GitHub Actions Updates

[jacobwoffenden]

Type of PR

• BUG
• FEAT
• MAINT
• DOC

Is your Pull Request linked to an existing Issue or Pull Request?

Not yet?

Give a brief description for the solution you have provided

• Adds dependency review and CodeQL workflows
• Adds Dependabot for dependency management
• Refactors GitHub Actions workflows, pinning versions and ensuring steps have IDs
• Switch to GitHub's native publishing workflow for documentation (see https://github.com/ministryofjustice/template-documentation-site/blob/main/.github/workflows/publish.yml)

PR Checklist

• Added documentation for changes
• Added feature to example notebooks or tutorial (if appropriate)
• Added tests (if appropriate)
• Updated CHANGELOG.md (if appropriate)
• Made changes based off the latest version of Splink
• Run the linter
• Run the spellchecker (if appropriate)

---

Notes

Zizmor's current output is

(splink) vscode ➜ /workspaces/splink (feat/gha-updates) $ uvx zizmor .
🌈 zizmor v1.19.0
 INFO audit: zizmor: 🌈 completed ./.github/dependabot.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/check-minimal-import.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/codeql-analysis.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/demo-examples.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/demo-tutorials.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/dependency-canary.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/dependency-review.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/documentation.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/lint.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/mypy.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/pypi-release.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/pytest-duckdb.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/pytest-postgres.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/pytest-spark.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/pytest-sqlite.yml
info[use-trusted-publishing]: prefer trusted publishing for authentication
  --> ./.github/workflows/pypi-release.yml:39:14
   |
39 |         run: uv publish --token ${{ secrets.PYPI_API_TOKEN }}
   |         ---  ^^^^^^^^^^^^^^^^^^ this command
   |         |
   |         this step
   |
   = note: audit confidence → High

error[unpinned-images]: unpinned image references
  --> ./.github/workflows/pytest-postgres.yml:25:9
   |
25 |         image: postgres
   |         ^^^^^^^^^^^^^^^ container image is unpinned
   |
   = note: audit confidence → High

35 findings (33 suppressed): 1 informational, 0 low, 0 medium, 1 high

TODO

• Remove self reference for workflows

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	8e8c483db84b4bee98b60c0593521ed34d9990e8	🟢 6.5	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 5 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Vulnerabilities 🟢 9 1 existing vulnerabilities detected SAST 🟢 8 SAST tool detected but not run on all commits Security-Policy 🟢 9 security policy file detected
actions/astral-sh/setup-uv	681c641aba71e4a1c380be3ab5e12ad51f415867	Unknown	Unknown
actions/actions/checkout	8e8c483db84b4bee98b60c0593521ed34d9990e8	🟢 6.5	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 5 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Vulnerabilities 🟢 9 1 existing vulnerabilities detected SAST 🟢 8 SAST tool detected but not run on all commits Security-Policy 🟢 9 security policy file detected
actions/astral-sh/setup-uv	681c641aba71e4a1c380be3ab5e12ad51f415867	Unknown	Unknown

Scanned Files

• .github/workflows/check_minimal_import.yml
• .github/workflows/mypy.yml
• .github/workflows/pytest-sqlite.yml
• .github/workflows/pytest_sqlite.yml
• .github/workflows/test_latest_dependency_versions.yml

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[RobinL]

A few minor comments on the docs workflow - thanks.

Actually realised I should try actually running all the tests using these new files - that's running here:
RobinL#8

EDIT: OK, that's run fine, so looks like this is all good except for the docs issues as mentioned

[ADBond]

Cheers for this @jacobwoffenden, all looks good, happy to merge this