Add a workflow vulnerability scanner#61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dkfellows wants to merge 8 commits into
base:main
Choose a base branch
from
Open

Add a workflow vulnerability scanner #61

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
1e7e0c1
Add a workflow vulnerability scanner
dkfellows May 18, 2026
e2dd2a2
Starting to address the issues
dkfellows May 18, 2026
69c39cd
Reducing template problems
dkfellows May 18, 2026
f894272
Reducing template problems
dkfellows May 18, 2026
c3e0269
Tweaks
dkfellows May 18, 2026
8fdc559
Commit ID binding
dkfellows May 18, 2026
b436398
Fix the caching action
dkfellows May 18, 2026
8d5cdc8
Woah there, dependabot!
dkfellows May 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -4,3 +4,5 @@ updates:
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7
24 changes: 14 additions & 10 deletions .github/workflows/benchmark-impl.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -58,19 +58,20 @@ jobs:
runs-on: ${{ matrix.os }}
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ inputs.ref }}
persist-credentials: false
- name: Set up python ${{ matrix.python-version }}
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ matrix.python-version }}
- name: Set up poetry
uses: hpcflow/github-support/setup-poetry@0.5
uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
with:
version: ${{ inputs.poetry-version }}
- name: Cache dependencies
uses: hpcflow/github-support/init-cache@0.5
uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
with:
name: benchmark
version: ${{ matrix.python-version }}
Expand All@@ -82,12 +83,15 @@ jobs:
- name: Set up variables
id: vars
run: |
echo "timeit=benchmark_make_workflow_${{ matrix.num_elements }}_elements-${{ runner.os }}-py-${{ matrix.python-version }}.txt" >> $GITHUB_OUTPUT
echo "timeit=benchmark_make_workflow_${N_ELEMS}_elements-${RUNNER_OS}-py-${PY_VER}.txt" >> $GITHUB_OUTPUT
shell: bash
env:
N_ELEMS: ${{ matrix.num_elements }}
PY_VER: ${{ matrix.python-version }}

- name: Run app make workflow command
run: |
poetry run $EXECUTABLE --timeit-file $TIMEIT_FILE make $BENCHMARK --var N $N_ELEMS
poetry run "$EXECUTABLE" --timeit-file "$TIMEIT_FILE" make $BENCHMARK --var N "$N_ELEMS"
env:
EXECUTABLE: ${{ inputs.executable_name }}
BENCHMARK: ${{ inputs.benchmark_make_workflow }}
Expand All@@ -96,7 +100,7 @@ jobs:
shell: bash

- name: Store benchmark file
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ${{ steps.vars.outputs.timeit }}
path: ${{ steps.vars.outputs.timeit }}
Expand All@@ -112,17 +116,17 @@ jobs:
run: |
mkdir benchmarks
- name: Fetch benchmark data
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
merge-multiple: true
path: benchmarks
- name: Delete partial benchmark data
uses: geekyeggo/delete-artifact@v6
uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
with:
name: "*"
failOnError: false
- name: Store benchmark data archive
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
id: upload
with:
name: benchmarks
Expand Down
258 changes: 170 additions & 88 deletions .github/workflows/build-exes-impl.yml
View file
Open in desktop

Large diffs are not rendered by default.

30 changes: 18 additions & 12 deletions .github/workflows/doc-build-impl.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -85,42 +85,48 @@ jobs:
artifact-url: ${{ steps.upload.outputs.artifact-url }}
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ inputs.ref }}
persist-credentials: false
- name: Checkout support code
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
repository: hpcflow/github-support
path: github-support
ref: ${{ inputs.script-branch }}
persist-credentials: false
- name: Init Python ${{ inputs.python-version }}
uses: actions/setup-python@v6
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ inputs.python-version }}
- name: Install and configure poetry ${{ inputs.poetry-version }}
uses: hpcflow/github-support/setup-poetry@0.5
uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
with:
version: ${{ inputs.poetry-version }}
- name: Cache Virtual Environment
uses: hpcflow/github-support/init-cache@0.5
uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
with:
name: sphinx
version: ${{ inputs.python-version }}
- name: Install Dependencies
run: |
poetry install ${{ inputs.install-args }}
poetry install $Args
env:
Args: ${{ inputs.install-args }}
- name: Configure Problem Matcher
run: echo "::add-matcher::github-support/problem-matchers/sphinx.json"
# See: https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md
# See: https://github.com/python/cpython/pull/20325
- name: Run Sphinx
run: |
poetry run make clean html ${{ inputs.sphinx-args }}
poetry run make clean html $Args
env:
Args: ${{ inputs.sphinx-args }}
working-directory: docs
- name: Upload documentation artifact
id: upload
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ${{ inputs.artifact-root-name }}-documentation (${{ inputs.ref }})
path: docs/build/html
Expand All@@ -146,17 +152,17 @@ jobs:
page-url: ${{ steps.deployment.outputs.page_url }}
steps:
- name: Download documentation artifact
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
path: site
merge-multiple: true
- name: Setup GitHub Pages
uses: actions/configure-pages@v6
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
- name: Upload artifact to documentation staging
uses: actions/upload-pages-artifact@v5
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
with:
# Upload dist repository
path: site
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v5
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Add a workflow vulnerability scanner#61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

dkfellows
wants to merge
8
commits into

base:main
Choose a base branch

from

 Open


Add a workflow vulnerability scanner
#61
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
1e7e0c1

Add a workflow vulnerability scanner


dkfellows May 18, 2026
e2dd2a2

Starting to address the issues


dkfellows May 18, 2026
69c39cd

Reducing template problems


dkfellows May 18, 2026
f894272

Reducing template problems


dkfellows May 18, 2026
c3e0269

Tweaks


dkfellows May 18, 2026
8fdc559

Commit ID binding


dkfellows May 18, 2026
b436398

Fix the caching action


dkfellows May 18, 2026
8d5cdc8

Woah there, dependabot!


dkfellows May 18, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,3 +4,5 @@ updates:
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7

24 changes: 14 additions & 10 deletions
.github/workflows/benchmark-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -58,19 +58,20 @@ jobs:
 runs-on: ${{ matrix.os }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Set up python ${{ matrix.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ matrix.python-version }}
 - name: Set up poetry
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache dependencies
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: benchmark
 version: ${{ matrix.python-version }}
Expand All@@ -82,12 +83,15 @@ jobs:
 - name: Set up variables
 id: vars
 run: |
 echo "timeit=benchmark_make_workflow_${{ matrix.num_elements }}_elements-${{ runner.os }}-py-${{ matrix.python-version }}.txt" >> $GITHUB_OUTPUT
 echo "timeit=benchmark_make_workflow_${N_ELEMS}_elements-${RUNNER_OS}-py-${PY_VER}.txt" >> $GITHUB_OUTPUT
 shell: bash
 env:
 N_ELEMS: ${{ matrix.num_elements }}
 PY_VER: ${{ matrix.python-version }}

 - name: Run app make workflow command
 run: |
 poetry run $EXECUTABLE --timeit-file $TIMEIT_FILE make $BENCHMARK --var N $N_ELEMS
 poetry run "$EXECUTABLE" --timeit-file "$TIMEIT_FILE" make $BENCHMARK --var N "$N_ELEMS"
 env:
 EXECUTABLE: ${{ inputs.executable_name }}
 BENCHMARK: ${{ inputs.benchmark_make_workflow }}
Expand All@@ -96,7 +100,7 @@ jobs:
 shell: bash

 - name: Store benchmark file
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ steps.vars.outputs.timeit }}
 path: ${{ steps.vars.outputs.timeit }}
Expand All@@ -112,17 +116,17 @@ jobs:
 run: |
 mkdir benchmarks
 - name: Fetch benchmark data
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 merge-multiple: true
 path: benchmarks
 - name: Delete partial benchmark data
 uses: geekyeggo/delete-artifact@v6
 uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
 with:
 name: "*"
 failOnError: false
 - name: Store benchmark data archive
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 id: upload
 with:
 name: benchmarks
Expand Down

258 changes: 170 additions & 88 deletions
.github/workflows/build-exes-impl.yml

View file


Open in desktop


Large diffs are not rendered by default.


30 changes: 18 additions & 12 deletions
.github/workflows/doc-build-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -85,42 +85,48 @@ jobs:
 artifact-url: ${{ steps.upload.outputs.artifact-url }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Checkout support code
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 repository: hpcflow/github-support
 path: github-support
 ref: ${{ inputs.script-branch }}
 persist-credentials: false
 - name: Init Python ${{ inputs.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ inputs.python-version }}
 - name: Install and configure poetry ${{ inputs.poetry-version }}
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache Virtual Environment
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: sphinx
 version: ${{ inputs.python-version }}
 - name: Install Dependencies
 run: |
 poetry install ${{ inputs.install-args }}
 poetry install $Args
 env:
 Args: ${{ inputs.install-args }}
 - name: Configure Problem Matcher
 run: echo "::add-matcher::github-support/problem-matchers/sphinx.json"
 # See: https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md
 # See: https://github.com/python/cpython/pull/20325
 - name: Run Sphinx
 run: |
 poetry run make clean html ${{ inputs.sphinx-args }}
 poetry run make clean html $Args
 env:
 Args: ${{ inputs.sphinx-args }}
 working-directory: docs
 - name: Upload documentation artifact
 id: upload
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ inputs.artifact-root-name }}-documentation (${{ inputs.ref }})
 path: docs/build/html
Expand All@@ -146,17 +152,17 @@ jobs:
 page-url: ${{ steps.deployment.outputs.page_url }}
 steps:
 - name: Download documentation artifact
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 path: site
 merge-multiple: true
 - name: Setup GitHub Pages
 uses: actions/configure-pages@v6
 uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 - name: Upload artifact to documentation staging
 uses: actions/upload-pages-artifact@v5
 uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
 with:
 # Upload dist repository
 path: site
 - name: Deploy to GitHub Pages
 id: deployment
 uses: actions/deploy-pages@v5
 uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Add a workflow vulnerability scanner#61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

dkfellows
wants to merge
8
commits into

base:main
Choose a base branch

from

 Open


Add a workflow vulnerability scanner
#61
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
1e7e0c1

Add a workflow vulnerability scanner


dkfellows May 18, 2026
e2dd2a2

Starting to address the issues


dkfellows May 18, 2026
69c39cd

Reducing template problems


dkfellows May 18, 2026
f894272

Reducing template problems


dkfellows May 18, 2026
c3e0269

Tweaks


dkfellows May 18, 2026
8fdc559

Commit ID binding


dkfellows May 18, 2026
b436398

Fix the caching action


dkfellows May 18, 2026
8d5cdc8

Woah there, dependabot!


dkfellows May 18, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,3 +4,5 @@ updates:
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7

24 changes: 14 additions & 10 deletions
.github/workflows/benchmark-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -58,19 +58,20 @@ jobs:
 runs-on: ${{ matrix.os }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Set up python ${{ matrix.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ matrix.python-version }}
 - name: Set up poetry
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache dependencies
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: benchmark
 version: ${{ matrix.python-version }}
Expand All@@ -82,12 +83,15 @@ jobs:
 - name: Set up variables
 id: vars
 run: |
 echo "timeit=benchmark_make_workflow_${{ matrix.num_elements }}_elements-${{ runner.os }}-py-${{ matrix.python-version }}.txt" >> $GITHUB_OUTPUT
 echo "timeit=benchmark_make_workflow_${N_ELEMS}_elements-${RUNNER_OS}-py-${PY_VER}.txt" >> $GITHUB_OUTPUT
 shell: bash
 env:
 N_ELEMS: ${{ matrix.num_elements }}
 PY_VER: ${{ matrix.python-version }}

 - name: Run app make workflow command
 run: |
 poetry run $EXECUTABLE --timeit-file $TIMEIT_FILE make $BENCHMARK --var N $N_ELEMS
 poetry run "$EXECUTABLE" --timeit-file "$TIMEIT_FILE" make $BENCHMARK --var N "$N_ELEMS"
 env:
 EXECUTABLE: ${{ inputs.executable_name }}
 BENCHMARK: ${{ inputs.benchmark_make_workflow }}
Expand All@@ -96,7 +100,7 @@ jobs:
 shell: bash

 - name: Store benchmark file
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ steps.vars.outputs.timeit }}
 path: ${{ steps.vars.outputs.timeit }}
Expand All@@ -112,17 +116,17 @@ jobs:
 run: |
 mkdir benchmarks
 - name: Fetch benchmark data
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 merge-multiple: true
 path: benchmarks
 - name: Delete partial benchmark data
 uses: geekyeggo/delete-artifact@v6
 uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
 with:
 name: "*"
 failOnError: false
 - name: Store benchmark data archive
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 id: upload
 with:
 name: benchmarks
Expand Down

258 changes: 170 additions & 88 deletions
.github/workflows/build-exes-impl.yml

View file


Open in desktop


Large diffs are not rendered by default.


30 changes: 18 additions & 12 deletions
.github/workflows/doc-build-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -85,42 +85,48 @@ jobs:
 artifact-url: ${{ steps.upload.outputs.artifact-url }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Checkout support code
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 repository: hpcflow/github-support
 path: github-support
 ref: ${{ inputs.script-branch }}
 persist-credentials: false
 - name: Init Python ${{ inputs.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ inputs.python-version }}
 - name: Install and configure poetry ${{ inputs.poetry-version }}
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache Virtual Environment
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: sphinx
 version: ${{ inputs.python-version }}
 - name: Install Dependencies
 run: |
 poetry install ${{ inputs.install-args }}
 poetry install $Args
 env:
 Args: ${{ inputs.install-args }}
 - name: Configure Problem Matcher
 run: echo "::add-matcher::github-support/problem-matchers/sphinx.json"
 # See: https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md
 # See: https://github.com/python/cpython/pull/20325
 - name: Run Sphinx
 run: |
 poetry run make clean html ${{ inputs.sphinx-args }}
 poetry run make clean html $Args
 env:
 Args: ${{ inputs.sphinx-args }}
 working-directory: docs
 - name: Upload documentation artifact
 id: upload
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ inputs.artifact-root-name }}-documentation (${{ inputs.ref }})
 path: docs/build/html
Expand All@@ -146,17 +152,17 @@ jobs:
 page-url: ${{ steps.deployment.outputs.page_url }}
 steps:
 - name: Download documentation artifact
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 path: site
 merge-multiple: true
 - name: Setup GitHub Pages
 uses: actions/configure-pages@v6
 uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 - name: Upload artifact to documentation staging
 uses: actions/upload-pages-artifact@v5
 uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
 with:
 # Upload dist repository
 path: site
 - name: Deploy to GitHub Pages
 id: deployment
 uses: actions/deploy-pages@v5
 uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Add a workflow vulnerability scanner#61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

dkfellows
wants to merge
8
commits into

base:main
Choose a base branch

from

 Open


Add a workflow vulnerability scanner
#61
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
1e7e0c1

Add a workflow vulnerability scanner


dkfellows May 18, 2026
e2dd2a2

Starting to address the issues


dkfellows May 18, 2026
69c39cd

Reducing template problems


dkfellows May 18, 2026
f894272

Reducing template problems


dkfellows May 18, 2026
c3e0269

Tweaks


dkfellows May 18, 2026
8fdc559

Commit ID binding


dkfellows May 18, 2026
b436398

Fix the caching action


dkfellows May 18, 2026
8d5cdc8

Woah there, dependabot!


dkfellows May 18, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,3 +4,5 @@ updates:
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7

24 changes: 14 additions & 10 deletions
.github/workflows/benchmark-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -58,19 +58,20 @@ jobs:
 runs-on: ${{ matrix.os }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Set up python ${{ matrix.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ matrix.python-version }}
 - name: Set up poetry
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache dependencies
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: benchmark
 version: ${{ matrix.python-version }}
Expand All@@ -82,12 +83,15 @@ jobs:
 - name: Set up variables
 id: vars
 run: |
 echo "timeit=benchmark_make_workflow_${{ matrix.num_elements }}_elements-${{ runner.os }}-py-${{ matrix.python-version }}.txt" >> $GITHUB_OUTPUT
 echo "timeit=benchmark_make_workflow_${N_ELEMS}_elements-${RUNNER_OS}-py-${PY_VER}.txt" >> $GITHUB_OUTPUT
 shell: bash
 env:
 N_ELEMS: ${{ matrix.num_elements }}
 PY_VER: ${{ matrix.python-version }}

 - name: Run app make workflow command
 run: |
 poetry run $EXECUTABLE --timeit-file $TIMEIT_FILE make $BENCHMARK --var N $N_ELEMS
 poetry run "$EXECUTABLE" --timeit-file "$TIMEIT_FILE" make $BENCHMARK --var N "$N_ELEMS"
 env:
 EXECUTABLE: ${{ inputs.executable_name }}
 BENCHMARK: ${{ inputs.benchmark_make_workflow }}
Expand All@@ -96,7 +100,7 @@ jobs:
 shell: bash

 - name: Store benchmark file
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ steps.vars.outputs.timeit }}
 path: ${{ steps.vars.outputs.timeit }}
Expand All@@ -112,17 +116,17 @@ jobs:
 run: |
 mkdir benchmarks
 - name: Fetch benchmark data
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 merge-multiple: true
 path: benchmarks
 - name: Delete partial benchmark data
 uses: geekyeggo/delete-artifact@v6
 uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
 with:
 name: "*"
 failOnError: false
 - name: Store benchmark data archive
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 id: upload
 with:
 name: benchmarks
Expand Down

258 changes: 170 additions & 88 deletions
.github/workflows/build-exes-impl.yml

View file


Open in desktop


Large diffs are not rendered by default.


30 changes: 18 additions & 12 deletions
.github/workflows/doc-build-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -85,42 +85,48 @@ jobs:
 artifact-url: ${{ steps.upload.outputs.artifact-url }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Checkout support code
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 repository: hpcflow/github-support
 path: github-support
 ref: ${{ inputs.script-branch }}
 persist-credentials: false
 - name: Init Python ${{ inputs.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ inputs.python-version }}
 - name: Install and configure poetry ${{ inputs.poetry-version }}
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache Virtual Environment
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: sphinx
 version: ${{ inputs.python-version }}
 - name: Install Dependencies
 run: |
 poetry install ${{ inputs.install-args }}
 poetry install $Args
 env:
 Args: ${{ inputs.install-args }}
 - name: Configure Problem Matcher
 run: echo "::add-matcher::github-support/problem-matchers/sphinx.json"
 # See: https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md
 # See: https://github.com/python/cpython/pull/20325
 - name: Run Sphinx
 run: |
 poetry run make clean html ${{ inputs.sphinx-args }}
 poetry run make clean html $Args
 env:
 Args: ${{ inputs.sphinx-args }}
 working-directory: docs
 - name: Upload documentation artifact
 id: upload
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ inputs.artifact-root-name }}-documentation (${{ inputs.ref }})
 path: docs/build/html
Expand All@@ -146,17 +152,17 @@ jobs:
 page-url: ${{ steps.deployment.outputs.page_url }}
 steps:
 - name: Download documentation artifact
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 path: site
 merge-multiple: true
 - name: Setup GitHub Pages
 uses: actions/configure-pages@v6
 uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 - name: Upload artifact to documentation staging
 uses: actions/upload-pages-artifact@v5
 uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
 with:
 # Upload dist repository
 path: site
 - name: Deploy to GitHub Pages
 id: deployment
 uses: actions/deploy-pages@v5
 uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Add a workflow vulnerability scanner#61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

dkfellows
wants to merge
8
commits into

base:main
Choose a base branch

from

 Open


Add a workflow vulnerability scanner
#61
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
1e7e0c1

Add a workflow vulnerability scanner


dkfellows May 18, 2026
e2dd2a2

Starting to address the issues


dkfellows May 18, 2026
69c39cd

Reducing template problems


dkfellows May 18, 2026
f894272

Reducing template problems


dkfellows May 18, 2026
c3e0269

Tweaks


dkfellows May 18, 2026
8fdc559

Commit ID binding


dkfellows May 18, 2026
b436398

Fix the caching action


dkfellows May 18, 2026
8d5cdc8

Woah there, dependabot!


dkfellows May 18, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,3 +4,5 @@ updates:
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7

24 changes: 14 additions & 10 deletions
.github/workflows/benchmark-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -58,19 +58,20 @@ jobs:
 runs-on: ${{ matrix.os }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Set up python ${{ matrix.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ matrix.python-version }}
 - name: Set up poetry
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache dependencies
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: benchmark
 version: ${{ matrix.python-version }}
Expand All@@ -82,12 +83,15 @@ jobs:
 - name: Set up variables
 id: vars
 run: |
 echo "timeit=benchmark_make_workflow_${{ matrix.num_elements }}_elements-${{ runner.os }}-py-${{ matrix.python-version }}.txt" >> $GITHUB_OUTPUT
 echo "timeit=benchmark_make_workflow_${N_ELEMS}_elements-${RUNNER_OS}-py-${PY_VER}.txt" >> $GITHUB_OUTPUT
 shell: bash
 env:
 N_ELEMS: ${{ matrix.num_elements }}
 PY_VER: ${{ matrix.python-version }}

 - name: Run app make workflow command
 run: |
 poetry run $EXECUTABLE --timeit-file $TIMEIT_FILE make $BENCHMARK --var N $N_ELEMS
 poetry run "$EXECUTABLE" --timeit-file "$TIMEIT_FILE" make $BENCHMARK --var N "$N_ELEMS"
 env:
 EXECUTABLE: ${{ inputs.executable_name }}
 BENCHMARK: ${{ inputs.benchmark_make_workflow }}
Expand All@@ -96,7 +100,7 @@ jobs:
 shell: bash

 - name: Store benchmark file
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ steps.vars.outputs.timeit }}
 path: ${{ steps.vars.outputs.timeit }}
Expand All@@ -112,17 +116,17 @@ jobs:
 run: |
 mkdir benchmarks
 - name: Fetch benchmark data
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 merge-multiple: true
 path: benchmarks
 - name: Delete partial benchmark data
 uses: geekyeggo/delete-artifact@v6
 uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
 with:
 name: "*"
 failOnError: false
 - name: Store benchmark data archive
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 id: upload
 with:
 name: benchmarks
Expand Down

258 changes: 170 additions & 88 deletions
.github/workflows/build-exes-impl.yml

View file


Open in desktop


Large diffs are not rendered by default.


30 changes: 18 additions & 12 deletions
.github/workflows/doc-build-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -85,42 +85,48 @@ jobs:
 artifact-url: ${{ steps.upload.outputs.artifact-url }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Checkout support code
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 repository: hpcflow/github-support
 path: github-support
 ref: ${{ inputs.script-branch }}
 persist-credentials: false
 - name: Init Python ${{ inputs.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ inputs.python-version }}
 - name: Install and configure poetry ${{ inputs.poetry-version }}
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache Virtual Environment
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: sphinx
 version: ${{ inputs.python-version }}
 - name: Install Dependencies
 run: |
 poetry install ${{ inputs.install-args }}
 poetry install $Args
 env:
 Args: ${{ inputs.install-args }}
 - name: Configure Problem Matcher
 run: echo "::add-matcher::github-support/problem-matchers/sphinx.json"
 # See: https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md
 # See: https://github.com/python/cpython/pull/20325
 - name: Run Sphinx
 run: |
 poetry run make clean html ${{ inputs.sphinx-args }}
 poetry run make clean html $Args
 env:
 Args: ${{ inputs.sphinx-args }}
 working-directory: docs
 - name: Upload documentation artifact
 id: upload
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ inputs.artifact-root-name }}-documentation (${{ inputs.ref }})
 path: docs/build/html
Expand All@@ -146,17 +152,17 @@ jobs:
 page-url: ${{ steps.deployment.outputs.page_url }}
 steps:
 - name: Download documentation artifact
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 path: site
 merge-multiple: true
 - name: Setup GitHub Pages
 uses: actions/configure-pages@v6
 uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 - name: Upload artifact to documentation staging
 uses: actions/upload-pages-artifact@v5
 uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
 with:
 # Upload dist repository
 path: site
 - name: Deploy to GitHub Pages
 id: deployment
 uses: actions/deploy-pages@v5
 uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Add a workflow vulnerability scanner#61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

dkfellows
wants to merge
8
commits into

base:main
Choose a base branch

from

 Open


Add a workflow vulnerability scanner
#61
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
1e7e0c1

Add a workflow vulnerability scanner


dkfellows May 18, 2026
e2dd2a2

Starting to address the issues


dkfellows May 18, 2026
69c39cd

Reducing template problems


dkfellows May 18, 2026
f894272

Reducing template problems


dkfellows May 18, 2026
c3e0269

Tweaks


dkfellows May 18, 2026
8fdc559

Commit ID binding


dkfellows May 18, 2026
b436398

Fix the caching action


dkfellows May 18, 2026
8d5cdc8

Woah there, dependabot!


dkfellows May 18, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,3 +4,5 @@ updates:
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7

24 changes: 14 additions & 10 deletions
.github/workflows/benchmark-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -58,19 +58,20 @@ jobs:
 runs-on: ${{ matrix.os }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Set up python ${{ matrix.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ matrix.python-version }}
 - name: Set up poetry
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache dependencies
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: benchmark
 version: ${{ matrix.python-version }}
Expand All@@ -82,12 +83,15 @@ jobs:
 - name: Set up variables
 id: vars
 run: |
 echo "timeit=benchmark_make_workflow_${{ matrix.num_elements }}_elements-${{ runner.os }}-py-${{ matrix.python-version }}.txt" >> $GITHUB_OUTPUT
 echo "timeit=benchmark_make_workflow_${N_ELEMS}_elements-${RUNNER_OS}-py-${PY_VER}.txt" >> $GITHUB_OUTPUT
 shell: bash
 env:
 N_ELEMS: ${{ matrix.num_elements }}
 PY_VER: ${{ matrix.python-version }}

 - name: Run app make workflow command
 run: |
 poetry run $EXECUTABLE --timeit-file $TIMEIT_FILE make $BENCHMARK --var N $N_ELEMS
 poetry run "$EXECUTABLE" --timeit-file "$TIMEIT_FILE" make $BENCHMARK --var N "$N_ELEMS"
 env:
 EXECUTABLE: ${{ inputs.executable_name }}
 BENCHMARK: ${{ inputs.benchmark_make_workflow }}
Expand All@@ -96,7 +100,7 @@ jobs:
 shell: bash

 - name: Store benchmark file
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ steps.vars.outputs.timeit }}
 path: ${{ steps.vars.outputs.timeit }}
Expand All@@ -112,17 +116,17 @@ jobs:
 run: |
 mkdir benchmarks
 - name: Fetch benchmark data
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 merge-multiple: true
 path: benchmarks
 - name: Delete partial benchmark data
 uses: geekyeggo/delete-artifact@v6
 uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
 with:
 name: "*"
 failOnError: false
 - name: Store benchmark data archive
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 id: upload
 with:
 name: benchmarks
Expand Down

258 changes: 170 additions & 88 deletions
.github/workflows/build-exes-impl.yml

View file


Open in desktop


Large diffs are not rendered by default.


30 changes: 18 additions & 12 deletions
.github/workflows/doc-build-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -85,42 +85,48 @@ jobs:
 artifact-url: ${{ steps.upload.outputs.artifact-url }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Checkout support code
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 repository: hpcflow/github-support
 path: github-support
 ref: ${{ inputs.script-branch }}
 persist-credentials: false
 - name: Init Python ${{ inputs.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ inputs.python-version }}
 - name: Install and configure poetry ${{ inputs.poetry-version }}
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache Virtual Environment
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: sphinx
 version: ${{ inputs.python-version }}
 - name: Install Dependencies
 run: |
 poetry install ${{ inputs.install-args }}
 poetry install $Args
 env:
 Args: ${{ inputs.install-args }}
 - name: Configure Problem Matcher
 run: echo "::add-matcher::github-support/problem-matchers/sphinx.json"
 # See: https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md
 # See: https://github.com/python/cpython/pull/20325
 - name: Run Sphinx
 run: |
 poetry run make clean html ${{ inputs.sphinx-args }}
 poetry run make clean html $Args
 env:
 Args: ${{ inputs.sphinx-args }}
 working-directory: docs
 - name: Upload documentation artifact
 id: upload
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ inputs.artifact-root-name }}-documentation (${{ inputs.ref }})
 path: docs/build/html
Expand All@@ -146,17 +152,17 @@ jobs:
 page-url: ${{ steps.deployment.outputs.page_url }}
 steps:
 - name: Download documentation artifact
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 path: site
 merge-multiple: true
 - name: Setup GitHub Pages
 uses: actions/configure-pages@v6
 uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 - name: Upload artifact to documentation staging
 uses: actions/upload-pages-artifact@v5
 uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
 with:
 # Upload dist repository
 path: site
 - name: Deploy to GitHub Pages
 id: deployment
 uses: actions/deploy-pages@v5
 uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Add a workflow vulnerability scanner#61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

dkfellows
wants to merge
8
commits into

base:main
Choose a base branch

from

 Open


Add a workflow vulnerability scanner
#61
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
1e7e0c1

Add a workflow vulnerability scanner


dkfellows May 18, 2026
e2dd2a2

Starting to address the issues


dkfellows May 18, 2026
69c39cd

Reducing template problems


dkfellows May 18, 2026
f894272

Reducing template problems


dkfellows May 18, 2026
c3e0269

Tweaks


dkfellows May 18, 2026
8fdc559

Commit ID binding


dkfellows May 18, 2026
b436398

Fix the caching action


dkfellows May 18, 2026
8d5cdc8

Woah there, dependabot!


dkfellows May 18, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,3 +4,5 @@ updates:
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7

24 changes: 14 additions & 10 deletions
.github/workflows/benchmark-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -58,19 +58,20 @@ jobs:
 runs-on: ${{ matrix.os }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Set up python ${{ matrix.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ matrix.python-version }}
 - name: Set up poetry
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache dependencies
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: benchmark
 version: ${{ matrix.python-version }}
Expand All@@ -82,12 +83,15 @@ jobs:
 - name: Set up variables
 id: vars
 run: |
 echo "timeit=benchmark_make_workflow_${{ matrix.num_elements }}_elements-${{ runner.os }}-py-${{ matrix.python-version }}.txt" >> $GITHUB_OUTPUT
 echo "timeit=benchmark_make_workflow_${N_ELEMS}_elements-${RUNNER_OS}-py-${PY_VER}.txt" >> $GITHUB_OUTPUT
 shell: bash
 env:
 N_ELEMS: ${{ matrix.num_elements }}
 PY_VER: ${{ matrix.python-version }}

 - name: Run app make workflow command
 run: |
 poetry run $EXECUTABLE --timeit-file $TIMEIT_FILE make $BENCHMARK --var N $N_ELEMS
 poetry run "$EXECUTABLE" --timeit-file "$TIMEIT_FILE" make $BENCHMARK --var N "$N_ELEMS"
 env:
 EXECUTABLE: ${{ inputs.executable_name }}
 BENCHMARK: ${{ inputs.benchmark_make_workflow }}
Expand All@@ -96,7 +100,7 @@ jobs:
 shell: bash

 - name: Store benchmark file
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ steps.vars.outputs.timeit }}
 path: ${{ steps.vars.outputs.timeit }}
Expand All@@ -112,17 +116,17 @@ jobs:
 run: |
 mkdir benchmarks
 - name: Fetch benchmark data
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 merge-multiple: true
 path: benchmarks
 - name: Delete partial benchmark data
 uses: geekyeggo/delete-artifact@v6
 uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
 with:
 name: "*"
 failOnError: false
 - name: Store benchmark data archive
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 id: upload
 with:
 name: benchmarks
Expand Down

258 changes: 170 additions & 88 deletions
.github/workflows/build-exes-impl.yml

View file


Open in desktop


Large diffs are not rendered by default.


30 changes: 18 additions & 12 deletions
.github/workflows/doc-build-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -85,42 +85,48 @@ jobs:
 artifact-url: ${{ steps.upload.outputs.artifact-url }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Checkout support code
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 repository: hpcflow/github-support
 path: github-support
 ref: ${{ inputs.script-branch }}
 persist-credentials: false
 - name: Init Python ${{ inputs.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ inputs.python-version }}
 - name: Install and configure poetry ${{ inputs.poetry-version }}
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache Virtual Environment
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: sphinx
 version: ${{ inputs.python-version }}
 - name: Install Dependencies
 run: |
 poetry install ${{ inputs.install-args }}
 poetry install $Args
 env:
 Args: ${{ inputs.install-args }}
 - name: Configure Problem Matcher
 run: echo "::add-matcher::github-support/problem-matchers/sphinx.json"
 # See: https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md
 # See: https://github.com/python/cpython/pull/20325
 - name: Run Sphinx
 run: |
 poetry run make clean html ${{ inputs.sphinx-args }}
 poetry run make clean html $Args
 env:
 Args: ${{ inputs.sphinx-args }}
 working-directory: docs
 - name: Upload documentation artifact
 id: upload
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ inputs.artifact-root-name }}-documentation (${{ inputs.ref }})
 path: docs/build/html
Expand All@@ -146,17 +152,17 @@ jobs:
 page-url: ${{ steps.deployment.outputs.page_url }}
 steps:
 - name: Download documentation artifact
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 path: site
 merge-multiple: true
 - name: Setup GitHub Pages
 uses: actions/configure-pages@v6
 uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 - name: Upload artifact to documentation staging
 uses: actions/upload-pages-artifact@v5
 uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
 with:
 # Upload dist repository
 path: site
 - name: Deploy to GitHub Pages
 id: deployment
 uses: actions/deploy-pages@v5
 uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Add a workflow vulnerability scanner#61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Open

dkfellows
wants to merge
8
commits into

base:main
Choose a base branch

from

 Open


Add a workflow vulnerability scanner
#61
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


8 commits


Select commit
Hold shift + click to select a range
1e7e0c1

Add a workflow vulnerability scanner


dkfellows May 18, 2026
e2dd2a2

Starting to address the issues


dkfellows May 18, 2026
69c39cd

Reducing template problems


dkfellows May 18, 2026
f894272

Reducing template problems


dkfellows May 18, 2026
c3e0269

Tweaks


dkfellows May 18, 2026
8fdc559

Commit ID binding


dkfellows May 18, 2026
b436398

Fix the caching action


dkfellows May 18, 2026
8d5cdc8

Woah there, dependabot!


dkfellows May 18, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


2 changes: 2 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,3 +4,5 @@ updates:
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7

24 changes: 14 additions & 10 deletions
.github/workflows/benchmark-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -58,19 +58,20 @@ jobs:
 runs-on: ${{ matrix.os }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Set up python ${{ matrix.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ matrix.python-version }}
 - name: Set up poetry
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache dependencies
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: benchmark
 version: ${{ matrix.python-version }}
Expand All@@ -82,12 +83,15 @@ jobs:
 - name: Set up variables
 id: vars
 run: |
 echo "timeit=benchmark_make_workflow_${{ matrix.num_elements }}_elements-${{ runner.os }}-py-${{ matrix.python-version }}.txt" >> $GITHUB_OUTPUT
 echo "timeit=benchmark_make_workflow_${N_ELEMS}_elements-${RUNNER_OS}-py-${PY_VER}.txt" >> $GITHUB_OUTPUT
 shell: bash
 env:
 N_ELEMS: ${{ matrix.num_elements }}
 PY_VER: ${{ matrix.python-version }}

 - name: Run app make workflow command
 run: |
 poetry run $EXECUTABLE --timeit-file $TIMEIT_FILE make $BENCHMARK --var N $N_ELEMS
 poetry run "$EXECUTABLE" --timeit-file "$TIMEIT_FILE" make $BENCHMARK --var N "$N_ELEMS"
 env:
 EXECUTABLE: ${{ inputs.executable_name }}
 BENCHMARK: ${{ inputs.benchmark_make_workflow }}
Expand All@@ -96,7 +100,7 @@ jobs:
 shell: bash

 - name: Store benchmark file
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ steps.vars.outputs.timeit }}
 path: ${{ steps.vars.outputs.timeit }}
Expand All@@ -112,17 +116,17 @@ jobs:
 run: |
 mkdir benchmarks
 - name: Fetch benchmark data
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 merge-multiple: true
 path: benchmarks
 - name: Delete partial benchmark data
 uses: geekyeggo/delete-artifact@v6
 uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0
 with:
 name: "*"
 failOnError: false
 - name: Store benchmark data archive
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 id: upload
 with:
 name: benchmarks
Expand Down

258 changes: 170 additions & 88 deletions
.github/workflows/build-exes-impl.yml

View file


Open in desktop


Large diffs are not rendered by default.


30 changes: 18 additions & 12 deletions
.github/workflows/doc-build-impl.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -85,42 +85,48 @@ jobs:
 artifact-url: ${{ steps.upload.outputs.artifact-url }}
 steps:
 - name: Checkout
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 ref: ${{ inputs.ref }}
 persist-credentials: false
 - name: Checkout support code
 uses: actions/checkout@v6
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 with:
 repository: hpcflow/github-support
 path: github-support
 ref: ${{ inputs.script-branch }}
 persist-credentials: false
 - name: Init Python ${{ inputs.python-version }}
 uses: actions/setup-python@v6
 uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
 with:
 python-version: ${{ inputs.python-version }}
 - name: Install and configure poetry ${{ inputs.poetry-version }}
 uses: hpcflow/github-support/setup-poetry@0.5
 uses: hpcflow/github-support/setup-poetry@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 version: ${{ inputs.poetry-version }}
 - name: Cache Virtual Environment
 uses: hpcflow/github-support/init-cache@0.5
 uses: hpcflow/github-support/init-cache@86e0cf45f9f79069d0bc1b8a727c097a03d9012e # 0.5
 with:
 name: sphinx
 version: ${{ inputs.python-version }}
 - name: Install Dependencies
 run: |
 poetry install ${{ inputs.install-args }}
 poetry install $Args
 env:
 Args: ${{ inputs.install-args }}
 - name: Configure Problem Matcher
 run: echo "::add-matcher::github-support/problem-matchers/sphinx.json"
 # See: https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md
 # See: https://github.com/python/cpython/pull/20325
 - name: Run Sphinx
 run: |
 poetry run make clean html ${{ inputs.sphinx-args }}
 poetry run make clean html $Args
 env:
 Args: ${{ inputs.sphinx-args }}
 working-directory: docs
 - name: Upload documentation artifact
 id: upload
 uses: actions/upload-artifact@v7
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ inputs.artifact-root-name }}-documentation (${{ inputs.ref }})
 path: docs/build/html
Expand All@@ -146,17 +152,17 @@ jobs:
 page-url: ${{ steps.deployment.outputs.page_url }}
 steps:
 - name: Download documentation artifact
 uses: actions/download-artifact@v8
 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 with:
 path: site
 merge-multiple: true
 - name: Setup GitHub Pages
 uses: actions/configure-pages@v6
 uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 - name: Upload artifact to documentation staging
 uses: actions/upload-pages-artifact@v5
 uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
 with:
 # Upload dist repository
 path: site
 - name: Deploy to GitHub Pages
 id: deployment
 uses: actions/deploy-pages@v5
 uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
Loading