From 8238fe63b76223953b7dd3f2b9a5a2fa5371dc17 Mon Sep 17 00:00:00 2001 From: Ayan Sinha Mahapatra Date: Thu, 29 Oct 2026 11:54:43 -0700 Subject: [PATCH 1/3] Update github actions versions Signed-off-by: Ayan Sinha Mahapatra --- .github/workflows/about-files-ci.yml | 4 +- .github/workflows/commoncode-release.yml | 12 +- .github/workflows/docs-ci.yml | 4 +- .../licensedcode-data-index-release.yml | 12 +- .github/workflows/scancode-release.yml | 111 +++++++++--------- .github/workflows/update-citation.yml | 4 +- .github/workflows/zizmor.yml | 2 +- 7 files changed, 77 insertions(+), 72 deletions(-) diff --git a/.github/workflows/about-files-ci.yml b/.github/workflows/about-files-ci.yml index 8c8b5c11316..eb50f2fbfab 100644 --- a/.github/workflows/about-files-ci.yml +++ b/.github/workflows/about-files-ci.yml @@ -16,12 +16,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/commoncode-release.yml b/.github/workflows/commoncode-release.yml index ca127d29656..d87446787ef 100644 --- a/.github/workflows/commoncode-release.yml +++ b/.github/workflows/commoncode-release.yml @@ -27,11 +27,11 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: 3.14 @@ -42,7 +42,7 @@ jobs: run: etc/release/commoncode-create-pypi-wheel-and-sdist.sh - name: Upload built archives - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: pypi_archives path: dist/* @@ -59,7 +59,7 @@ jobs: steps: - name: Download built archives - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: pypi_archives path: dist @@ -82,11 +82,11 @@ jobs: steps: - name: Download built archives - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: pypi_archives path: dist - name: Publish to PyPI if: startsWith(github.ref, 'refs/tags') - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b \ No newline at end of file + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 \ No newline at end of file diff --git a/.github/workflows/docs-ci.yml b/.github/workflows/docs-ci.yml index 9a040112ede..1e1053d67ae 100644 --- a/.github/workflows/docs-ci.yml +++ b/.github/workflows/docs-ci.yml @@ -16,12 +16,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/licensedcode-data-index-release.yml b/.github/workflows/licensedcode-data-index-release.yml index 353829d1905..fa15f9d6f10 100644 --- a/.github/workflows/licensedcode-data-index-release.yml +++ b/.github/workflows/licensedcode-data-index-release.yml @@ -27,11 +27,11 @@ jobs: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: 3.14 @@ -42,7 +42,7 @@ jobs: run: etc/release/licensedcode-create-pypi-wheel-and-sdist.sh - name: Upload built archives - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: pypi_archives path: dist/* @@ -59,7 +59,7 @@ jobs: steps: - name: Download built archives - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: pypi_archives path: dist @@ -82,11 +82,11 @@ jobs: steps: - name: Download built archives - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: pypi_archives path: dist - name: Publish to PyPI if: startsWith(github.ref, 'refs/tags') - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b \ No newline at end of file + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 \ No newline at end of file diff --git a/.github/workflows/scancode-release.yml b/.github/workflows/scancode-release.yml index baf71764126..6274fd58b90 100644 --- a/.github/workflows/scancode-release.yml +++ b/.github/workflows/scancode-release.yml @@ -32,12 +32,14 @@ jobs: shell: bash steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + # https://github.com/actions/checkout/releases/tag/v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + # https://github.com/actions/setup-python/releases/tag/v7.1.0 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: 3.14 @@ -48,7 +50,8 @@ jobs: run: etc/release/licensedcode-create-pypi-wheel-and-sdist.sh - name: Collect built wheels and sdist - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f + # https://github.com/actions/upload-artifact/releases/tag/v7.0.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: wheels_sdist path: dist/* @@ -71,13 +74,13 @@ jobs: pyver: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - run: git fetch --prune --unshallow - name: Set up Python on ${{ matrix.pyver }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.pyver }} @@ -85,7 +88,7 @@ jobs: run: etc/release/scancode-create-release-app-linux.sh ${{ matrix.pyver }} - name: Collect built linux app for python ${{ matrix.pyver }} - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: linux_app_py_${{ matrix.pyver }} path: release/* @@ -108,13 +111,13 @@ jobs: pyver: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - run: git fetch --prune --unshallow - name: Set up Python on ${{ matrix.pyver }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.pyver }} @@ -122,7 +125,7 @@ jobs: run: etc/release/scancode-create-release-app-macos.sh ${{ matrix.pyver }} - name: Collect built mac app for python ${{ matrix.pyver }} - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: macos_app_py_${{ matrix.pyver }} path: release/* @@ -145,13 +148,13 @@ jobs: pyver: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - run: git fetch --prune --unshallow - name: Set up Python on ${{ matrix.pyver }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.pyver }} @@ -159,7 +162,7 @@ jobs: run: etc/release/scancode-create-release-app-windows.sh ${{ matrix.pyver }} - name: Collect built windows app for python ${{ matrix.pyver }} - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: windows_app_py_${{ matrix.pyver }} path: release/* @@ -179,13 +182,13 @@ jobs: fail-fast: true steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - run: git fetch --prune --unshallow - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: "3.14" @@ -193,7 +196,7 @@ jobs: run: etc/release/scancode-create-release-app-sources.sh - name: Collect built source app tarball - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 with: name: source_app path: release/* @@ -219,12 +222,12 @@ jobs: pyver: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python ${{ matrix.pyver }} on ${{ matrix.os }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.pyver }} @@ -234,7 +237,8 @@ jobs: sudo apt install p7zip-full libarchive-dev libmagic1 libmagic-dev - name: Download wheels artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + # https://github.com/actions/download-artifact/releases/tag/v8.0.2 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: wheels_sdist path: dist @@ -275,12 +279,12 @@ jobs: pyver: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python ${{ matrix.pyver }} on ${{ matrix.os }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.pyver }} @@ -290,7 +294,7 @@ jobs: brew install libarchive libmagic - name: Download wheels artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: wheels_sdist path: dist @@ -331,17 +335,17 @@ jobs: pyver: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python ${{ matrix.pyver }} on ${{ matrix.os }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.pyver }} - name: Download wheels artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: wheels_sdist path: dist @@ -382,12 +386,12 @@ jobs: pyver: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python ${{ matrix.pyver }} on ${{ matrix.os }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.pyver }} @@ -397,7 +401,7 @@ jobs: sudo apt install p7zip-full libarchive-dev libmagic1 libmagic-dev - name: Download a single artifact linux_app_py_${{ matrix.pyver }} - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: linux_app_py_${{ matrix.pyver }} path: dist @@ -433,12 +437,12 @@ jobs: pyver: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python ${{ matrix.pyver }} on ${{ matrix.os }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.pyver }} @@ -448,7 +452,7 @@ jobs: brew install libarchive libmagic - name: Download a single artifact macos_app_py_${{ matrix.pyver }} - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: macos_app_py_${{ matrix.pyver }} path: dist @@ -485,17 +489,17 @@ jobs: pyver: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python ${{ matrix.pyver }} on ${{ matrix.os }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.pyver }} - name: Download a single artifact windows_app_py_${{ matrix.pyver }} - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: windows_app_py_${{ matrix.pyver }} path: dist @@ -528,103 +532,103 @@ jobs: steps: - name: Download a single artifact source_app - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: source_app path: dist - name: Download a single artifact macos_app for python 3.10 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: macos_app_py_3.10 path: dist - name: Download a single artifact macos_app for python 3.11 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: macos_app_py_3.11 path: dist - name: Download a single artifact macos_app for python 3.12 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: macos_app_py_3.12 path: dist - name: Download a single artifact macos_app for python 3.13 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: macos_app_py_3.13 path: dist - name: Download a single artifact macos_app for python 3.14 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: macos_app_py_3.14 path: dist - name: Download a single artifact linux_app for python 3.10 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: linux_app_py_3.10 path: dist - name: Download a single artifact linux_app for python 3.11 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: linux_app_py_3.11 path: dist - name: Download a single artifact linux_app for python 3.12 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: linux_app_py_3.12 path: dist - name: Download a single artifact linux_app for python 3.13 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: linux_app_py_3.13 path: dist - name: Download a single artifact linux_app for python 3.14 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: linux_app_py_3.14 path: dist - name: Download a single artifact windows_app for python 3.10 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: windows_app_py_3.10 path: dist - name: Download a single artifact windows_app for python 3.11 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: windows_app_py_3.11 path: dist - name: Download a single artifact windows_app for python 3.12 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: windows_app_py_3.12 path: dist - name: Download a single artifact windows_app for python 3.13 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: windows_app_py_3.13 path: dist - name: Download a single artifact windows_app for python 3.14 - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: windows_app_py_3.14 path: dist - name: Download scancode and licensedcode wheels - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: wheels_sdist path: dist @@ -658,12 +662,12 @@ jobs: steps: - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: 3.14 - name: scancode and licensedcode wheels - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 with: name: wheels_sdist path: dist @@ -674,4 +678,5 @@ jobs: - name: Publish distributions to PyPI if: startsWith(github.ref, 'refs/tags') - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b + # https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.3 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 diff --git a/.github/workflows/update-citation.yml b/.github/workflows/update-citation.yml index 0ee1af9a854..5cd91a824b2 100644 --- a/.github/workflows/update-citation.yml +++ b/.github/workflows/update-citation.yml @@ -19,12 +19,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 90cf295a645..859818b26f6 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -16,7 +16,7 @@ jobs: security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.2 with: persist-credentials: false From a4cd525c4c3c20eda1480fdfea8a4558d58568de Mon Sep 17 00:00:00 2001 From: Ayan Sinha Mahapatra Date: Thu, 29 Oct 2026 11:54:59 -0700 Subject: [PATCH 2/3] Bump version to v33 for release Signed-off-by: Ayan Sinha Mahapatra --- CHANGELOG.rst | 4 ++++ pyproject-licensedcode-data.toml | 2 +- pyproject-licensedcode-index.toml | 2 +- pyproject-scancode-toolkit-mini.toml | 2 +- pyproject-scancode-toolkit.toml | 4 ++-- pyproject.toml | 4 ++-- src/scancode_config.py | 2 +- 7 files changed, 12 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.rst b/CHANGELOG.rst index abc3ae41ad2..a42eb6f9580 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -4,6 +4,9 @@ Changelog Next release -------------- +v33.0.0 - 2026-10-30 +------------------------ + - Fix the optional ``licenses`` extra dependency typo to install ``licensedcode-data``. https://github.com/aboutcode-org/scancode-toolkit/pull/5056 @@ -26,6 +29,7 @@ Next release ``ValueError: did not find any 'pre_scan' hooks``. https://github.com/aboutcode-org/scancode-toolkit/issues/5363 + v33.0.0rc1 - 2026-05-14 ------------------------ diff --git a/pyproject-licensedcode-data.toml b/pyproject-licensedcode-data.toml index f82d3053b39..a6008e7b42a 100644 --- a/pyproject-licensedcode-data.toml +++ b/pyproject-licensedcode-data.toml @@ -4,7 +4,7 @@ build-backend = "flot.buildapi" [project] name = "licensedcode-data" -version = "33.0.0rc1" +version = "33.0.0" description = "A packaging of the ScanCode licensedb license and license rules database." long_description_content_type = "text/x-rst" readme = "src/licensedcode/data/README.rst" diff --git a/pyproject-licensedcode-index.toml b/pyproject-licensedcode-index.toml index e9e4128e0df..14fa11c5c77 100644 --- a/pyproject-licensedcode-index.toml +++ b/pyproject-licensedcode-index.toml @@ -4,7 +4,7 @@ build-backend = "flot.buildapi" [project] name = "licensedcode-index" -version = "33.0.0rc1" +version = "33.0.0" description = "A packaging of the ScanCode licensedb license and license rules pre-built index. Can only be used with ScanCode-Toolkit." long_description_content_type = "text/x-rst" readme = "src/licensedcode/data/README.rst" diff --git a/pyproject-scancode-toolkit-mini.toml b/pyproject-scancode-toolkit-mini.toml index a5762e9c22f..63d66880f6c 100644 --- a/pyproject-scancode-toolkit-mini.toml +++ b/pyproject-scancode-toolkit-mini.toml @@ -4,7 +4,7 @@ build-backend = "flot.buildapi" [project] name = "scancode-toolkit-mini" -version = "33.0.0rc1" +version = "33.0.0" description = "ScanCode is a tool to scan code for license, copyright, package and their documented dependencies and other interesting facts." readme = "README.rst" license = { text = "Apache-2.0 AND CC-BY-4.0 AND LicenseRef-scancode-other-permissive AND LicenseRef-scancode-other-copyleft" } diff --git a/pyproject-scancode-toolkit.toml b/pyproject-scancode-toolkit.toml index e481874b662..b3a745f9558 100644 --- a/pyproject-scancode-toolkit.toml +++ b/pyproject-scancode-toolkit.toml @@ -4,7 +4,7 @@ build-backend = "flot.buildapi" [project] name = "scancode-toolkit" -version = "33.0.0rc1" +version = "33.0.0" description = "ScanCode is a tool to scan code for license, copyright, package and their documented dependencies and other interesting facts." readme = "README.rst" license = { text = "Apache-2.0 AND CC-BY-4.0 AND LicenseRef-scancode-other-permissive AND LicenseRef-scancode-other-copyleft" } @@ -152,7 +152,7 @@ dev = [ [tool.bumpversion] -current_version = "33.0.0rc1" +current_version = "33.0.0" allow_dirty = true files = [ diff --git a/pyproject.toml b/pyproject.toml index 31a5711823c..2609d2561c7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -7,7 +7,7 @@ build-backend = "flot.buildapi" [project] name = "scancode-toolkit-devel" -version = "33.0.0rc1" +version = "33.0.0" description = "ScanCode is a tool to scan code for license, copyright, package and their documented dependencies and other interesting facts." readme = "README.rst" license = { text = "Apache-2.0 AND CC-BY-4.0 AND LicenseRef-scancode-other-permissive AND LicenseRef-scancode-other-copyleft" } @@ -156,7 +156,7 @@ dev = [ [tool.bumpversion] -current_version = "33.0.0rc1" +current_version = "33.0.0" allow_dirty = true files = [ diff --git a/src/scancode_config.py b/src/scancode_config.py index c020494f6f4..8e0d960697b 100644 --- a/src/scancode_config.py +++ b/src/scancode_config.py @@ -134,7 +134,7 @@ def _create_dir(location): # See https://scancode-toolkit.readthedocs.io/en/latest/misc/versioning.html for # more information on versioning if not __version__: - __version__ = '33.0.0rc1' + __version__ = '33.0.0' ####################### # used to warn user when the version is out of date From e411a31b578a520a389d919301701c8608b24775 Mon Sep 17 00:00:00 2001 From: Ayan Sinha Mahapatra Date: Thu, 29 Oct 2026 21:24:08 -0700 Subject: [PATCH 3/3] Include commoncode wheels in app archive builds Signed-off-by: Ayan Sinha Mahapatra --- configure | 8 +++++--- etc/release/scancode-create-release-app-linux.sh | 2 ++ etc/release/scancode-create-release-app-macos.sh | 2 ++ etc/release/scancode-create-release-app-sources.sh | 1 + etc/release/scancode-create-release-app-windows.sh | 2 ++ 5 files changed, 12 insertions(+), 3 deletions(-) diff --git a/configure b/configure index 8f2f685f10e..50953f81c9c 100755 --- a/configure +++ b/configure @@ -259,9 +259,11 @@ install_packages() { install_packages_with_local() { # commoncode is present as dependencies of dependencies and so # we need to install commoncode from local source first so this - # is tested and not the released commoncode - "$CFG_BIN_DIR/flot" --pyproject pyproject-commoncode.toml - "$CFG_BIN_DIR/pip" install --force-reinstall ./dist/commoncode*.whl + # is tested and not the released commoncode, in developement installs + if [[ "$(echo $thirddir/*.whl)x" == "$thirddir/*.whlx" ]]; then + "$CFG_BIN_DIR/flot" --pyproject pyproject-commoncode.toml + "$CFG_BIN_DIR/pip" install --force-reinstall ./dist/commoncode*.whl + fi install_packages "$CFG_REQUIREMENTS" } diff --git a/etc/release/scancode-create-release-app-linux.sh b/etc/release/scancode-create-release-app-linux.sh index ab70ca9afc1..c495c2091f0 100755 --- a/etc/release/scancode-create-release-app-linux.sh +++ b/etc/release/scancode-create-release-app-linux.sh @@ -56,12 +56,14 @@ venv/bin/flot --pyproject pyproject-licensedcode-index.toml --wheel cp -r \ dist/scancode_*.whl \ scancode extractcode configure \ + pyproject-commoncode.toml \ *.rst \ samples \ *NOTICE *LICENSE *ABOUT \ $release_dir cp -r \ + dist/commoncode*.whl \ dist/licensedcode_index*.whl \ $release_dir/thirdparty diff --git a/etc/release/scancode-create-release-app-macos.sh b/etc/release/scancode-create-release-app-macos.sh index 998eae0573b..9862785a33f 100755 --- a/etc/release/scancode-create-release-app-macos.sh +++ b/etc/release/scancode-create-release-app-macos.sh @@ -55,12 +55,14 @@ venv/bin/flot --pyproject pyproject-licensedcode-index.toml --wheel cp -r \ dist/scancode_*.whl \ scancode extractcode configure \ + pyproject-commoncode.toml \ *.rst \ samples \ *NOTICE *LICENSE *ABOUT \ $release_dir cp -r \ + dist/commoncode*.whl \ dist/licensedcode_index*.whl \ $release_dir/thirdparty diff --git a/etc/release/scancode-create-release-app-sources.sh b/etc/release/scancode-create-release-app-sources.sh index 348d5bfc049..6afe2c729ce 100755 --- a/etc/release/scancode-create-release-app-sources.sh +++ b/etc/release/scancode-create-release-app-sources.sh @@ -54,6 +54,7 @@ cp -r \ docs \ samples \ *NOTICE *LICENSE *ABOUT \ + pyproject-commoncode.toml \ $release_dir tarball=scancode-toolkit-$(git describe --tags)_sources.tar.gz diff --git a/etc/release/scancode-create-release-app-windows.sh b/etc/release/scancode-create-release-app-windows.sh index dc37b417a6e..b36ee6a81b9 100755 --- a/etc/release/scancode-create-release-app-windows.sh +++ b/etc/release/scancode-create-release-app-windows.sh @@ -55,12 +55,14 @@ venv/bin/flot --pyproject pyproject-licensedcode-index.toml --wheel cp -r \ dist/scancode_*.whl \ scancode.bat extractcode.bat configure.bat \ + pyproject-commoncode.toml \ *.rst \ samples \ *NOTICE *LICENSE *ABOUT \ $release_dir cp -r \ + dist/commoncode*.whl \ dist/licensedcode_index*.whl \ $release_dir/thirdparty