Skip to content

Commit b145585

Browse files
Gobot1234Gobot1234
authored
Merge branch 'main' into main
2 parents c5800c4 + c1ffc2f commit b145585

36 files changed

+444
-189
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 58 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@ concurrency:
1616
cancel-in-progress: true
1717

1818
permissions:
19-
contents: write
19+
contents: read
2020
packages: read
21-
pull-requests: write
22-
issues: write
21+
pull-requests: read
22+
issues: read
2323

2424
env:
2525
API_CODE_CACHE: 6
@@ -41,10 +41,12 @@ jobs:
4141
name: "Add license headers"
4242
runs-on: ubuntu-latest
4343
steps:
44-
- uses: actions/checkout@v5
44+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
45+
with:
46+
persist-credentials: false
4547

4648
- name: Set up Python
47-
uses: actions/setup-python@v6
49+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
4850
with:
4951
python-version: ${{ env.MAIN_PYTHON_VERSION }}
5052

@@ -117,7 +119,7 @@ jobs:
117119

118120
check-vulnerabilities:
119121
name: "Check library vulnerabilities"
120-
runs-on: ubuntu-22.04
122+
runs-on: ubuntu-latest
121123
steps:
122124
- uses: ansys/actions/check-vulnerabilities@main
123125
with:
@@ -129,6 +131,16 @@ jobs:
129131
hide-log: false
130132
bandit-configfile: "pyproject.toml"
131133

134+
actions-security:
135+
name: "Actions Security"
136+
runs-on: ubuntu-latest
137+
steps:
138+
- uses: ansys/actions/check-actions-security@c2fa7c93f6883114e0e643599431b33d29f0b13f # v10.1.4
139+
with:
140+
generate-summary: true
141+
token: ${{ secrets.GITHUB_TOKEN }}
142+
auditing-level: 'high'
143+
132144
docs_build:
133145
name: Build Documentation
134146
needs: [docs-style]
@@ -138,10 +150,12 @@ jobs:
138150
PYFLUENT_CONTAINER_MOUNT_SOURCE: "/home/ansys/Downloads/ansys_fluent_core_examples"
139151

140152
steps:
141-
- uses: actions/checkout@v5
153+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
154+
with:
155+
persist-credentials: false
142156

143157
- name: Setup Python
144-
uses: actions/setup-python@v6
158+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
145159
with:
146160
python-version: ${{ env.PYTHON_VERSION }}
147161

@@ -151,12 +165,13 @@ jobs:
151165
sudo apt-get install pandoc libegl1 make xvfb libfontconfig1 libxrender1 libxkbcommon-x11-0 -y
152166
153167
- name: Cache pip
154-
uses: actions/cache@v4
168+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
155169
with:
156170
path: ~/.cache/pip
157171
key: Python-${{ runner.os }}-${{ env.PYTHON_VERSION }}-${{ hashFiles('pyproject.toml') }}
158172
restore-keys: |
159173
Python-${{ runner.os }}-${{ env.PYTHON_VERSION }}
174+
lookup-only: false # zizmor: ignore[cache-poisoning]
160175

161176
- name: Install Quarto
162177
uses: quarto-dev/quarto-actions/setup@9e48da27e184aa238fcb49f5db75469626d43adb # v2.1.9
@@ -186,12 +201,13 @@ jobs:
186201
id: version
187202

188203
- name: Cache API Code
189-
uses: actions/cache@v4
204+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
190205
id: cache-api-code
191206
with:
192207
path: |
193208
src/ansys/fluent/core/generated
194209
key: API-Code-v${{ env.API_CODE_CACHE }}-${{ steps.version.outputs.PYFLUENT_VERSION }}-${{ env.DOC_DEPLOYMENT_IMAGE_TAG }}-${{ hashFiles('src/ansys/fluent/core/codegen/**') }}
210+
lookup-only: false # zizmor: ignore[cache-poisoning]
195211

196212
- name: Login to GitHub Container Registry
197213
if: steps.cache-api-code.outputs.cache-hit != 'true'
@@ -227,14 +243,16 @@ jobs:
227243
FLUENT_IMAGE_TAG: ${{ env.DOC_DEPLOYMENT_IMAGE_TAG }}
228244

229245
- name: Zip HTML Documentation before upload
246+
env:
247+
DOC_DEPLOYMENT_IMG: ${{ env.DOC_DEPLOYMENT_IMAGE_TAG }}
230248
run: |
231249
sudo apt install zip -y
232250
pushd doc/_build/html
233-
zip -r ../../../HTML-Documentation-tag-${{ env.DOC_DEPLOYMENT_IMAGE_TAG }}.zip .
251+
zip -r ../../../HTML-Documentation-tag-${DOC_DEPLOYMENT_IMG}.zip .
234252
popd
235253
236254
- name: Upload HTML Documentation
237-
uses: actions/upload-artifact@v4
255+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
238256
with:
239257
name: HTML-Documentation-tag-${{ env.DOC_DEPLOYMENT_IMAGE_TAG }}
240258
path: HTML-Documentation-tag-${{ env.DOC_DEPLOYMENT_IMAGE_TAG }}.zip
@@ -250,20 +268,23 @@ jobs:
250268
runs-on: [self-hosted, pyfluent]
251269

252270
steps:
253-
- uses: actions/checkout@v5
271+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
272+
with:
273+
persist-credentials: false
254274

255275
- name: Setup Python
256-
uses: actions/setup-python@v6
276+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
257277
with:
258278
python-version: ${{ env.MAIN_PYTHON_VERSION }}
259279

260280
- name: Cache pip
261-
uses: actions/cache@v4
281+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
262282
with:
263283
path: ~/.cache/pip
264284
key: Python-${{ runner.os }}-${{ env.MAIN_PYTHON_VERSION }}-${{ hashFiles('pyproject.toml') }}
265285
restore-keys: |
266286
Python-${{ runner.os }}-${{ env.MAIN_PYTHON_VERSION }}
287+
lookup-only: false # zizmor: ignore[cache-poisoning]
267288

268289
- name: Add version information
269290
run: make version-info
@@ -285,13 +306,14 @@ jobs:
285306
password: ${{ secrets.GITHUB_TOKEN }}
286307

287308
- name: Cache API Code
288-
uses: actions/cache@v4
309+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
289310
id: cache-api-code
290311
with:
291312
path: src/ansys/fluent/core/generated
292313
# Combined cache key for all versions:
293314
# API-Code-<Cache version>-<PyFluent version>-<First Fluent release version>-<Last Fluent release version>-<Fluent dev version>-<Hash of codegen files>
294315
key: API-Code-v${{ env.API_CODE_CACHE }}-${{ steps.version.outputs.PYFLUENT_VERSION }}-v23.1.0-v25.2.0-${{ vars.FLUENT_STABLE_IMAGE_DEV }}-${{ hashFiles('src/ansys/fluent/core/codegen/**') }}
316+
lookup-only: false # zizmor: ignore[cache-poisoning]
295317

296318
- name: Pull 23.1 Fluent docker image
297319
if: steps.cache-api-code.outputs.cache-hit != 'true'
@@ -453,7 +475,7 @@ jobs:
453475
twine check dist/*
454476
455477
- name: Upload package
456-
uses: actions/upload-artifact@v4
478+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
457479
with:
458480
name: PyFluent-packages
459481
path: |
@@ -493,17 +515,19 @@ jobs:
493515
FLUENT_IMAGE_TAG: ${{ matrix.version == 261 && vars.FLUENT_STABLE_IMAGE_DEV || matrix.image-tag }}
494516

495517
steps:
496-
- uses: actions/checkout@v5
518+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
519+
with:
520+
persist-credentials: false
497521

498522
- name: Setup Python
499523
if: ${{ !contains(github.event.pull_request.title, '[skip tests]') }}
500-
uses: actions/setup-python@v6
524+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
501525
with:
502526
python-version: ${{ env.MAIN_PYTHON_VERSION }}
503527

504528
- name: Download package
505529
if: ${{ !contains(github.event.pull_request.title, '[skip tests]') }}
506-
uses: actions/download-artifact@v5
530+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
507531
with:
508532
name: PyFluent-packages
509533
path: dist
@@ -533,17 +557,19 @@ jobs:
533557

534558
- name: Unit Testing
535559
if: ${{ !contains(github.event.pull_request.title, '[skip tests]') }}
560+
env:
561+
MATRIX_VERSION: ${{ matrix.version }}
536562
run: |
537563
make install-test
538-
make unittest-dev-${{ matrix.version }}
564+
make unittest-dev-${MATRIX_VERSION}
539565
540566
- name: Cleanup previous docker containers
541567
if: always()
542568
run: make cleanup-previous-docker-containers
543569

544570
- name: Upload 25.2 Coverage Artifacts
545571
if: matrix.image-tag == 'v25.2.0'
546-
uses: actions/upload-artifact@v4
572+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
547573
with:
548574
name: coverage_report
549575
path: ./htmlcov
@@ -560,20 +586,23 @@ jobs:
560586
PYTEST_XDIST_AUTO_NUM_WORKERS: 1
561587

562588
steps:
563-
- uses: actions/checkout@v5
589+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
590+
with:
591+
persist-credentials: false
564592

565593
- name: Setup Python
566-
uses: actions/setup-python@v6
594+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
567595
with:
568596
python-version: ${{ env.MAIN_PYTHON_VERSION }}
569597

570598
- name: Cache pip
571-
uses: actions/cache@v4
599+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
572600
with:
573601
path: ~/.cache/pip
574602
key: Python-${{ runner.os }}-${{ matrix.python-version }}-${{ hashFiles('pyproject.toml') }}
575603
restore-keys: |
576604
Python-${{ runner.os }}-${{ matrix.python-version }}
605+
lookup-only: false # zizmor: ignore[cache-poisoning]
577606

578607
- name: Add version information
579608
run: make version-info
@@ -640,7 +669,7 @@ jobs:
640669

641670
steps:
642671
- name: Set up Python
643-
uses: actions/setup-python@v6
672+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
644673
with:
645674
python-version: ${{ env.MAIN_PYTHON_VERSION }}
646675

@@ -658,21 +687,21 @@ jobs:
658687
TWINE_REPOSITORY_URL: https://pkgs.dev.azure.com/pyansys/_packaging/pyansys/pypi/upload
659688

660689
- name: "Download the library artifacts from build-library step"
661-
uses: actions/download-artifact@v5
690+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
662691
with:
663692
name: PyFluent-packages
664693
path: PyFluent-packages
665694

666695
- name: "Upload artifacts to PyPI using trusted publisher"
667-
uses: pypa/[email protected]
696+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
668697
with:
669698
repository-url: "https://upload.pypi.org/legacy/"
670699
print-hash: true
671700
packages-dir: PyFluent-packages
672701
skip-existing: false
673702

674703
- name: Release
675-
uses: softprops/action-gh-release@v2
704+
uses: softprops/action-gh-release@aec2ec56f94eb8180ceec724245f64ef008b89f5 # v2.4.0
676705
with:
677706
files: |
678707
./**/*.whl

‎.github/workflows/codeql.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
name: "CodeQL"
22

3+
permissions:
4+
contents: read
5+
security-events: read
6+
actions: read
7+
38
on:
49
push:
510
branches: [ "main", "release/*" ]
@@ -19,10 +24,6 @@ jobs:
1924
# Consider using larger runners for possible analysis time improvements.
2025
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
2126
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
22-
permissions:
23-
actions: read
24-
contents: read
25-
security-events: write
2627

2728
strategy:
2829
fail-fast: false
@@ -35,11 +36,13 @@ jobs:
3536

3637
steps:
3738
- name: Checkout repository
38-
uses: actions/checkout@v5
39+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
40+
with:
41+
persist-credentials: false
3942

4043
# Initializes the CodeQL tools for scanning.
4144
- name: Initialize CodeQL
42-
uses: github/codeql-action/init@v3
45+
uses: github/codeql-action/init@e296a935590eb16afc0c0108289f68c87e2a89a5 # v4.30.7
4346
with:
4447
languages: ${{ matrix.language }}
4548
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -66,6 +69,6 @@ jobs:
6669
# ./location_of_script_within_repo/buildscript.sh
6770

6871
- name: Perform CodeQL Analysis
69-
uses: github/codeql-action/analyze@v3
72+
uses: github/codeql-action/analyze@e296a935590eb16afc0c0108289f68c87e2a89a5 # v4.30.7
7073
with:
7174
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,12 @@ permissions:
1212

1313
jobs:
1414
dependency-review:
15+
name: "Run Dependency Review"
1516
runs-on: ubuntu-latest
1617
steps:
1718
- name: 'Checkout Repository'
18-
uses: actions/checkout@v5
19+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
20+
with:
21+
persist-credentials: false
1922
- name: 'Dependency Review'
20-
uses: actions/dependency-review-action@v4
23+
uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0

‎.github/workflows/doc-build-dev-nightly.yml‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ on:
66
workflow_dispatch:
77

88
permissions:
9-
contents: write
9+
contents: read
1010
packages: read
11-
pull-requests: write
12-
issues: write
11+
pull-requests: read
12+
issues: read
1313

1414
env:
1515
DOCUMENTATION_CNAME: "fluent.docs.pyansys.com"
@@ -25,13 +25,16 @@ env:
2525

2626
jobs:
2727
build_dev_docs:
28+
name: "Build Documentation"
2829
runs-on: [self-hosted, pyfluent]
2930

3031
steps:
31-
- uses: actions/checkout@v5
32+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
33+
with:
34+
persist-credentials: false
3235

3336
- name: Setup Python
34-
uses: actions/setup-python@v6
37+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
3538
with:
3639
python-version: "3.11"
3740

@@ -105,14 +108,16 @@ jobs:
105108
BUILD_ALL_DOCS: 1
106109

107110
- name: Zip HTML Documentation before upload
111+
env:
112+
DOC_DEPLOYMENT_IMG: ${{ env.DOC_DEPLOYMENT_IMAGE_TAG }}
108113
run: |
109114
sudo apt install zip -y
110115
pushd doc/_build/html
111-
zip -r ../../../HTML-Documentation-tag-${{ env.DOC_DEPLOYMENT_IMAGE_TAG }}.zip .
116+
zip -r ../../../HTML-Documentation-tag-${DOC_DEPLOYMENT_IMG}.zip .
112117
popd
113118
114119
- name: Upload HTML Documentation
115-
uses: actions/upload-artifact@v4
120+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
116121
with:
117122
name: HTML-Documentation-tag-${{ env.DOC_DEPLOYMENT_IMAGE_TAG }}
118123
path: HTML-Documentation-tag-${{ env.DOC_DEPLOYMENT_IMAGE_TAG }}.zip
@@ -123,6 +128,7 @@ jobs:
123128
run: make docker-clean-images
124129

125130
deploy_dev_docs:
131+
name: "Deploy Documentation"
126132
runs-on: ubuntu-latest
127133
needs: [build_dev_docs]
128134
if: github.ref == 'refs/heads/main'

0 commit comments

Comments
 (0)