Merge pull request #5737 from plotly/cleanup-ci-workflows

[CHORE]: CI workflow cleanup and tightening

Author: emilykl

.github/actions/setup-chrome-for-pytest/action.yml

@@ -5,7 +5,7 @@ runs:
   steps:
     - name: Set up Chrome
       id: setup-chrome
-      uses: browser-actions/setup-chrome@4f8e94349a351df0f048634f25fec36c3c91eded  # v2.1.1
+      uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
       with:
         install-chromedriver: true
     - name: Set BROWSER env var

.github/dependabot.yml

@@ -20,7 +20,9 @@ updates:
 
   # Update pinned versions for third-party GitHub Actions workflows
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"                   # Only covers .github/workflows/
+      - "/.github/actions/*"  # Covers all subdirectories under .github/actions/
     schedule:
       interval: "weekly"
     groups:

.github/workflows/build-doc.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   build-doc:
     runs-on: ubuntu-latest
@@ -42,8 +45,13 @@ jobs:
           cd doc
           source .venv/bin/activate
           make -kj8 || make -kj8
-          curl https://raw.githubusercontent.com/plotly/graphing-library-docs/master/front-matter-ci.py > front-matter-ci.py
-          curl https://raw.githubusercontent.com/plotly/graphing-library-docs/master/check-or-enforce-order.py > check-or-enforce-order.py
+          # Fetch scripts from plotly/graphing-library-docs, pinned to a specific commit SHA 
+          # to guard against unauthorized changes in that repo. If changes are made to the
+          # below-referenced scripts in plotly/graphing-library-docs, update DOCS_CI_REF
+          # accordingly to point to the latest commit SHA.
+          DOCS_CI_REF=e05eaed1ae800139df084e0587762aa273a4f19d
+          curl -fsSL https://raw.githubusercontent.com/plotly/graphing-library-docs/$DOCS_CI_REF/front-matter-ci.py > front-matter-ci.py
+          curl -fsSL https://raw.githubusercontent.com/plotly/graphing-library-docs/$DOCS_CI_REF/check-or-enforce-order.py > check-or-enforce-order.py
           python front-matter-ci.py build/html
           python check-or-enforce-order.py build/html
 

.github/workflows/build-package.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   plotlyjs-dev-build:
     name: plotly.js dev build
@@ -27,7 +30,7 @@ jobs:
         run: |
           uv venv
           source .venv/bin/activate
-          uv sync --extra dev_optional
+          uv sync --locked --extra dev_optional
       - name: Update plotly.js to dev
         run: |
           source .venv/bin/activate
@@ -39,7 +42,7 @@ jobs:
       - name: Build source distribution packages
         run: |
           source .venv/bin/activate
-          uv sync --extra dev_build
+          uv sync --locked --extra dev_build
           python -m build --sdist --wheel -o dist
       - name: Upload dist artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -67,7 +70,7 @@ jobs:
         run: |
           uv venv
           source .venv/bin/activate
-          uv sync --extra dev_build
+          uv sync --locked --extra dev_build
           cd js
           npm ci
           npm run build

.github/workflows/check-codegen.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check-python-codegen:
     name: Check Python codegen
@@ -26,7 +29,7 @@ jobs:
         uv venv
         source .venv/bin/activate
         uv lock --check
-        uv sync --extra dev_codegen
+        uv sync --locked --extra dev_codegen
     - name: Run codegen
       run: |
         source .venv/bin/activate

.github/workflows/check-formatting.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check-code-formatting:
     name: Run ruff check
@@ -23,7 +26,7 @@ jobs:
         run: |
           uv venv
           source .venv/bin/activate
-          uv sync --extra dev_core
+          uv sync --locked --extra dev_core
       - name: Check handwritten code with ruff
         run: |
           source .venv/bin/activate

.github/workflows/check-js-build.yml

@@ -3,13 +3,16 @@ on:
     branches:
       - main
   pull_request:
-    types: [opened, reopened]
+    types: [opened, reopened, synchronize]
     paths:
       - 'js/**'
       - 'plotly/labextension/**'
 
 name: Check JS build
 
+permissions:
+  contents: read
+
 jobs:
   check-js-build:
     name: Check JS version number and build artifacts
@@ -51,7 +54,7 @@ jobs:
         source .venv/bin/activate
         # Technically, we only need the `jupyter-builder` package, but using the dev_build extra
         # keeps build behavior consistent across all CI jobs
-        uv sync --extra dev_build
+        uv sync --locked --extra dev_build
         cd js
         npm ci
         npm run build

.github/workflows/run-percy.yml

@@ -8,6 +8,9 @@ on:
     types: [opened, reopened, synchronize]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   python-311-percy:
     name: Run Percy
@@ -36,7 +39,7 @@ jobs:
         run: |
           uv venv
           source .venv/bin/activate
-          uv sync --extra dev_optional
+          uv sync --locked --extra dev_optional
       - name: Build HTML figures (Pandas 2)
         run: |
           source .venv/bin/activate

.github/workflows/run-pytest.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   test-core:
     name: Core tests (Python ${{ matrix.python-version }})
@@ -28,7 +31,7 @@ jobs:
           uv venv
           source .venv/bin/activate
           uv lock --check
-          uv sync --extra dev_core
+          uv sync --locked --extra dev_core
           python --version
       - name: Test core
         run: |
@@ -56,7 +59,7 @@ jobs:
         run: |
           uv venv
           source .venv/bin/activate
-          uv sync --extra dev_optional --extra dev_pandas3
+          uv sync --locked --extra dev_optional --extra dev_pandas3
           python --version
       - name: Test core
         run: |
@@ -108,7 +111,7 @@ jobs:
         run: |
           uv venv
           source .venv/bin/activate
-          uv sync --extra dev_optional --extra dev_pandas${{ matrix.pandas-version }}
+          uv sync --locked --extra dev_optional --extra dev_pandas${{ matrix.pandas-version }}
       - name: Test core
         run: |
           source .venv/bin/activate
@@ -153,7 +156,7 @@ jobs:
         run: |
           uv venv
           source .venv/bin/activate
-          uv sync --extra dev_optional
+          uv sync --locked --extra dev_optional
           uv pip uninstall kaleido
           uv pip install kaleido==0.2.1
           python --version

.github/workflows/test-release.yml

@@ -3,6 +3,9 @@ name: Test release
 on:
   workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Full prod build
@@ -68,6 +71,6 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution 📦 to TestPyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
       with:
-        repository-url: https://test.pypi.org/legacy/
+        repository-url: https://test.pypi.org/legacy/