a28 100644 --- a/.github/workflows/scorecard.yaml +++ b/.github/workflows/scorecard.yaml @@ -23,4 +23,4 @@ jobs: pull-requests: read # read reviews for the Code-Review check security-events: write # upload the SARIF results to code scanning statuses: read # read commit statuses for the CI-Tests check - uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 diff --git a/.github/workflows/upgrade-release-tools.yaml b/.github/workflows/upgrade-release-tools.yaml index 72f4c8a..77a9837 100644 --- a/.github/workflows/upgrade-release-tools.yaml +++ b/.github/workflows/upgrade-release-tools.yaml @@ -10,7 +10,7 @@ concurrency: jobs: upgrade: name: ๐Ÿ”€ Upgrade release tools - uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@534a196a132a52365c464e1227d4c46f30968f29 # 6.4.0 + uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0 permissions: contents: read secrets: