execsql2 2.17.3__tar.gz → 2.18.0__tar.gz

execsql2-2.18.0/.github/dependabot.yml

@@ -0,0 +1,21 @@
+# Dependabot keeps the SHA-pinned GitHub Actions in ci-cd.yml up to
+# date. The audit's B22 finding (F059) called out that pinning to
+# major-version tags (e.g. `actions/checkout@v6`) is supply-chain
+# exposure — an attacker who compromises the repo can retag any v6.x
+# release to point at malicious code and every consumer pulls it on
+# the next run. Pinning to a 40-char SHA closes that hole, but the
+# pins must be refreshed when upstream ships a real new release;
+# Dependabot files a PR with the new SHA and a CHANGELOG link.
+version: 2
+updates:
+    - package-ecosystem: github-actions
+      directory: /
+      schedule:
+          interval: weekly
+      groups:
+          actions-minor-and-patch:
+              patterns:
+                  - "*"
+              update-types:
+                  - minor
+                  - patch

{execsql2-2.17.3 → execsql2-2.18.0}/.github/workflows/ci-cd.yml

@@ -20,8 +20,8 @@ jobs:
         permissions:
             contents: read
         steps:
-            - uses: actions/checkout@v6
-            - uses: actions/setup-python@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+            - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
               with:
                   python-version: "3.13"
             - run: python -m pip install ruff
@@ -48,13 +48,13 @@ jobs:
             contents: read
         steps:
             - name: Check out repository code
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
             - name: Setup Python ${{ matrix.python-version }}
-              uses: actions/setup-python@v6
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
               with:
                   python-version: ${{ matrix.python-version }}
             - name: Cache pip dependencies
-              uses: actions/cache@v5
+              uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
               with:
                   path: ~/.cache/pip
                   key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{
@@ -86,7 +86,7 @@ jobs:
                   tox -e py
             - name: Upload coverage to Codecov
               if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.13'
-              uses: codecov/codecov-action@v6
+              uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354  # v6.0.1
               with:
                   token: ${{ secrets.CODECOV_TOKEN }}
                   files: coverage.xml
@@ -139,9 +139,9 @@ jobs:
                     --health-interval 10s --health-timeout 5s --health-retries 20
         steps:
             - name: Check out repository code
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
             - name: Setup Python ${{ matrix.python-version }}
-              uses: actions/setup-python@v6
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
               with:
                   python-version: ${{ matrix.python-version }}
             - name: Install tkinter (Ubuntu)
@@ -167,7 +167,7 @@ jobs:
               run: |
                   python -m pytest --cov=execsql --cov-branch --cov-report=xml --cov-fail-under=86
             - name: Upload coverage to Codecov
-              uses: codecov/codecov-action@v6
+              uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354  # v6.0.1
               with:
                   token: ${{ secrets.CODECOV_TOKEN }}
                   files: coverage.xml
@@ -186,8 +186,8 @@ jobs:
         permissions:
             contents: read
         steps:
-            - uses: actions/checkout@v6
-            - uses: actions/setup-python@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+            - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
               with:
                   python-version: ${{ matrix.python-version }}
             - name: Install Microsoft Access Database Engine 2016 (x64)
@@ -226,9 +226,9 @@ jobs:
         permissions:
             contents: read
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
             - name: Set up Python
-              uses: actions/setup-python@v6
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
               with:
                   python-version: "3.13"
                   cache: "pip"
@@ -239,7 +239,7 @@ jobs:
                   python -m build --sdist --wheel --outdir dist/
                   python -m twine check dist/*
             - name: Upload dist artifact
-              uses: actions/upload-artifact@v7
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
               with:
                   name: ${{ github.event.repository.name }}
                   path: dist/
@@ -257,12 +257,12 @@ jobs:
             contents: read
         steps:
             - name: Download dist
-              uses: actions/download-artifact@v8
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
               with:
                   name: ${{ github.event.repository.name }}
                   path: dist/
             - name: Publish to PyPI
-              uses: pypa/gh-action-pypi-publish@release/v1
+              uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
               with:
                   packages-dir: dist
                   skip-existing: true
@@ -276,14 +276,14 @@ jobs:
             contents: write
         steps:
             - name: Checkout
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
             - name: Download dist
-              uses: actions/download-artifact@v8
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
               with:
                   name: ${{ github.event.repository.name }}
                   path: dist/
             - name: Create release
-              uses: softprops/action-gh-release@v2
+              uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2
               with:
                   draft: false
                   prerelease: false