From d17b7c20d0f89ab09476185d5db465ff4d560c0d Mon Sep 17 00:00:00 2001 From: Stijn van Houwelingen Date: Tue, 25 Aug 2026 17:03:28 +0200 Subject: [PATCH 1/3] refactor: rename test-suite to ci. Rename ci job to codeqa Signed-off-by: Stijn van Houwelingen --- .github/workflows/{test-suite.yml => ci.yml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename .github/workflows/{test-suite.yml => ci.yml} (99%) diff --git a/.github/workflows/test-suite.yml b/.github/workflows/ci.yml similarity index 99% rename from .github/workflows/test-suite.yml rename to .github/workflows/ci.yml index 091df20..4e2b0aa 100644 --- a/.github/workflows/test-suite.yml +++ b/.github/workflows/ci.yml @@ -10,7 +10,7 @@ on: branches: [ main ] jobs: - ci: + codeqa: runs-on: ubuntu-latest strategy: matrix: From 48acb0a4e6ee119a9028095ed23963883d28cfe5 Mon Sep 17 00:00:00 2001 From: Stijn van Houwelingen Date: Tue, 25 Aug 2026 17:08:45 +0200 Subject: [PATCH 2/3] feat: add zizmor GH action Signed-off-by: Stijn van Houwelingen --- .github/workflows/ci.yml | 18 ++++++++++++++++++ README.md | 19 +++++++++++++++++++ 2 files changed, 37 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4e2b0aa..417e056 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,6 +10,24 @@ on: branches: [ main ] jobs: + # Statically audits GitHub Actions workflows for security issues (e.g. injection + # risks, overly broad permissions, unpinned actions). See README.md's Developing + # section for how to run zizmor locally and auto-fix findings. + zizmor: + name: Run zizmor 🌈 + runs-on: ubuntu-latest + permissions: + security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. + contents: read # Only needed for private repos. Needed to clone the repo. + actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info. + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0 codeqa: runs-on: ubuntu-latest strategy: diff --git a/README.md b/README.md index 339a6df..070da68 100644 --- a/README.md +++ b/README.md @@ -105,6 +105,25 @@ To run the test suite, you can use the following command: uv run pytest -v test/ ``` +We also run [zizmor](https://github.com/zizmorcore/zizmor) in CI to statically +audit our GitHub Actions workflows for security issues (e.g. injection risks, +overly broad permissions, unpinned actions). You can run it locally without +installing it, using `uvx`: + +```bash +uvx zizmor . +``` + +Some findings can be fixed automatically: + +```bash +# Apply only safe fixes +uvx zizmor --fix . + +# Apply all fixes, including unsafe ones (review the diff afterwards) +uvx zizmor --fix=all . +``` + ## Contributing Documentation ### Building the documentation From f8f0c82608454a851740c50e01ee9a4c16fcbe81 Mon Sep 17 00:00:00 2001 From: Stijn van Houwelingen Date: Tue, 25 Aug 2026 17:09:08 +0200 Subject: [PATCH 3/3] feat: add flake8 documentation Signed-off-by: Stijn van Houwelingen --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 070da68..a8bda07 100644 --- a/README.md +++ b/README.md @@ -105,6 +105,12 @@ To run the test suite, you can use the following command: uv run pytest -v test/ ``` +To lint the code with `flake8`: + +```bash +uv run flake8 openleadr/ --count --select=E9,F63,F7,F82 --show-source --statistics +``` + We also run [zizmor](https://github.com/zizmorcore/zizmor) in CI to statically audit our GitHub Actions workflows for security issues (e.g. injection risks, overly broad permissions, unpinned actions). You can run it locally without