Feat/additional ci

.github/workflows/test-suite.yml → .github/workflows/ci.yml

@@ -10,32 +10,50 @@
     branches: [ main ]
 
 jobs:
-  ci:
+  # Statically audits GitHub Actions workflows for security issues (e.g. injection
+  # risks, overly broad permissions, unpinned actions). See README.md's Developing
+  # section for how to run zizmor locally and auto-fix findings.
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read # Only needed for private repos. Needed to clone the repo.
+      actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+  codeqa:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: ['3.9', '3.10', '3.11', '3.12']
     env:
       UV_PYTHON_DOWNLOADS: never
     steps:
     - uses: actions/checkout@v4
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install UV
       uses: astral-sh/setup-uv@v6
       with:
         enable-cache: true
     - name: Install dependencies
       run: |
         uv sync --locked --python ${{ matrix.python-version }} --group dev
     - name: Lint with flake8
       run: |
         # stop the build if there are Python syntax errors or undefined names
         uv run flake8 openleadr/ --count --select=E9,F63,F7,F82 --show-source --statistics
         # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
         uv run flake8 openleadr/ --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
     - name: Test with pytest
       run: |
         uv run pytest -vv test/

README.md

@@ -105,6 +105,31 @@ To run the test suite, you can use the following command:
 uv run pytest -v test/
 ```
 
+To lint the code with `flake8`:
+
+```bash
+uv run flake8 openleadr/ --count --select=E9,F63,F7,F82 --show-source --statistics
+```
+
+We also run [zizmor](https://github.com/zizmorcore/zizmor) in CI to statically
+audit our GitHub Actions workflows for security issues (e.g. injection risks,
+overly broad permissions, unpinned actions). You can run it locally without
+installing it, using `uvx`:
+
+```bash
+uvx zizmor .
+```
+
+Some findings can be fixed automatically:
+
+```bash
+# Apply only safe fixes
+uvx zizmor --fix .
+
+# Apply all fixes, including unsafe ones (review the diff afterwards)
+uvx zizmor --fix=all .
+```
+
 ## Contributing Documentation
 
 ### Building the documentation