etlplus 0.3.10__tar.gz → 0.3.13__tar.gz

{etlplus-0.3.10 → etlplus-0.3.13}/.github/actions/python-bootstrap/action.yml

@@ -5,6 +5,10 @@
 #
 # A GitHub Actions action to set up Python and install Python package
 # dependencies.
+#
+# Notes
+# - External action references are each pinned to a specific commit SHA for
+#   improved security and stability (e.g., reduced supply-chain attack risks).
 
 ---
 
@@ -25,7 +29,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
       with:
         python-version: ${{ inputs.python-version }}
 

{etlplus-0.3.10 → etlplus-0.3.13}/.github/workflows/ci.yml

@@ -4,6 +4,16 @@
 # Copyright © 2025 Dagitali LLC. All rights reserved.
 #
 # A GitHub Actions workflow configuration file for Continuous Integration (CI).
+#
+# Notes
+# - The workflow includes jobs for linting, testing, building distributions,
+#   and publishing releases to GitHub and PyPI.
+# - The workflow is hardened by removing global permissions and setting per-job
+#.  scopes.
+# - To harden workflow security, global permissions are absent, and per-job
+#   permissions are set as needed.
+# - External action references are each pinned to a specific commit SHA for
+#   improved security and stability (e.g., reduced supply-chain attack risks).
 
 ---
 
@@ -28,9 +38,7 @@ on:
   pull_request:
     branches: [ main, develop ]
 
-permissions:
-  contents: read
-  id-token: write
+permissions: {}
 
 jobs:
   lint:
@@ -38,8 +46,10 @@ jobs:
     strategy: &python-matrix
       matrix:
         python-version: ['3.13', '3.14']
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 0
       - uses: ./.github/actions/python-bootstrap
@@ -55,8 +65,10 @@ jobs:
   test:
     runs-on: ubuntu-latest
     strategy: *python-matrix
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 0
       - uses: ./.github/actions/python-bootstrap
@@ -72,8 +84,10 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     needs: [lint, test]
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 0
       - uses: ./.github/actions/python-bootstrap
@@ -84,7 +98,7 @@ jobs:
         run: |
           python -m build
       - name: Upload distributions
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: dist-artifacts
           path: dist/*
@@ -98,16 +112,16 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 0
       - name: Download distributions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           name: dist-artifacts
           path: dist
       - name: Publish GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2
         with:
           files: dist/*
           generate_release_notes: true
@@ -117,19 +131,22 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     needs: build
+    permissions:
+      contents: read
+      id-token: write
     environment:
       name: pypi
       url: https://pypi.org/project/etlplus/
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
         with:
           fetch-depth: 0
       - name: Download distributions
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           name: dist-artifacts
           path: dist
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1
         with:
           verbose: true

{etlplus-0.3.10/etlplus.egg-info → etlplus-0.3.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: etlplus
-Version: 0.3.10
+Version: 0.3.13
 Summary: A Swiss Army knife for simple ETL operations
 Home-page: https://github.com/Dagitali/ETLPlus
 Author: ETLPlus Team

{etlplus-0.3.10 → etlplus-0.3.13/etlplus.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: etlplus
-Version: 0.3.10
+Version: 0.3.13
 Summary: A Swiss Army knife for simple ETL operations
 Home-page: https://github.com/Dagitali/ETLPlus
 Author: ETLPlus Team