ci: Supply Chain Hardening

.github/workflows/ci.yml

@@ -2,31 +2,35 @@ name: ci
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   test:
 
     runs-on: ubuntu-latest
 
     strategy:
       matrix:
-        python-version: [ '3.6', '3.7', '3.8', '3.9', '3.10' ]
+        python-version: [ '3.10', '3.11' ]
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@28f2168f4d98ee0445e3c6321f6e6616c83dd5ec
         with:
           python-version: ${{ matrix.python-version }}
+          cache: 'pip'
       - name: Install requirements
         run: |
-          python -m pip install -r requirements.txt
-          python setup.py install
+          python -m pip install --require-hashes -r requirements.txt
+          pip install .
       - name: Check source files
         if: matrix.python-version == '3.10'
         run: |
-          python -m pip install pytest-pycodestyle
-          python -m pip install pytest-flakes
+          python -m pip install pytest-pycodestyle --require-hashes --hash=sha256:dd0060039e12a59b521da8e57e17133c965566dd8d17631e589e7545238829ac
+          python -m pip install pytest-flakes --require-hashes --hash=sha256:953134e97215ae31f6879fbd7368c18d43f709dc2fab5b7777db2bb2bac3a924
           py.test --pycodestyle ftw
           py.test --flakes ftw
       - name: Run tests

.github/workflows/publish.yml

@@ -4,25 +4,28 @@ on:
   release:
     types: [created]
 
+permissions: 
+  contents: read
+
 jobs:
   deploy:
 
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@28f2168f4d98ee0445e3c6321f6e6616c83dd5ec
       with:
-        python-version: '3.x'
+        python-version: '3.11'
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install setuptools wheel twine
+        python -m pip install --require-hashes -r requirements-build.txt
     - name: Build and publish
       env:
         TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
         TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
       run: |
-        python setup.py sdist bdist_wheel
+        python -m build
         twine upload dist/*

requirements-build.txt

@@ -0,0 +1,3 @@
+twine==6.2.0 --hash sha256:418ebf08ccda9a8caaebe414433b0ba5e25eb5e4a927667122fbe8f829f985d8
+wheel==0.46.3 --hash sha256:e3e79874b07d776c40bd6033f8ddf76a7dad46a7b8aa1b2787a83083519a1803
+setuptools=82.0.1 --hash sha256:7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9

requirements.txt

@@ -1,5 +1,5 @@
-Brotli==1.0.9
-IPy==1.01
-PyYAML==6.0
-pytest==6.2.5
-python-dateutil==2.8.2
+Brotli==1.2.0 --hash=sha256:e310f77e41941c13340a95976fe66a8a95b01e783d430eeaf7a2f87e0a57dd0a
+IPy==1.01 --hash=sha256:edeca741dea2d54aca568fa23740288c3fe86c0f3ea700344571e9ef14a7cc1a
+PyYAML==6.0.3 --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f
+pytest==9.0.2 --hash=sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11
+python-dateutil==2.9.0 --hash=sha256:cbf2f1da5e6083ac2fbfd4da39a25f34312230110440f424a14c7558bb85d82e