@@ -21,7 +21,7 @@ concurrency:
2121jobs :
2222 zizmor :
2323 name : Zizmor (workflow audit)
24- runs-on : self-hosted
24+ runs-on : ubuntu-latest
2525 steps :
2626 - name : Checkout
2727 uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -30,14 +30,14 @@ jobs:
3030 - name : Set up uv
3131 uses : astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
3232 with :
33- version : " 0.11.8 "
33+ version : " 0.11.26 "
3434 python-version : " 3.12"
3535 - name : Run zizmor
36- run : uvx --from zizmor==1.24 .1 zizmor --persona pedantic --format github .github/workflows
36+ run : uvx --from zizmor==1.26 .1 zizmor --persona pedantic --format github .github/workflows
3737
3838 gitleaks :
3939 name : Gitleaks (secrets scan)
40- runs-on : self-hosted
40+ runs-on : ubuntu-latest
4141 steps :
4242 - name : Checkout
4343 uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
5151
5252 bandit :
5353 name : Bandit (Python source audit)
54- runs-on : self-hosted
54+ runs-on : ubuntu-latest
5555 steps :
5656 - name : Checkout
5757 uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
6060 - name : Set up uv
6161 uses : astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
6262 with :
63- version : " 0.11.8 "
63+ version : " 0.11.26 "
6464 python-version : " 3.12"
6565 - name : Run bandit
6666 run : |
7474
7575 pip-audit :
7676 name : pip-audit (dependency CVE scan)
77- runs-on : self-hosted
77+ runs-on : ubuntu-latest
7878 steps :
7979 - name : Checkout
8080 uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -83,17 +83,17 @@ jobs:
8383 - name : Set up uv
8484 uses : astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
8585 with :
86- version : " 0.11.8 "
86+ version : " 0.11.26 "
8787 python-version : " 3.12"
8888 - name : Run pip-audit (server image runtime)
8989 # src/lumilake_server/requirements.txt is the pin set baked into
9090 # the published Docker image (generated by sync_requirements.py).
91- run : uvx pip-audit==2.9.0 --strict -r src/lumilake_server/requirements.txt
91+ run : uvx pip-audit==2.10.1 --strict -r src/lumilake_server/requirements.txt
9292 - name : Export wheel install closure
9393 # PyPI users' install: every extra, no dependency-group (dev/lint/test
9494 # and server-runtime don't ship in any wheel), no workspace members.
9595 run : |
9696 uv export --all-extras --no-default-groups --no-emit-workspace \
9797 --format requirements-txt --no-hashes > /tmp/wheels-audit.txt
9898 - name : Run pip-audit (wheel install closure)
99- run : uvx pip-audit==2.9.0 --strict -r /tmp/wheels-audit.txt
99+ run : uvx pip-audit==2.10.1 --strict -r /tmp/wheels-audit.txt
0 commit comments