Skip to content

gh-140681: Freeze pre-commit hooks and update zizmor links#140682

Merged
hugovk merged 5 commits intopython:mainfrom
shenxianpeng:update-for-zizmor
Mar 5, 2026
Merged

gh-140681: Freeze pre-commit hooks and update zizmor links#140682
hugovk merged 5 commits intopython:mainfrom
shenxianpeng:update-for-zizmor

Conversation

@shenxianpeng
Copy link
Contributor

@shenxianpeng shenxianpeng commented Oct 27, 2025

gh-140681: Update zizmor repo and doc links

@shenxianpeng shenxianpeng changed the title Update zizmor repo and doc links gh-140681: Update zizmor repo and doc links Oct 27, 2025
@bedevere-app bedevere-app bot mentioned this pull request Oct 27, 2025
Open
@hugovk
Copy link
Member

hugovk commented Oct 27, 2025

We're in no rush here, it still works because of the redirects.

If we're going to update this, we might as well update the others (for example, prek autoupdate --jobs 0 or pre-commit autoupdate --jobs 0).

We can also now remove the self-hosted-runner of .github/actionlint.yaml.

And there might be a Sphinx Lint release fairly soon, so could also wait for that.

@hugovk hugovk added the infra CI, GitHub Actions, buildbots, Dependabot, etc. label Oct 27, 2025
@hugovk hugovk changed the title gh-140681: Update zizmor repo and doc links gh-140681: Freeze pre-commit hooks and update zizmor links Mar 4, 2026
@hugovk hugovk added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Mar 4, 2026
@hugovk
Copy link
Member

hugovk commented Mar 4, 2026

As this was still open, I've updated it to also freeze the pre-commit hooks, as discussed at python/devguide#1748 (review). In short, if a repo became compromised, they could rewrite the tag to something malicious. Git SHAs can mitigate this.

If we're going to update this, we might as well update the others (for example, prek autoupdate --jobs 0 or pre-commit autoupdate --jobs 0).

We can also now remove the self-hosted-runner of .github/actionlint.yaml.

I did these too.

@hugovk hugovk mentioned this pull request Mar 4, 2026
Merged
@hugovk hugovk merged commit 11840ca into python:main Mar 5, 2026
53 checks passed
@miss-islington-app
Copy link

miss-islington-app bot commented Mar 5, 2026

Thanks @shenxianpeng for the PR, and @hugovk for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

@miss-islington-app
Copy link

miss-islington-app bot commented Mar 5, 2026

Sorry, @shenxianpeng and @hugovk, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 11840ca99ae809c1c8401b4f34d2820de55e27a0 3.14

@miss-islington-app
Copy link

miss-islington-app bot commented Mar 5, 2026

Sorry, @shenxianpeng and @hugovk, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 11840ca99ae809c1c8401b4f34d2820de55e27a0 3.13

hugovk added a commit to hugovk/cpython that referenced this pull request Mar 5, 2026
@shenxianpeng @StanFromIreland @hugovk
[3.14] pythongh-140681: Freeze pre-commit hooks and update zizmor lin…
6e7327c 
…ks (pythonGH-140682)

(cherry picked from commit 11840ca)

Co-authored-by: Xianpeng Shen <xianpeng.shen@gmail.com>
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
@bedevere-app
Copy link

bedevere-app bot commented Mar 5, 2026

GH-145536 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Mar 5, 2026
hugovk added a commit to hugovk/cpython that referenced this pull request Mar 5, 2026
@shenxianpeng @StanFromIreland @hugovk
pythongh-140681: Freeze pre-commit hooks and update zizmor links (pyt…
a64edd4 
…hon#140682)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
@hugovk
Copy link
Member

hugovk commented Mar 5, 2026 •
edited
Loading

3.13 blocked by GH-144593 so cherry-picked into that one.

@hugovk hugovk removed the needs backport to 3.13 bugs and security fixes label Mar 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@webknjaz webknjaz webknjaz approved these changes

@hugovk hugovk hugovk approved these changes

@sethmlarson sethmlarson sethmlarson approved these changes

@StanFromIreland StanFromIreland StanFromIreland approved these changes

@ezio-melotti ezio-melotti Awaiting requested review from ezio-melotti ezio-melotti is a code owner

@AA-Turner AA-Turner Awaiting requested review from AA-Turner AA-Turner is a code owner

Assignees

@hugovk hugovk

Labels

infra CI, GitHub Actions, buildbots, Dependabot, etc. skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@shenxianpeng @hugovk @webknjaz @sethmlarson @StanFromIreland