Skip to content

Commit d701e0a

Browse files
tacaswelltacaswell
committed
CI: Restrict default permissions
Reduces risk of arbitrary code is run by attacker.
1 parent ddb5781 commit d701e0a

File tree

4 files changed

+121
-53
lines changed

4 files changed

+121
-53
lines changed

‎.github/workflows/basemap-data-hires.yml

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,11 @@ jobs:
5858
-
5959
name: Build sdist and wheel
6060
run: |
61-
cd ${{ env.PKGDIR }}
61+
cd ${PKGDIR}
6262
python setup.py sdist
6363
pip wheel -w dist --no-deps dist/*.zip
64+
env:
65+
PKGDIR: ${{ env.PKGDIR }}
6466
-
6567
name: Upload build artifacts
6668
uses: actions/upload-artifact@v4
@@ -95,7 +97,9 @@ jobs:
9597
-
9698
name: Install package
9799
run: |
98-
pip install ${{ env.PKGDIR }}/dist/*.whl
100+
pip install ${PKGDIR}/dist/*.whl
101+
env:
102+
PKGDIR: ${{ env.PKGDIR }}
99103
-
100104
name: Test package
101105
run: |
@@ -127,15 +131,18 @@ jobs:
127131
name: Check distributables
128132
run: |
129133
python -m twine check \
130-
${{ env.PKGDIR }}/dist/*.zip \
131-
${{ env.PKGDIR }}/dist/*.whl
134+
${PKGDIR}/dist/*.zip \
135+
${PKGDIR}/dist/*.whl
136+
env:
137+
PKGDIR: ${{ env.PKGDIR }}
132138
-
133139
name: Upload distributables
134140
env:
135141
TWINE_USERNAME: __token__
136-
TWINE_PASSWORD: "${{ secrets.PYPI_TOKEN }}"
137-
TWINE_REPOSITORY_URL: "${{ secrets.PYPI_REPOSITORY_URL }}"
142+
TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
143+
TWINE_REPOSITORY_URL: ${{ secrets.PYPI_REPOSITORY_URL }}
144+
PKGDIR: ${{ env.PKGDIR }}
138145
run: |
139146
python -m twine upload --skip-existing \
140-
${{ env.PKGDIR }}/dist/*.zip \
141-
${{ env.PKGDIR }}/dist/*.whl
147+
${PKGDIR}/dist/*.zip \
148+
${PKGDIR}/dist/*.whl

‎.github/workflows/basemap-data.yml

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,11 @@ jobs:
5858
-
5959
name: Build sdist and wheel
6060
run: |
61-
cd ${{ env.PKGDIR }}
61+
cd ${PKGDIR}
6262
python setup.py sdist
6363
pip wheel -w dist --no-deps dist/*.zip
64+
env:
65+
PKGDIR: ${{ env.PKGDIR }}
6466
-
6567
name: Upload build artifacts
6668
uses: actions/upload-artifact@v4
@@ -95,7 +97,9 @@ jobs:
9597
-
9698
name: Install package
9799
run: |
98-
pip install ${{ env.PKGDIR }}/dist/*.whl
100+
pip install ${PKGDIR}/dist/*.whl
101+
env:
102+
PKGDIR: ${{ env.PKGDIR }}
99103
-
100104
name: Test package
101105
run: |
@@ -127,15 +131,18 @@ jobs:
127131
name: Check distributables
128132
run: |
129133
python -m twine check \
130-
${{ env.PKGDIR }}/dist/*.zip \
131-
${{ env.PKGDIR }}/dist/*.whl
134+
${PKGDIR}/dist/*.zip \
135+
${PKGDIR}/dist/*.whl
136+
env:
137+
PKGDIR: ${{ env.PKGDIR }}
132138
-
133139
name: Upload distributables
134140
env:
135141
TWINE_USERNAME: __token__
136-
TWINE_PASSWORD: "${{ secrets.PYPI_TOKEN }}"
137-
TWINE_REPOSITORY_URL: "${{ secrets.PYPI_REPOSITORY_URL }}"
142+
TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
143+
TWINE_REPOSITORY_URL: ${{ secrets.PYPI_REPOSITORY_URL }}
144+
PKGDIR: ${{ env.PKGDIR }}
138145
run: |
139146
python -m twine upload --skip-existing \
140-
${{ env.PKGDIR }}/dist/*.zip \
141-
${{ env.PKGDIR }}/dist/*.whl
147+
${PKGDIR}/dist/*.zip \
148+
${PKGDIR}/dist/*.whl

‎.github/workflows/basemap-for-manylinux.yml

Lines changed: 55 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -59,27 +59,35 @@ jobs:
5959
-
6060
name: Install lint requirements
6161
run: |
62-
cd ${{ env.PKGDIR }}
62+
cd ${PKGDIR}
6363
pip install -r requirements-lint.txt
64+
env:
65+
PKGDIR: ${{ env.PKGDIR }}
6466
-
6567
name: Install library requirements
6668
run: |
67-
cd ${{ env.PKGDIR }}
69+
cd ${PKGDIR}
6870
pip install -r requirements.txt
71+
env:
72+
PKGDIR: ${{ env.PKGDIR }}
6973
-
7074
name: Run Flake8
7175
run: |
72-
cd ${{ env.PKGDIR }}
76+
cd ${PKGDIR}
7377
if [ -x "$(command -v flake8)" ]; then
7478
flake8 src/mpl_toolkits/basemap/cm.py src/mpl_toolkits/basemap/diagnostic.py src/mpl_toolkits/basemap/proj.py src/mpl_toolkits/basemap/solar.py test;
7579
fi
80+
env:
81+
PKGDIR: ${{ env.PKGDIR }}
7682
-
7783
name: Run PyLint
7884
run: |
79-
cd ${{ env.PKGDIR }}
85+
cd ${PKGDIR}
8086
if [ -x "$(command -v pylint)" ]; then
8187
pylint src/mpl_toolkits/basemap/cm.py src/mpl_toolkits/basemap/diagnostic.py src/mpl_toolkits/basemap/proj.py src/mpl_toolkits/basemap/solar.py test;
8288
fi
89+
env:
90+
PKGDIR: ${{ env.PKGDIR }}
8391

8492
build-geos:
8593
strategy:
@@ -121,8 +129,10 @@ jobs:
121129
-
122130
name: Build GEOS from source
123131
run: |
124-
cd ${{ env.PKGDIR }}
132+
cd ${PKGDIR}
125133
python -c "import utils; utils.GeosLibrary('3.6.5').build('extern', njobs=16)"
134+
env:
135+
PKGDIR: ${{ env.PKGDIR }}
126136
-
127137
name: Upload GEOS artifacts
128138
uses: actions/upload-artifact@v1
@@ -193,17 +203,19 @@ jobs:
193203
name: Build wheel
194204
run: |
195205
sitepkgdir=$(pip show numpy 2>/dev/null | grep Location: | cut -d' ' -f2)
196-
export GEOS_DIR="${GITHUB_WORKSPACE}/${{ env.PKGDIR }}/extern"
206+
export GEOS_DIR="${GITHUB_WORKSPACE}/${PKGDIR}/extern"
197207
export NUMPY_INCLUDE_PATH=${sitepkgdir}/numpy/core/include
198208
case "${{ matrix.python-version }}" in
199209
3.11|3.12)
200210
kwds="--no-build-isolation"
201211
pip install setuptools wheel "cython >= 0.29, < 3.1"
202212
;;
203213
esac
204-
cd ${{ env.PKGDIR }}
214+
cd ${PKGDIR}
205215
python setup.py sdist
206216
pip wheel -w dist --no-deps ${kwds} dist/*.zip
217+
env:
218+
PKGDIR: ${{ env.PKGDIR }}
207219
-
208220
name: Upload build artifacts
209221
uses: actions/upload-artifact@v1
@@ -246,9 +258,11 @@ jobs:
246258
-
247259
name: Repair wheel
248260
run: |
249-
cd ${{ env.PKGDIR }}
261+
cd ${PKGDIR}
250262
export LD_LIBRARY_PATH="$(readlink -f extern/lib)"
251263
auditwheel repair -w dist dist/*.whl
264+
env:
265+
PKGDIR: ${{ env.PKGDIR }}
252266
-
253267
name: Upload build artifacts
254268
uses: actions/upload-artifact@v1
@@ -296,21 +310,27 @@ jobs:
296310
-
297311
name: Install test requirements
298312
run: |
299-
cd ${{ env.PKGDIR }}
313+
cd ${PKGDIR}
300314
pip install -r requirements-test.txt
315+
env:
316+
PKGDIR: ${{ env.PKGDIR }}
301317
-
302318
name: Install package (full)
303319
run: |
304-
whlpath=$(ls ${{ env.PKGDIR }}/dist/*-manylinux1*.whl | head -n1)
320+
whlpath=$(ls ${PKGDIR}/dist/*-manylinux1*.whl | head -n1)
305321
pip install "${whlpath}[owslib,pillow]"
322+
env:
323+
PKGDIR: ${{ env.PKGDIR }}
306324
-
307325
name: Test package
308326
run: |
309-
cd ${{ env.PKGDIR }}
327+
cd ${PKGDIR}
310328
export COVERAGE_FILE=.coverage.${{ matrix.python-version }}
311329
python -m pytest \
312330
--cov="mpl_toolkits.basemap" --cov-report=term \
313331
--ignore=dist --ignore=build
332+
env:
333+
PKGDIR: ${{ env.PKGDIR }}
314334
-
315335
name: Upload test artifacts
316336
uses: actions/upload-artifact@v1
@@ -337,15 +357,19 @@ jobs:
337357
-
338358
name: Install test requirements
339359
run: |
340-
cd ${{ env.PKGDIR }}
360+
cd ${PKGDIR}
341361
pip install -r requirements-test.txt
362+
env:
363+
PKGDIR: ${{ env.PKGDIR }}
342364
-
343365
name: Compute combined coverage
344366
run: |
345-
cd ${{ env.PKGDIR }}
367+
cd ${PKGDIR}
346368
coverage combine
347369
coverage html
348370
coverage report
371+
env:
372+
PKGDIR: ${{ env.PKGDIR }}
349373
-
350374
name: Upload coverage artifacts
351375
uses: actions/upload-artifact@v1
@@ -367,8 +391,10 @@ jobs:
367391
-
368392
name: Install doc requirements
369393
run: |
370-
cd ${{ env.PKGDIR }}
394+
cd ${PKGDIR}
371395
pip install -r requirements-doc.txt
396+
env:
397+
PKGDIR: ${{ env.PKGDIR }}
372398
-
373399
name: Download build artifacts
374400
uses: actions/download-artifact@v1
@@ -378,13 +404,17 @@ jobs:
378404
-
379405
name: Install package
380406
run: |
381-
cd ${{ env.PKGDIR }}
407+
cd ${PKGDIR}
382408
pip install dist/*-manylinux1*.whl
409+
env:
410+
PKGDIR: ${{ env.PKGDIR }}
383411
-
384412
name: Run sphinx
385413
run: |
386-
cd ${{ env.PKGDIR }}
414+
cd ${PKGDIR}
387415
python -m sphinx doc/source public
416+
env:
417+
PKGDIR: ${{ env.PKGDIR }}
388418
-
389419
name: Upload docs artifacts
390420
uses: actions/upload-artifact@v1
@@ -441,15 +471,18 @@ jobs:
441471
name: Check distributables
442472
run: |
443473
python -m twine check \
444-
${{ env.PKGDIR }}/dist/*.zip \
445-
${{ env.PKGDIR }}/dist/*-manylinux1*.whl
474+
${PKGDIR}/dist/*.zip \
475+
${PKGDIR}/dist/*-manylinux1*.whl
476+
env:
477+
PKGDIR: ${{ env.PKGDIR }}
446478
-
447479
name: Upload distributables
448480
env:
449481
TWINE_USERNAME: __token__
450-
TWINE_PASSWORD: "${{ secrets.PYPI_TOKEN }}"
451-
TWINE_REPOSITORY_URL: "${{ secrets.PYPI_REPOSITORY_URL }}"
482+
TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
483+
TWINE_REPOSITORY_URL: ${{ secrets.PYPI_REPOSITORY_URL }}
484+
PKGDIR: ${{ env.PKGDIR }}
452485
run: |
453486
python -m twine upload --skip-existing \
454-
${{ env.PKGDIR }}/dist/*.zip \
455-
${{ env.PKGDIR }}/dist/*-manylinux1*.whl
487+
${PKGDIR}/dist/*.zip \
488+
${PKGDIR}/dist/*-manylinux1*.whl

0 commit comments

Comments
 (0)