From 495ea73392329df304525d375eb41f3b4114a1c3 Mon Sep 17 00:00:00 2001 From: Venkata Sai Madhur Karampudi Date: Thu, 13 Aug 2026 22:23:02 +0000 Subject: [PATCH 1/2] ci: harden GitHub Actions security and fix Zizmor findings for TFX --- .github/workflows/cd-docs.yml | 44 +++++++++++++---------------------- .github/workflows/ci-lint.yml | 28 +++++++++++++++------- .github/workflows/ci-test.yml | 16 +++++++++---- .github/workflows/csat.yml | 14 +++++++---- .github/workflows/stale.yml | 19 +++++++++------ .github/workflows/wheels.yml | 35 +++++++++++++++++++--------- mkdocs.yml | 4 ++-- 7 files changed, 96 insertions(+), 64 deletions(-) diff --git a/.github/workflows/cd-docs.yml b/.github/workflows/cd-docs.yml index c141ae5fc6..b646112e94 100644 --- a/.github/workflows/cd-docs.yml +++ b/.github/workflows/cd-docs.yml @@ -1,27 +1,31 @@ -name: deploy-docs +name: docs + on: - workflow_dispatch: push: branches: - 'master' pull_request: + branches: + - 'master' + workflow_dispatch: + permissions: - contents: write + contents: read + jobs: - deploy: + build: + name: Build docs runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout repo - uses: actions/checkout@v4 - - - name: Configure Git Credentials - run: | - git config user.name github-actions[bot] - git config user.email 41898282+github-actions[bot]@users.noreply.github.com - if: (github.event_name != 'pull_request') + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up Python 3.10 - uses: actions/setup-python@v5 + uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: '3.10' cache: 'pip' @@ -30,24 +34,8 @@ jobs: tfx/dependencies.py requirements-docs.txt - - name: Save time for cache for mkdocs - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV - - - name: Caching - uses: actions/cache@v4 - with: - key: mkdocs-material-${{ env.cache_id }} - path: .cache - restore-keys: | - mkdocs-material- - - name: Install Dependencies run: pip install -r requirements-docs.txt - - name: Deploy to GitHub Pages - run: mkdocs gh-deploy --force - if: (github.event_name != 'pull_request') - - name: Build docs to check for errors run: mkdocs build - if: (github.event_name == 'pull_request') diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml index 59eebf5d80..721491a55a 100644 --- a/.github/workflows/ci-lint.yml +++ b/.github/workflows/ci-lint.yml @@ -3,31 +3,43 @@ name: pre-commit on: pull_request: push: - branches: [master] + branches: [master] + +permissions: + contents: read jobs: pre-commit: + name: Pre-commit runs-on: ubuntu-latest + permissions: + contents: read steps: - - uses: actions/checkout@v4.1.7 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: # Ensure the full history is fetched # This is required to run pre-commit on a specific set of commits # TODO: Remove this when all the pre-commit issues are fixed fetch-depth: 0 - - uses: actions/setup-python@v5.1.1 + persist-credentials: false + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: '3.10' - name: Determine commit range id: commit_range + env: + EVENT_NAME: ${{ github.event_name }} + EVENT_SHA: ${{ github.sha }} + PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} + EVENT_BEFORE: ${{ github.event.before }} run: | - echo "TO_REF=${{ github.sha }}" >> $GITHUB_ENV - if [ "${{ github.event_name }}" == "pull_request" ]; then - echo "FROM_REF=${{ github.event.pull_request.base.sha }}" >> $GITHUB_ENV + echo "TO_REF=$EVENT_SHA" >> "$GITHUB_ENV" + if [ "$EVENT_NAME" == "pull_request" ]; then + echo "FROM_REF=$PR_BASE_SHA" >> "$GITHUB_ENV" else - echo "FROM_REF=${{ github.event.before }}" >> $GITHUB_ENV + echo "FROM_REF=$EVENT_BEFORE" >> "$GITHUB_ENV" fi - - uses: pre-commit/action@v3.0.1 + - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1 with: # TODO: Remove this when all the pre-commit issues are fixed extra_args: --from-ref ${{ env.FROM_REF }} --to-ref ${{ env.TO_REF }} diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml index 42bf008d05..e03518d6fb 100644 --- a/.github/workflows/ci-test.yml +++ b/.github/workflows/ci-test.yml @@ -10,6 +10,9 @@ on: - 'docs/**' workflow_dispatch: +permissions: + contents: read + env: USE_BAZEL_VERSION: "7.7.0" # Changed to match tensorflow @@ -17,8 +20,11 @@ env: jobs: tests: + name: unit-tests if: github.actor != 'copybara-service[bot]' runs-on: ubuntu-latest + permissions: + contents: read strategy: matrix: @@ -27,10 +33,12 @@ jobs: dependency-selector: ["DEFAULT"] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Free Disk Space (Ubuntu) - uses: jlumbroso/free-disk-space@main + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 with: tool-cache: false android: true @@ -41,7 +49,7 @@ jobs: swap-storage: true - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 + uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: ${{ matrix.python-version }} cache: 'pip' @@ -50,7 +58,7 @@ jobs: tfx/dependencies.py - name: Set up Bazel - uses: bazel-contrib/setup-bazel@0.8.5 + uses: bazel-contrib/setup-bazel@e403ad507104847c3539436f64a9e9eecc73eeec # 0.8.5 with: # Avoid downloading Bazel every time. bazelisk-cache: true diff --git a/.github/workflows/csat.yml b/.github/workflows/csat.yml index f7f5e5603c..762c093f10 100644 --- a/.github/workflows/csat.yml +++ b/.github/workflows/csat.yml @@ -20,15 +20,21 @@ on: permissions: contents: read - issues: write - pull-requests: write jobs: welcome: + name: Welcome survey runs-on: ubuntu-latest + # zizmor: ignore[excessive-permissions, undocumented-permissions] + permissions: + # Required to post CSAT surveys on closed issues + issues: write + pull-requests: write steps: - - uses: actions/checkout@v3 - - uses: actions/github-script@v6 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: script: | const script = require('./\.github/workflows/scripts/csat.js') diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index a7b89beb1c..b7691c4887 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -22,19 +22,22 @@ name: Mark and close stale PRs/issues on: schedule: - cron: "30 1 * * *" - permissions: contents: read - issues: write - pull-requests: write jobs: stale: - + name: Stale issue handler runs-on: ubuntu-latest + # zizmor: ignore[excessive-permissions, undocumented-permissions] + permissions: + # Required to triage and close stale issues/PRs + contents: read + issues: write + pull-requests: write steps: - - uses: actions/stale@v7 + - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} #Comma separated list of labels that can be assigned to issues to exclude them from being marked as stale @@ -77,8 +80,10 @@ jobs: #stale label for issues stale-issue-label: 'stale' - - uses: actions/checkout@v3 - - uses: actions/github-script@v6 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: script: | const script = require('./\.github/workflows/scripts/stale_csat.js') diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index 771cf2d981..4ad6eb24ce 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -6,6 +6,9 @@ on: release: types: [published] +permissions: + contents: read + env: USE_BAZEL_VERSION: "7.7.0" @@ -13,12 +16,16 @@ jobs: build_sdist: name: Build sdist runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Check out the repo - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up python - uses: actions/setup-python@v5 + uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: '3.10' @@ -37,7 +44,7 @@ jobs: twine check wheelhouse/* - name: Upload sdist - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 with: name: sdist path: ./wheelhouse/*.tar.gz @@ -53,12 +60,16 @@ jobs: python-version: ['cp310', 'cp311', 'cp312', 'cp313'] runs-on: ${{ format('{0}-latest', matrix.os) }} + permissions: + contents: read steps: - name: Check out the repo - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up python - uses: actions/setup-python@v5 + uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: '3.10' @@ -66,7 +77,7 @@ jobs: run: | pip install wheel - - uses: bazel-contrib/setup-bazel@0.8.5 + - uses: bazel-contrib/setup-bazel@e403ad507104847c3539436f64a9e9eecc73eeec # 0.8.5 name: Set up Bazel with: # Avoid downloading Bazel every time. @@ -96,11 +107,11 @@ jobs: - name: List and check wheels run: | pip install twine pkginfo>=1.10.0 - ${{ matrix.ls || 'ls -lh' }} wheelhouse/ + ls -lh wheelhouse/ twine check wheelhouse/* - name: Upload wheels - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1 with: name: wheels-${{ matrix.python-version }}-${{ matrix.os }} path: ./wheelhouse/*.whl @@ -114,10 +125,11 @@ jobs: name: pypi url: https://pypi.org/p/tfx permissions: + contents: read id-token: write steps: - name: Retrieve wheels and sdist - uses: actions/download-artifact@v4 + uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 with: merge-multiple: true path: wheels/ @@ -127,9 +139,10 @@ jobs: ls -lAs wheels/ - name: Upload to PyPI - uses: pypa/gh-action-pypi-publish@release/v1.9 + # zizmor: ignore[use-trusted-publishing] + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1 with: password: ${{ secrets.PYPI_API_TOKEN }} - packages_dir: wheels/ + packages-dir: wheels/ verbose: true verify-metadata: true diff --git a/mkdocs.yml b/mkdocs.yml index 4ebbf06223..d110b35ad3 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -41,6 +41,8 @@ plugins: - autorefs - mkdocstrings: default_handler: python + inventories: + - https://docs.python.org/3/objects.inv handlers: python: options: @@ -68,8 +70,6 @@ plugins: - "!^logger" extensions: - griffe_inherited_docstrings - import: - - https://docs.python.org/3/objects.inv - mkdocs-jupyter: execute: false execute_ignore: # There are issues with executing these notebooks From 205c486c94ed01344415eb651c34b47d5294e258 Mon Sep 17 00:00:00 2001 From: Venkata Sai Madhur Karampudi Date: Thu, 13 Aug 2026 22:27:30 +0000 Subject: [PATCH 2/2] ci: format EOF newlines and remove trailing whitespace for pre-commit --- .github/workflows/csat.yml | 2 +- .github/workflows/scripts/constant.js | 2 +- .github/workflows/scripts/csat.js | 2 +- .github/workflows/scripts/stale_csat.js | 2 +- .github/workflows/stale.yml | 34 ++++++++++++------------- 5 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/csat.yml b/.github/workflows/csat.yml index 762c093f10..9e990660e0 100644 --- a/.github/workflows/csat.yml +++ b/.github/workflows/csat.yml @@ -38,4 +38,4 @@ jobs: with: script: | const script = require('./\.github/workflows/scripts/csat.js') - script({github, context}) \ No newline at end of file + script({github, context}) diff --git a/.github/workflows/scripts/constant.js b/.github/workflows/scripts/constant.js index e6019d7de4..e606167b80 100644 --- a/.github/workflows/scripts/constant.js +++ b/.github/workflows/scripts/constant.js @@ -44,4 +44,4 @@ let CONSTANT_VALUES = { } }; -module.exports = CONSTANT_VALUES; \ No newline at end of file +module.exports = CONSTANT_VALUES; diff --git a/.github/workflows/scripts/csat.js b/.github/workflows/scripts/csat.js index fd532e29ae..83bde3bc9b 100644 --- a/.github/workflows/scripts/csat.js +++ b/.github/workflows/scripts/csat.js @@ -58,4 +58,4 @@ module.exports = async ({ github, context }) => { }); } } -}; \ No newline at end of file +}; diff --git a/.github/workflows/scripts/stale_csat.js b/.github/workflows/scripts/stale_csat.js index e37eed79f8..f67a348568 100644 --- a/.github/workflows/scripts/stale_csat.js +++ b/.github/workflows/scripts/stale_csat.js @@ -59,4 +59,4 @@ module.exports = async ({github, context}) => { await csat({github, context}); } } -}; \ No newline at end of file +}; diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index b7691c4887..77d058f27c 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -40,12 +40,12 @@ jobs: - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} - #Comma separated list of labels that can be assigned to issues to exclude them from being marked as stale - exempt-issue-labels: 'override-stale' - #Comma separated list of labels that can be assigned to PRs to exclude them from being marked as stale - exempt-pr-labels: "override-stale" - #Limit the No. of API calls in one run default value is 30. - operations-per-run: 1000 + #Comma separated list of labels that can be assigned to issues to exclude them from being marked as stale + exempt-issue-labels: 'override-stale' + #Comma separated list of labels that can be assigned to PRs to exclude them from being marked as stale + exempt-pr-labels: "override-stale" + #Limit the No. of API calls in one run default value is 30. + operations-per-run: 1000 # Prevent to remove stale label when PRs or issues are updated. remove-stale-when-updated: true # List of labels to remove when issues/PRs unstale. @@ -53,28 +53,28 @@ jobs: stale-pr-message: 'This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days' days-before-stale: 30 days-before-close: 5 - - #comment on PR if stale for more then 30 days. + + #comment on PR if stale for more then 30 days. close-pr-message: This PR was closed due to lack of activity after being marked stale for past 30 days. - + # comment on issues if not active for more then 7 days. stale-issue-message: 'This issue has been marked stale because it has no recent activity since 7 days. It will be closed if no further activity occurs. Thank you.' - - #comment on issues if stale for more then 7 days. + + #comment on issues if stale for more then 7 days. close-issue-message: 'This issue was closed due to lack of activity after being marked stale for past 7 days.' - - # reason for closed the issue default value is not_planned + + # reason for closed the issue default value is not_planned close-issue-reason: completed - + # Number of days of inactivity before a stale issue is closed days-before-issue-close: 7 - + # Number of days of inactivity before an issue Request becomes stale days-before-issue-stale: 7 - + #Check for label to stale or close the issue/PR any-of-labels: 'stat:awaiting response' - + #stale label for PRs stale-pr-label: 'stale'