introduce zizmor, simplify sync_steering_members

.github/ISSUE_TEMPLATE/graduation_request.yml

@@ -134,11 +134,6 @@ body:
         - [ ]  no
         - [ ]  abstain
 
-        @mbargull (Marcel Bargull)
-        - [ ]  yes
-        - [ ]  no
-        - [ ]  abstain
-
         @jakirkham (John Kirkham)
         - [ ]  yes
         - [ ]  no

.github/workflows/_create-meeting-notes-pr.yml

@@ -79,23 +79,30 @@ jobs:
           python3 -V
           python3 -m pip install jinja2 requests
       - name: Prepare date
+        env:
+          INPUT_DATE: ${{ inputs.date || 'now' }}
         run: |
-          chosen_date="$(date -I -u --date "${{ inputs.date || 'now' }}")"
+          chosen_date="$(date -I -u --date "$INPUT_DATE")"
           echo "chosen_date=${chosen_date}" >> $GITHUB_ENV
       - name: Prepare branch
+        env:
+          INPUT_BRANCH_NAME: ${{ inputs.branch_name || '%Y-%m-%d-meeting-notes' }}
         run: |
           # Create new branch
-          branch_name=$(date --date "$chosen_date" "+${{ inputs.branch_name || '%Y-%m-%d-meeting-notes' }}")
+          branch_name=$(date --date "$chosen_date" "+$INPUT_BRANCH_NAME")
           if [[ "${{ inputs.force_push }}" == "true" ]]; then
             git checkout -b "${branch_name}" || git checkout "${branch_name}"
           else
             git checkout -b "${branch_name}"
           fi
           echo "branch_name=$branch_name" >> $GITHUB_ENV
       - name: Render template
+        env:
+          INPUT_OUTPUT_PATH: ${{ inputs.output_path || 'meeting-notes/%Y-%m-%d.md' }}
+          INPUT_TEMPLATE_PATH: ${{ inputs.template_path || 'meeting-notes/TEMPLATE.md' }}
         run: |
           # Render template
-          output_path=$(date --date "$chosen_date" "+${{ inputs.output_path ||  'meeting-notes/%Y-%m-%d.md' }}")
+          output_path=$(date --date "$chosen_date" "+$INPUT_OUTPUT_PATH")
           export output_path
           mkdir -p "$(dirname "$output_path")"
           python3 > "$output_path" <<EOF
@@ -104,7 +111,7 @@ jobs:
           import os
           from datetime import datetime
           from pathlib import Path
-          template = Template(Path("${{ inputs.template_path || 'meeting-notes/TEMPLATE.md' }}").read_text(), undefined=DebugUndefined)
+          template = Template(Path(os.environ["INPUT_TEMPLATE_PATH"]).read_text(), undefined=DebugUndefined)
           print(
             template.render(
               env=os.environ,
@@ -126,12 +133,13 @@ jobs:
         if: ${{ !inputs.dry_run }}
         env:
           HACKMD_TOKEN: ${{ secrets.HACKMD_TOKEN }}
+          HACKMD_TEAM: ${{ inputs.hackmd_team }}
         shell: python
         run: |
           import os
           from pathlib import Path
           import requests
-          url = "https://api.hackmd.io/v1/teams/${{ inputs.hackmd_team }}/notes"
+          url = f"https://api.hackmd.io/v1/teams/{os.environ['HACKMD_TEAM']}/notes"
           headers = {"Authorization": f"Bearer {os.environ['HACKMD_TOKEN']}"}
           data = {
             "title": os.environ["note_title"],
@@ -158,12 +166,13 @@ jobs:
             git push origin "${branch_name}"
           fi
       - name: Prepare PR contents
+        env:
+          INPUT_PR_TITLE: ${{ inputs.pr_title || 'Meeting notes for %Y-%m-%d' }}
+          INPUT_PR_BODY: ${{ inputs.pr_body || 'PR BODY TEXT EXAMPLE' }}
         run: |
-          echo "pr_title=$(date --date "$chosen_date" "+${{ inputs.pr_title || 'Meeting notes for %Y-%m-%d' }}")" >> $GITHUB_ENV
+          echo "pr_title=$(date --date "$chosen_date" "+$INPUT_PR_TITLE")" >> $GITHUB_ENV
           # We need to escape the backticks in markdown so JS interpolation does not choke
-          cat <<'EOF' > "$RUNNER_TEMP/pr-body"
-          ${{ inputs.pr_body || 'PR BODY TEXT EXAMPLE' }}
-          EOF
+          printf '%s\n' "$INPUT_PR_BODY" > "$RUNNER_TEMP/pr-body"
           EOV=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
           echo "pr_body<<$EOV" >> $GITHUB_ENV
           sed 's/`/\\`/g' "$RUNNER_TEMP/pr-body" >> $GITHUB_ENV

.github/workflows/_sync-meeting-notes-pr.yml

@@ -97,6 +97,8 @@ jobs:
           sys.exit(0)
       - name: Commit changes (if any)
         if: ${{ !inputs.dry_run }}
+        env:
+          TARGET_REF: ${{ github.head_ref || github.ref_name }}
         run: |
           set -x
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
@@ -106,7 +108,7 @@ jobs:
           if ! git diff --exit-code "$DOCPATH"; then
             git add "$DOCPATH"
             git commit -m "Update $DOCPATH"
-            git push origin ${{ github.head_ref || github.ref_name }}
+            git push origin "$TARGET_REF"
           else
             echo "No changes detected."
           fi

.github/workflows/meeting-notes.yml

@@ -16,15 +16,15 @@ on:
   pull_request:
     types:
       - labeled
-permissions:
-  contents: write
-  pull-requests: write
 # You need to enable 'Allow GitHub Actions to create and approve pull requests'
 # in your Actions Settings too
 
 jobs:
   create:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    permissions:
+      contents: write
+      pull-requests: write
     uses: ./.github/workflows/_create-meeting-notes-pr.yml
     with:
       date: ${{ github.event_name == 'schedule' && 'next Wednesday' || (inputs.date || 'now') }}
@@ -40,6 +40,9 @@ jobs:
       HACKMD_TOKEN: ${{ secrets.HACKMD_TOKEN }}
   sync:
     if: github.event.label.name == 'sync-hackmd-notes'
+    permissions:
+      contents: write
+      pull-requests: write
     uses: ./.github/workflows/_sync-meeting-notes-pr.yml
     with:
       pr_number: ${{ github.event.number }}

.pre-commit-config.yaml

@@ -95,3 +95,18 @@ repos:
         exclude_types: [csv]
         types: [text]
         args: [--write-changes]
+      # zizmor
+      - id: zizmor
+        name: zizmor
+        entry: pixi run zizmor --min-severity high --fix .
+        language: system
+        types: [yaml]
+        pass_filenames: false
+      # custom hooks
+      - id: sync-steering-members
+        name: Sync steering members
+        entry: pixi run sync_steering_members
+        language: system
+        always_run: true
+        pass_filenames: false
+        require_serial: true

pixi.toml

@@ -17,6 +17,7 @@ ruff = "*"
 codespell = "*"
 yamlfmt = "*"
 tombi = "*"
+zizmor = "*"
 
 [tasks]
 lint = "pre-commit run --all-files"