Skip to content

Harden GitHub Actions and test on Python 3.15 - #20

Merged
cssho merged 1 commit into
masterfrom
actions-hardening
Oct 27, 2026
Merged

cssho merged 1 commit into
masterfrom
actions-hardening

Conversation

@cssho

@cssho cssho commented Oct 27, 2026

Copy link
Copy Markdown
Owner
  • Add zizmor as a dev dependency (so Dependabot keeps it updated via uv.lock) and run it in the lint job with online audits; no new required check, ci-ok already covers lint
  • persist-credentials: false on every actions/checkout (zizmor artipacked)
  • Dependabot cooldown: default-days: 3 for both ecosystems; .github/zizmor.yml sets the dependabot-cooldown audit to 3 days to match (its default is 7)
  • Python 3.15 added to the test matrix (python-build-standalone ships 3.15.2)

Local: zizmor reports no findings; 50 tests pass on the default Python and 3.15.

🤖 Generated with Claude Code

https://claude.ai/code/session_012pKTVb5TrGn27R29rHHNck

- Add zizmor (dev dependency) and run it in the lint job
- Set persist-credentials: false on every checkout
- Add a 3-day Dependabot cooldown, and configure zizmor to match
- Add Python 3.15 to the test matrix

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012pKTVb5TrGn27R29rHHNck
@cssho
cssho merged commit 5b15451 into master Oct 27, 2026
9 checks passed
@cssho
cssho deleted the actions-hardening branch October 27, 2026 15:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant