MNT/SEC: setup pre-commit + zizmor and address for security-related lints #494
+36
−11
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
neutrinoceros
commented
Dec 13, 2025
| merge-multiple: true | ||
|
|
||
| - uses: pypa/gh-action-pypi-publish@release/v1 | ||
| - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 # zizmor: ignore[use-trusted-publishing] |
Collaborator
Author
There was a problem hiding this comment.
Ideally we would also setup trusted publishing, but this requires clearance on the PyPI side, which I do not have, so I'm ignoring the rule for now.
neutrinoceros
force-pushed
the
zizmor
branch
from
146d781 to
9fdb324
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
use-trusted-publishinglint ruleThis will also set a fundation for migrating from flake8+black to ruff for Python linting and formatting through pre-commit.
Ideally I would like to set up
pre-commit.cias an external service, though I don't have sufficient permissions to do it on my own so I sent a request (but I'm unsure who's going to receive it). In the mean time I set up a GHA-based job to ensure it's run in CI.