Skip to content

Commit 374367f

Browse files
nashifnashif
committed
ci: workflows: pin python dependencies
Pin python dependencies to hashes and cleanup/unify python setup steps in various workflows. We now have one dependency file containing all requirements for github actions that is managed centrally with hashes. No direct pip installs are needed in workflow files and everything shall go via the requirements file. Pinning to specific version and hashes helps with preventing supply chain attacks. Signed-off-by: Anas Nashif <[email protected]>
1 parent bc5a60c commit 374367f

22 files changed

+1535
-153
lines changed

‎.github/workflows/assigner.yml

+11-4
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,20 @@ jobs:
2828
issues: write # to add assignees to issues
2929

3030
steps:
31-
- name: Install Python dependencies
32-
run: |
33-
pip install -U PyGithub>=1.55 west
34-
3531
- name: Check out source code
3632
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3733

34+
- name: Set up Python
35+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
36+
with:
37+
python-version: 3.12
38+
cache: pip
39+
cache-dependency-path: scripts/requirements-actions.txt
40+
41+
- name: install-packages
42+
run: |
43+
pip install -r scripts/requirements-actions.txt --require-hashes
44+
3845
- name: Run assignment script
3946
env:
4047
GITHUB_TOKEN: ${{ secrets.ZB_GITHUB_TOKEN }}

‎.github/workflows/backport_issue_check.yml

+13-6
Original file line numberDiff line numberDiff line change
@@ -28,16 +28,23 @@ jobs:
2828
- name: Check out source code
2929
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3030

31-
- name: Install Python dependencies
31+
- name: Set up Python
32+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
33+
with:
34+
python-version: 3.12
35+
cache: pip
36+
cache-dependency-path: scripts/requirements-actions.txt
37+
38+
- name: install-packages
3239
run: |
33-
pip install -U pygithub
40+
pip install -r scripts/requirements-actions.txt --require-hashes
3441
3542
- name: Run backport issue checker
3643
env:
3744
GITHUB_TOKEN: ${{ secrets.ZB_GITHUB_TOKEN }}
3845
run: |
3946
./scripts/release/list_backports.py \
40-
-o ${{ github.event.repository.owner.login }} \
41-
-r ${{ github.event.repository.name }} \
42-
-b ${{ github.event.pull_request.base.ref }} \
43-
-p ${{ github.event.pull_request.number }}
47+
-o ${{ github.event.repository.owner.login }} \
48+
-r ${{ github.event.repository.name }} \
49+
-b ${{ github.event.pull_request.base.ref }} \
50+
-p ${{ github.event.pull_request.number }}

‎.github/workflows/bsim-tests.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,6 @@ jobs:
178178
179179
- name: Merge Test Results
180180
run: |
181-
pip install junitparser junit2html
182181
junitparser merge --glob "./bsim_*/*bsim_results.*.xml" "./twister-out/twister.xml" junit.xml
183182
junit2html junit.xml junit.html
184183

‎.github/workflows/bug_snapshot.yaml

+10-2
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,17 @@ jobs:
2626
- name: Checkout
2727
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2828

29-
- name: Install Python dependencies
29+
- name: Set up Python
30+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
31+
with:
32+
python-version: 3.12
33+
cache: pip
34+
cache-dependency-path: scripts/requirements-actions.txt
35+
36+
- name: install-packages
3037
run: |
31-
pip install -U pygithub
38+
pip install -r scripts/requirements-actions.txt --require-hashes
39+
3240
3341
- name: Snapshot bugs
3442
env:

‎.github/workflows/clang.yaml

+18-1
Original file line numberDiff line numberDiff line change
@@ -135,13 +135,30 @@ jobs:
135135
checks: write # to create GitHub annotations
136136
if: (success() || failure())
137137
steps:
138+
- name: Checkout
139+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
140+
with:
141+
fetch-depth: 0
142+
persist-credentials: false
143+
138144
- name: Download Artifacts
139145
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
140146
with:
141147
path: artifacts
148+
149+
- name: Set up Python
150+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
151+
with:
152+
python-version: 3.12
153+
cache: pip
154+
cache-dependency-path: scripts/requirements-actions.txt
155+
156+
- name: install-packages
157+
run: |
158+
pip install -r scripts/requirements-actions.txt --require-hashes
159+
142160
- name: Merge Test Results
143161
run: |
144-
pip install junitparser junit2html
145162
junitparser merge artifacts/*/twister.xml junit.xml
146163
junit2html junit.xml junit-clang.html
147164

‎.github/workflows/codecov.yaml

+11-3
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,6 @@ jobs:
104104
export ZEPHYR_BASE=${PWD}
105105
export ZEPHYR_TOOLCHAIN_VARIANT=zephyr
106106
mkdir -p coverage/reports
107-
pip install gcovr==6.0
108107
./scripts/twister -E ${{matrix.normalized}}-testplan.json
109108
ls -la
110109
./scripts/twister \
@@ -144,6 +143,17 @@ jobs:
144143
with:
145144
fetch-depth: 0
146145

146+
- name: Set up Python
147+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
148+
with:
149+
python-version: 3.12
150+
cache: pip
151+
cache-dependency-path: scripts/requirements-actions.txt
152+
153+
- name: install-packages
154+
run: |
155+
pip install -r scripts/requirements-actions.txt --require-hashes
156+
147157
- name: Download Artifacts
148158
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
149159
with:
@@ -185,7 +195,6 @@ jobs:
185195
- name: Merge coverage files
186196
run: |
187197
pushd ./coverage/reports
188-
pip install gcovr==6.0
189198
gcovr ${{ steps.get-coverage-files.outputs.mergefiles }} --merge-mode-functions=separate --json merged.json
190199
gcovr ${{ steps.get-coverage-files.outputs.mergefiles }} --merge-mode-functions=separate --cobertura merged.xml
191200
popd
@@ -201,7 +210,6 @@ jobs:
201210
- name: Generate Coverage Report
202211
if: always()
203212
run: |
204-
pip install xlsxwriter ijson
205213
python3 ./scripts/ci/coverage/coverage_analysis.py \
206214
-t native_sim-testplan.json \
207215
-m MAINTAINERS.yml \

‎.github/workflows/coding_guidelines.yml

+7-7
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,16 @@ jobs:
1616
ref: ${{ github.event.pull_request.head.sha }}
1717
fetch-depth: 0
1818

19-
- name: cache-pip
20-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
19+
- name: Set up Python
20+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
2121
with:
22-
path: ~/.cache/pip
23-
key: ${{ runner.os }}-pip-${{ hashFiles('.github/workflows/coding_guidelines.yml') }}
22+
python-version: 3.12
23+
cache: pip
24+
cache-dependency-path: scripts/requirements-actions.txt
2425

25-
- name: Install python dependencies
26+
- name: install-packages
2627
run: |
27-
pip install unidiff
28-
pip install sh
28+
pip install -r scripts/requirements-actions.txt --require-hashes
2929
3030
- name: Install Packages
3131
run: |

‎.github/workflows/compliance.yml

+5-10
Original file line numberDiff line numberDiff line change
@@ -46,18 +46,13 @@ jobs:
4646
- name: Set up Python
4747
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
4848
with:
49-
python-version: 3.11
49+
python-version: 3.12
50+
cache: pip
51+
cache-dependency-path: scripts/requirements-actions.txt
5052

51-
- name: cache-pip
52-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
53-
with:
54-
path: ~/.cache/pip
55-
key: ${{ runner.os }}-pip-${{ hashFiles('.github/workflows/compliance.yml') }}
56-
57-
- name: Install python dependencies
53+
- name: install-packages
5854
run: |
59-
pip install -r scripts/requirements-compliance.txt
60-
pip install west
55+
pip install -r scripts/requirements-actions.txt --require-hashes
6156
6257
- name: west setup
6358
run: |

‎.github/workflows/daily_test_version.yml

+11-4
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,22 @@ jobs:
2626
aws-secret-access-key: ${{ secrets.AWS_TESTING_SECRET_ACCESS_KEY }}
2727
aws-region: us-east-1
2828

29-
- name: install-pip
30-
run: |
31-
pip install gitpython
32-
3329
- name: checkout
3430
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3531
with:
3632
fetch-depth: 0
3733

34+
- name: Set up Python
35+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
36+
with:
37+
python-version: 3.12
38+
cache: pip
39+
cache-dependency-path: scripts/requirements-actions.txt
40+
41+
- name: install-packages
42+
run: |
43+
pip install -r scripts/requirements-actions.txt --require-hashes
44+
3845
- name: Upload to AWS S3
3946
run: |
4047
python3 scripts/ci/version_mgr.py --update .

‎.github/workflows/devicetree_checks.yml

+7-27
Original file line numberDiff line numberDiff line change
@@ -34,38 +34,18 @@ jobs:
3434
steps:
3535
- name: checkout
3636
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
37+
3738
- name: Set up Python ${{ matrix.python-version }}
3839
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
3940
with:
4041
python-version: ${{ matrix.python-version }}
41-
- name: cache-pip-linux
42-
if: startsWith(runner.os, 'Linux')
43-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
44-
with:
45-
path: ~/.cache/pip
46-
key: ${{ runner.os }}-pip-${{ matrix.python-version }}
47-
restore-keys: |
48-
${{ runner.os }}-pip-${{ matrix.python-version }}
49-
- name: cache-pip-mac
50-
if: startsWith(runner.os, 'macOS')
51-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
52-
with:
53-
path: ~/Library/Caches/pip
54-
# Trailing '-' was just to get a different cache name
55-
key: ${{ runner.os }}-pip-${{ matrix.python-version }}-
56-
restore-keys: |
57-
${{ runner.os }}-pip-${{ matrix.python-version }}-
58-
- name: cache-pip-win
59-
if: startsWith(runner.os, 'Windows')
60-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
61-
with:
62-
path: ~\AppData\Local\pip\Cache
63-
key: ${{ runner.os }}-pip-${{ matrix.python-version }}
64-
restore-keys: |
65-
${{ runner.os }}-pip-${{ matrix.python-version }}
66-
- name: install python dependencies
42+
cache: pip
43+
cache-dependency-path: scripts/requirements-actions.txt
44+
45+
- name: install-packages
6746
run: |
68-
pip install pytest pyyaml tox
47+
pip install -r scripts/requirements-actions.txt --require-hashes
48+
6949
- name: run tox
7050
working-directory: scripts/dts/python-devicetree
7151
run: |

‎.github/workflows/footprint-tracking.yml

+11-3
Original file line numberDiff line numberDiff line change
@@ -61,14 +61,24 @@ jobs:
6161
run: |
6262
sudo apt-get update
6363
sudo apt-get install -y python3-venv
64-
pip install -U gitpython
6564
6665
- name: checkout
6766
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6867
with:
6968
ref: ${{ github.event.pull_request.head.sha }}
7069
fetch-depth: 0
7170

71+
- name: Set up Python
72+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
73+
with:
74+
python-version: 3.12
75+
cache: pip
76+
cache-dependency-path: scripts/requirements-actions.txt
77+
78+
- name: install-packages
79+
run: |
80+
pip install -r scripts/requirements-actions.txt --require-hashes
81+
7282
- name: Environment Setup
7383
run: |
7484
echo "ZEPHYR_SDK_INSTALL_DIR=/opt/toolchains/zephyr-sdk-$( cat SDK_VERSION )" >> $GITHUB_ENV
@@ -97,7 +107,6 @@ jobs:
97107
run: |
98108
python3 -m venv .venv
99109
. .venv/bin/activate
100-
pip install awscli
101110
aws s3 sync --quiet footprint_data/ s3://testing.zephyrproject.org/footprint_data/
102111
103112
- name: Transform Footprint data to Twister JSON reports
@@ -116,7 +125,6 @@ jobs:
116125
ELASTICSEARCH_INDEX: ${{ vars.FOOTPRINT_TRACKING_INDEX }}
117126
run: |
118127
shopt -s globstar
119-
pip install -U elasticsearch
120128
run_date=`date --iso-8601=minutes`
121129
python3 ./scripts/ci/upload_test_results_es.py -r ${run_date} \
122130
--flatten footprint \

‎.github/workflows/manifest.yml

+12-1
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,23 @@ jobs:
2020
fetch-depth: 0
2121
persist-credentials: false
2222

23+
- name: Set up Python
24+
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
25+
with:
26+
python-version: 3.12
27+
cache: pip
28+
cache-dependency-path: scripts/requirements-actions.txt
29+
30+
- name: install-packages
31+
run: |
32+
cd zephyrproject/zephyr
33+
pip install -r scripts/requirements-actions.txt --require-hashes
34+
2335
- name: west setup
2436
env:
2537
BASE_REF: ${{ github.base_ref }}
2638
working-directory: zephyrproject/zephyr
2739
run: |
28-
pip install west
2940
git config --global user.email "[email protected]"
3041
git config --global user.name "Your Name"
3142
west init -l . || true

‎.github/workflows/pylib_tests.yml

+5-9
Original file line numberDiff line numberDiff line change
@@ -33,21 +33,17 @@ jobs:
3333
steps:
3434
- name: checkout
3535
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
36+
3637
- name: Set up Python ${{ matrix.python-version }}
3738
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
3839
with:
3940
python-version: ${{ matrix.python-version }}
40-
- name: cache-pip-linux
41-
if: startsWith(runner.os, 'Linux')
42-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
43-
with:
44-
path: ~/.cache/pip
45-
key: ${{ runner.os }}-pip-${{ matrix.python-version }}
46-
restore-keys: |
47-
${{ runner.os }}-pip-${{ matrix.python-version }}
41+
cache: pip
42+
cache-dependency-path: scripts/requirements-actions.txt
43+
4844
- name: install-packages
4945
run: |
50-
pip install -r scripts/requirements-base.txt -r scripts/requirements-build-test.txt
46+
pip install -r scripts/requirements-actions.txt --require-hashes
5147
- name: Run pytest for build_helpers
5248
env:
5349
ZEPHYR_BASE: ./

0 commit comments

Comments
 (0)