Skip to content

gh-140681: Freeze pre-commit hooks and update zizmor links - #140682

Merged
hugovk merged 5 commits into
python:mainfrom
shenxianpeng:update-for-zizmor
Mar 5, 2026
Merged

gh-140681: Freeze pre-commit hooks and update zizmor links#140682
hugovk merged 5 commits into
python:mainfrom
shenxianpeng:update-for-zizmor

Conversation

@shenxianpeng

@shenxianpengshenxianpeng commented Oct 27, 2025

Copy link
Copy Markdown
Contributor

gh-140681: Update zizmor repo and doc links

@shenxianpengshenxianpeng changed the title Update zizmor repo and doc linksgh-140681: Update zizmor repo and doc linksOct 27, 2025
@bedevere-appbedevere-appBot mentioned this pull request Oct 27, 2025
Closed
StanFromIreland
StanFromIreland reviewed Oct 27, 2025
View reviewed changes
Comment threadMisc/NEWS.d/next/Documentation/2025-10-27-17-14-34.gh-issue-140681.fMOJ9T.rst Outdated
@hugovk

hugovk commented Oct 27, 2025

Copy link
Copy Markdown
Member

We're in no rush here, it still works because of the redirects.

If we're going to update this, we might as well update the others (for example, prek autoupdate --jobs 0 or pre-commit autoupdate --jobs 0).

We can also now remove the self-hosted-runner of .github/actionlint.yaml.

And there might be a Sphinx Lint release fairly soon, so could also wait for that.

@hugovkhugovk added the infra CI, GitHub Actions, buildbots, Dependabot, etc. label Oct 27, 2025
@hugovkhugovk changed the title gh-140681: Update zizmor repo and doc linksgh-140681: Freeze pre-commit hooks and update zizmor linksMar 4, 2026
@hugovkhugovk added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Mar 4, 2026
@hugovk

hugovk commented Mar 4, 2026

Copy link
Copy Markdown
Member

As this was still open, I've updated it to also freeze the pre-commit hooks, as discussed at python/devguide#1748 (review). In short, if a repo became compromised, they could rewrite the tag to something malicious. Git SHAs can mitigate this.

If we're going to update this, we might as well update the others (for example, prek autoupdate --jobs 0 or pre-commit autoupdate --jobs 0).

We can also now remove the self-hosted-runner of .github/actionlint.yaml.

I did these too.

@hugovkhugovk mentioned this pull request Mar 4, 2026
Merged
@hugovk
hugovk merged commit 11840ca into python:mainMar 5, 2026
53 checks passed
@miss-islington-app

miss-islington-appBot commented Mar 5, 2026

Copy link
Copy Markdown

Thanks @shenxianpeng for the PR, and @hugovk for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-appBot commented Mar 5, 2026

Copy link
Copy Markdown

Sorry, @shenxianpeng and @hugovk, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 11840ca99ae809c1c8401b4f34d2820de55e27a0 3.14

@miss-islington-app

miss-islington-appBot commented Mar 5, 2026

Copy link
Copy Markdown

Sorry, @shenxianpeng and @hugovk, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 11840ca99ae809c1c8401b4f34d2820de55e27a0 3.13

hugovk added a commit to hugovk/cpython that referenced this pull request Mar 5, 2026
@shenxianpeng@StanFromIreland@hugovk
[3.14]pythongh-140681: Freeze pre-commit hooks and update zizmor lin…
6e7327c
…ks (pythonGH-140682)
(cherry picked from commit 11840ca)
Co-authored-by: Xianpeng Shen <xianpeng.shen@gmail.com>
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
@bedevere-app

bedevere-appBot commented Mar 5, 2026

Copy link
Copy Markdown

GH-145536 is a backport of this pull request to the 3.14 branch.

@bedevere-appbedevere-appBot removed the needs backport to 3.14 bugs and security fixes label Mar 5, 2026
hugovk added a commit to hugovk/cpython that referenced this pull request Mar 5, 2026
@shenxianpeng@StanFromIreland@hugovk
pythongh-140681: Freeze pre-commit hooks and update zizmor links (pyt…
a64edd4
…hon#140682)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
@hugovk

hugovk commented Mar 5, 2026•
edited
Loading

Copy link
Copy Markdown
Member

3.13 blocked by GH-144593 so cherry-picked into that one.

@hugovkhugovk removed the needs backport to 3.13 bugs and security fixes label Mar 5, 2026
hugovk added a commit that referenced this pull request Mar 10, 2026
@hugovk@shenxianpeng@StanFromIreland
[3.14]gh-140681: Freeze pre-commit hooks and update zizmor links (GH…
bd26ed3
…-140682) (#145536)
Co-authored-by: Xianpeng Shen <xianpeng.shen@gmail.com>
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
ljfp pushed a commit to ljfp/cpython that referenced this pull request Apr 25, 2026
@shenxianpeng@StanFromIreland
@hugovk@ljfp
pythongh-140681: Freeze pre-commit hooks and update zizmor links (pyt…
9e91519
…hon#140682)
Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@webknjazwebknjazwebknjaz approved these changes
@hugovkhugovkhugovk approved these changes
@sethmlarsonsethmlarsonsethmlarson approved these changes
@StanFromIrelandStanFromIrelandStanFromIreland approved these changes
@ezio-melottiezio-melottiAwaiting requested review from ezio-melottiezio-melotti is a code owner
@AA-TurnerAA-TurnerAwaiting requested review from AA-TurnerAA-Turner is a code owner

Assignees

@hugovkhugovk

Labels

infraCI, GitHub Actions, buildbots, Dependabot, etc.skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@shenxianpeng@hugovk@webknjaz@sethmlarson@StanFromIreland@nazeerali4325-commits