Maintenance sprint 26q1

.github/workflows/docker-publish.yml

@@ -7,25 +7,35 @@ on:
     tags:
       - '[0-9]+\.[0-9]+\.[0-9]+'
 
+permissions:
+  contents: read
 jobs:
   publish-production:
 
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Export version env var
         run: |
           git fetch --prune --unshallow
           echo "DVE_VERSION=$(git describe --tags --abbrev=0) ($(git rev-parse --abbrev-ref HEAD):$(git log -1 --format=%h))" >> $GITHUB_ENV
 
-      - name: Publish to Registry
-        uses: docker/build-push-action@v1
+      - name: Log in to Docker Hub
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.pcicdevops_at_dockerhub_username }}
           password: ${{ secrets.pcicdevops_at_dockerhub_password }}
-          dockerfile: ./docker/production/Dockerfile
-          build_args: DVE_VERSION=${{ env.DVE_VERSION }}
-          repository: pcic/design-value-explorer
-          tag_with_ref: true
+
+      - name: Publish to Registry
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+        with:
+          file: ./docker/production/Dockerfile
+          push: true
+          tags: |
+            pcic/design-value-explorer:${{ github.ref_name }}
+            ${{ github.ref_name == 'main' && 'pcic/design-value-explorer:latest' || '' }}
+          build-args: DVE_VERSION=${{ env.DVE_VERSION }}

.github/workflows/python-ci.yml

@@ -2,6 +2,8 @@ name: Python CI
 
 on: push
 
+permissions:
+  contents: read
 jobs:
   test:
 
@@ -12,10 +14,12 @@ jobs:
           - "3.8"
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: ${{ matrix.python-version }}
 
@@ -29,7 +33,7 @@ jobs:
         pip install -U pipenv
 
     - id: cache-pipenv
-      uses: actions/cache@v4.2.0
+      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: ~/.local/share/virtualenvs
         key: ${{ runner.os }}-pipenv-${{ hashFiles('**/Pipfile.lock') }}

Pipfile

@@ -75,6 +75,7 @@ Werkzeug = "==2.0.3"
 xarray = "==0.21.1"
 zipp = "==3.7.0"
 python-json-logger = "2.0.2"
+setuptools = "<71.0.0"
 
 [dev-packages]
 pytest = "*"