Skip to content

Commit bd430f3

Browse files
hoxbrohoxbro
committed
feat: Add zizmor
1 parent c69444a commit bd430f3

8 files changed

Lines changed: 136 additions & 50 deletions

File tree

‎.github/workflows/build.yaml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ on:
1010
schedule:
1111
- cron: "0 19 * * SUN"
1212

13+
permissions: {}
14+
15+
concurrency:
16+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
17+
cancel-in-progress: true
18+
1319
env:
1420
NODE_VERSION: "24"
1521
PACKAGE: "panel"
@@ -30,14 +36,14 @@ jobs:
3036
name: Pixi lock
3137
runs-on: ubuntu-latest
3238
steps:
33-
- uses: holoviz-dev/holoviz_tasks/pixi_lock@v0
39+
- uses: holoviz-dev/holoviz_tasks/pixi-lock@v1
3440

3541
conda_build:
3642
name: Build Conda
3743
needs: [pixi_lock]
3844
runs-on: "ubuntu-latest"
3945
steps:
40-
- uses: holoviz-dev/holoviz_tasks/pixi_install@v0
46+
- uses: holoviz-dev/holoviz_tasks/pixi-install@v1
4147
with:
4248
environments: "build"
4349
install: false
@@ -81,7 +87,7 @@ jobs:
8187
needs: [pixi_lock]
8288
runs-on: "ubuntu-latest"
8389
steps:
84-
- uses: holoviz-dev/holoviz_tasks/pixi_install@v0
90+
- uses: holoviz-dev/holoviz_tasks/pixi-install@v1
8591
with:
8692
environments: "build"
8793
install: false
@@ -136,7 +142,7 @@ jobs:
136142
needs: [pixi_lock]
137143
runs-on: "ubuntu-latest"
138144
steps:
139-
- uses: holoviz-dev/holoviz_tasks/pixi_install@v0
145+
- uses: holoviz-dev/holoviz_tasks/pixi-install@v1
140146
with:
141147
environments: "build"
142148
download-data: false
@@ -174,6 +180,7 @@ jobs:
174180
with:
175181
node-version: ${{ env.NODE_VERSION }}
176182
registry-url: "https://registry.npmjs.org"
183+
package-manager-cache: false
177184
- name: npm dev deploy
178185
if: contains(github.ref_name, 'a') || contains(github.ref_name, 'b') || contains(github.ref_name, 'rc')
179186
run: |
@@ -188,7 +195,7 @@ jobs:
188195
needs: [pixi_lock]
189196
runs-on: "ubuntu-latest"
190197
steps:
191-
- uses: holoviz-dev/holoviz_tasks/pixi_install@v0
198+
- uses: holoviz-dev/holoviz_tasks/pixi-install@v1
192199
with:
193200
environments: "build"
194201
install: false
@@ -217,6 +224,7 @@ jobs:
217224
- uses: actions/checkout@v6
218225
with:
219226
fetch-depth: "1"
227+
persist-credentials: false
220228
- uses: actions/download-artifact@v8
221229
with:
222230
name: cdn
@@ -239,6 +247,8 @@ jobs:
239247
TAG: ${{ github.ref_name }}
240248
steps:
241249
- uses: actions/checkout@v6
250+
with:
251+
persist-credentials: false
242252
- uses: actions/download-artifact@v8
243253
with:
244254
pattern: artifacts-*

‎.github/workflows/docs.yaml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,12 @@ defaults:
2525
run:
2626
shell: bash -e {0}
2727

28+
permissions: {}
29+
30+
concurrency:
31+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
32+
cancel-in-progress: true
33+
2834
env:
2935
DISPLAY: ":99.0"
3036

@@ -33,15 +39,15 @@ jobs:
3339
name: Pixi lock
3440
runs-on: ubuntu-latest
3541
steps:
36-
- uses: holoviz-dev/holoviz_tasks/pixi_lock@v0
42+
- uses: holoviz-dev/holoviz_tasks/pixi-lock@v1
3743

3844
docs_build:
3945
name: Build Documentation
4046
needs: [pixi_lock]
4147
runs-on: "macos-latest"
4248
timeout-minutes: 180
4349
steps:
44-
- uses: holoviz-dev/holoviz_tasks/pixi_install@v0
50+
- uses: holoviz-dev/holoviz_tasks/pixi-install@v1
4551
with:
4652
environments: docs
4753
opengl: true

‎.github/workflows/downstream_tests.yaml‎

Lines changed: 19 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,28 @@
11
name: downstream_tests
22

33
on:
4-
# Run this workflow after the build workflow has completed.
5-
workflow_run:
4+
workflow_run: # zizmor: ignore[dangerous-triggers]
65
workflows: [packages]
76
types: [completed]
8-
# Or by triggering it manually via Github's UI
97
workflow_dispatch:
10-
inputs:
11-
manual:
12-
description: don't change me!
13-
type: boolean
14-
required: true
15-
default: true
8+
9+
permissions: {}
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
13+
cancel-in-progress: true
1614

1715
jobs:
1816
downstream_tests:
19-
uses: holoviz-dev/holoviz_tasks/.github/workflows/run_downstream_tests.yaml@main
20-
with:
21-
downstream_repos_as_json: "{\"downstream_repo\":[\"holoviews\", \"lumen\"]}"
22-
secrets:
23-
ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }}
17+
name: Run downstream tests
18+
runs-on: ubuntu-latest
19+
if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
20+
strategy:
21+
matrix:
22+
downstream_repo: [holoviews, lumen]
23+
fail-fast: false
24+
steps:
25+
- uses: holoviz-dev/holoviz_tasks/downstream-tests@v1
26+
with:
27+
downstream_repo: ${{ matrix.downstream_repo }}
28+
github_token: ${{ secrets.ACCESS_TOKEN }}

‎.github/workflows/gallery.yaml‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,28 @@
11
name: gallery
22

33
on:
4-
workflow_run:
4+
workflow_run: # zizmor: ignore[dangerous-triggers]
55
workflows: [packages]
66
types:
77
- completed
88
workflow_dispatch:
99
inputs:
1010
target:
11-
description: 'Build and deploy gallery'
11+
description: "Build and deploy gallery"
1212
type: choice
1313
options:
14-
- dev
15-
- main
16-
- dryrun
14+
- dev
15+
- main
16+
- dryrun
1717
required: true
1818
default: dryrun
1919

20+
permissions: {}
21+
22+
concurrency:
23+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
24+
cancel-in-progress: true
25+
2026
jobs:
2127
deploy_gallery:
2228
name: Gallery
@@ -29,14 +35,15 @@ jobs:
2935
uses: actions/checkout@v6
3036
with:
3137
fetch-depth: 0
38+
persist-credentials: false
3239
- name: Set and echo git ref
3340
id: vars
3441
env:
3542
HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
3643
run: |
3744
echo "Deploying from ref $HEAD_BRANCH"
3845
echo "tag=$HEAD_BRANCH" >> $GITHUB_OUTPUT
39-
- uses: conda-incubator/setup-miniconda@v3
46+
- uses: conda-incubator/setup-miniconda@v4
4047
with:
4148
miniconda-version: "latest"
4249
auto-update-conda: true
@@ -60,12 +67,14 @@ jobs:
6067
(github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'dev') ||
6168
(github.event_name == 'workflow_run' && (contains(steps.vars.outputs.tag, 'a') || contains(steps.vars.outputs.tag, 'b') || contains(steps.vars.outputs.tag, 'rc')))
6269
)
70+
env:
71+
TAG: ${{ steps.vars.outputs.tag || '0.0.1dev' }}
6372
run: |
6473
conda activate test
6574
ae5 login --hostname holoviz-demo.anaconda.com --username ${{ secrets.AE5_USERNAME }} --password ${{ secrets.AE5_PASSWORD }}
6675
ae5 deployment stop panel-gallery-dev --yes || :
6776
ae5 project delete panel-gallery-dev --yes || :
68-
ae5 project upload examples/gallery --name panel-gallery-dev --tag ${{ steps.vars.outputs.tag || '0.0.1dev' }}
77+
ae5 project upload examples/gallery --name panel-gallery-dev --tag "${TAG}"
6978
ae5 deployment start panel-gallery-dev --endpoint panel-gallery-dev --command dev --public --resource-profile large --wait
7079
- name: Upload and deploy prod gallery
7180
if: |
@@ -74,10 +83,12 @@ jobs:
7483
(github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'main') ||
7584
(github.event_name == 'workflow_run' && !(contains(steps.vars.outputs.tag, 'a') || contains(steps.vars.outputs.tag, 'b') || contains(steps.vars.outputs.tag, 'rc')) && contains(steps.vars.outputs.tag, 'v'))
7685
)
86+
env:
87+
TAG: ${{ steps.vars.outputs.tag }}
7788
run: |
7889
conda activate test
7990
ae5 login --hostname holoviz-demo.anaconda.com --username ${{ secrets.AE5_USERNAME }} --password ${{ secrets.AE5_PASSWORD }}
8091
ae5 deployment stop panel-gallery --yes || :
8192
ae5 project delete panel-gallery --yes || :
82-
ae5 project upload examples/gallery --name panel-gallery --tag ${{ steps.vars.outputs.tag }}
93+
ae5 project upload examples/gallery --name panel-gallery --tag "${TAG}"
8394
ae5 deployment start panel-gallery --endpoint panel-gallery --command prod --public --resource-profile extra_large --wait

‎.github/workflows/jupyterlite.yaml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,19 +21,25 @@ on:
2121
schedule:
2222
- cron: "0 19 * * SUN"
2323

24+
permissions: {}
25+
26+
concurrency:
27+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
28+
cancel-in-progress: true
29+
2430
jobs:
2531
pixi_lock:
2632
name: Pixi lock
2733
runs-on: ubuntu-latest
2834
steps:
29-
- uses: holoviz-dev/holoviz_tasks/pixi_lock@v0
35+
- uses: holoviz-dev/holoviz_tasks/pixi-lock@v1
3036

3137
lite_build:
3238
name: Build Jupyterlite
3339
needs: [pixi_lock]
3440
runs-on: "ubuntu-latest"
3541
steps:
36-
- uses: holoviz-dev/holoviz_tasks/pixi_install@v0
42+
- uses: holoviz-dev/holoviz_tasks/pixi-install@v1
3743
with:
3844
environments: "lite"
3945
install: false

‎.github/workflows/nightly_lock.yaml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ on:
44
schedule:
55
- cron: "0 0 * * *"
66

7+
permissions: {}
8+
9+
concurrency:
10+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
11+
cancel-in-progress: true
12+
713
env:
814
PACKAGE: "panel"
915

@@ -14,7 +20,7 @@ jobs:
1420
runs-on: ubuntu-latest
1521
timeout-minutes: 5
1622
steps:
17-
- uses: holoviz-dev/holoviz_tasks/pixi_lock@v0
23+
- uses: holoviz-dev/holoviz_tasks/pixi-lock@v1
1824
- name: Upload lock-file to S3
1925
env:
2026
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

0 commit comments

Comments
 (0)