diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 011561bd7..7cadc24be 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -34,26 +34,20 @@ on: workflow_dispatch: inputs: - debug: - description: 'Run with debugging options' - type: boolean - default: true soft-linting: description: 'Do not quit for linting errors' type: boolean default: true env: - # Python version to use for actions/setup-python. - python-version: '3.13' - SHELLOPTS: ${{inputs.debug && 'xtrace'}} PIP_PROGRESS_BAR: 'off' concurrency: cancel-in-progress: true group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}} -permissions: read-all +permissions: + contents: read jobs: python-checks: @@ -62,14 +56,15 @@ jobs: timeout-minutes: 20 steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: - python-version: ${{env.python-version}} + python-version: 3.13 cache: pip cache-dependency-path: | requirements.txt @@ -101,7 +96,9 @@ jobs: timeout-minutes: 15 steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Run hadolint on Dockerfiles continue-on-error: ${{inputs.soft-linting == 'true'}} @@ -123,7 +120,9 @@ jobs: timeout-minutes: 15 steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install problem matcher run: echo '::add-matcher::.github/problem-matchers/shellcheck.json' @@ -144,7 +143,9 @@ jobs: timeout-minutes: 15 steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install yamllint run: | @@ -164,7 +165,9 @@ jobs: timeout-minutes: 15 steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install Buildifier uses: jbajic/setup-buildifier@c558ee05c6f74ab5753ff794516750b4aadac296 # v1 @@ -184,13 +187,15 @@ jobs: timeout-minutes: 15 steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Run actionlint continue-on-error: ${{inputs.soft-linting == 'true'}} - uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2 + uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0 with: - flags: ${{inputs.debug && '-verbose'}} + flags: ${{runner.debug == '1' && '-verbose' || '' }} files: '.github/workflows/*.{yaml,yml}' pyflakes: false @@ -221,12 +226,13 @@ jobs: - '3.13' steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 id: setup with: python-version: ${{matrix.python_version}} @@ -244,24 +250,23 @@ jobs: - name: Set up Bazel uses: './.github/actions/set-up-bazel' with: - debug: ${{inputs.debug}} + debug: ${{runner.debug == '1'}} - if: ${{! startsWith(matrix.os, 'windows-')}} name: Build the qsim C++ library and run tests (non-Windows case) run: | alias bazel=bazelisk - dev_tools/test_libs.sh ${{inputs.debug && '--config=verbose'}} + dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}} - if: ${{startsWith(matrix.os, 'windows-')}} name: Build the qsim C++ library and run tests (Windows case) # On GitHub Windows runners, Bazel ends up finding a different "python3" # binary than what's installed by setup-python unless we tell Bazel what # to use. Here we do that by setting PYTHON_BIN_PATH. - env: - root: 'C:\\hostedtoolcache\\windows\\Python' - exe: '${{steps.setup.outputs.python-version}}\\x64\\python3.exe' - shell: cmd - run: bash -x dev_tools/test_libs.sh ${{inputs.debug && '--config=verbose'}} --action_env PYTHON_BIN_PATH=${{env.root}}\\${{env.exe}} + run: | + $pythonPath = (Get-Command python).Source -replace '\\', '/' + bash -x dev_tools/test_libs.sh ${{runner.debug == '1' && '--config=verbose' || ''}} --action_env PYTHON_BIN_PATH="$pythonPath" + shell: pwsh - name: Install LLVM and OpenMP on macOS if: startsWith(matrix.os, 'macos') @@ -291,8 +296,8 @@ jobs: run: | mkdir -p build cd build - cmake ${{inputs.debug && '--debug-output' || ''}} .. - cmake --build . -j ${{inputs.debug && '--verbose' || ''}} + cmake ${{runner.debug == '1' && '--debug-output' || ''}} .. + cmake --build . -j ${{runner.debug == '1' && '--verbose' || ''}} options-tests: name: Options tests @@ -313,14 +318,15 @@ jobs: parallel_opt: [openmp, nopenmp] steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: - python-version: ${{env.python-version}} + python-version: 3.13 cache: pip cache-dependency-path: | requirements.txt @@ -335,14 +341,14 @@ jobs: - name: Set up Bazel uses: './.github/actions/set-up-bazel' with: - debug: ${{inputs.debug}} + debug: ${{runner.debug == '1'}} - name: Run C++ tests run: | bazel test \ --config=${{matrix.hardware_opt}} \ --config=${{matrix.parallel_opt}} \ - ${{inputs.debug && '--config=verbose'}} \ + ${{runner.debug == '1' && '--config=verbose' || ''}} \ tests:all - name: Run sample simulation @@ -350,7 +356,7 @@ jobs: bazel run \ --config=${{matrix.hardware_opt}} \ --config=${{matrix.parallel_opt}} \ - ${{inputs.debug && '--config=verbose'}} \ + ${{runner.debug == '1' && '--config=verbose' || ''}} \ apps:qsim_base -- -c circuits/circuit_q24 memory-tests: @@ -368,18 +374,19 @@ jobs: common_args: >- --config=avx --config=openmp - ${{inputs.debug && '--config=verbose'}} + --config=verbose tests:all steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: - python-version: ${{env.python-version}} + python-version: 3.13 cache: pip cache-dependency-path: | requirements.txt @@ -394,7 +401,7 @@ jobs: - name: Set up Bazel uses: './.github/actions/set-up-bazel' with: - debug: ${{inputs.debug}} + debug: ${{runner.debug == '1'}} - name: Install google-perftools for tcmalloc run: | @@ -403,7 +410,7 @@ jobs: - name: Run TCMalloc tests env: - PERFTOOLS_VERBOSE: ${{inputs.debug && 1}} + PERFTOOLS_VERBOSE: ${{runner.debug == '1' && 1 || ''}} run: bazel test --config=tcmalloc ${{env.common_args}} - name: Run memory sanitizer tests @@ -423,15 +430,17 @@ jobs: - yaml-lint runs-on: ubuntu-24.04-x64-16-core timeout-minutes: 60 - env: - # The next environment variable is used by Docker. - BUILDKIT_PROGRESS: ${{inputs.debug && 'plain'}} steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false submodules: recursive + - name: Configure Docker BuildKit for debug mode + if: runner.debug == '1' + run: echo "BUILDKIT_PROGRESS=plain" >> "$GITHUB_ENV" + - name: Build Docker images run: | # Running locally, a plain "docker compose build" works as expected. diff --git a/.github/workflows/cirq_compatibility.yml b/.github/workflows/cirq_compatibility.yml index 986aefbd2..b5e4cf017 100644 --- a/.github/workflows/cirq_compatibility.yml +++ b/.github/workflows/cirq_compatibility.yml @@ -20,13 +20,9 @@ on: - cron: "10 7 * * *" workflow_dispatch: - inputs: - debug: - description: 'Run with debugging options' - type: boolean - default: true -permissions: read-all +permissions: + contents: read concurrency: # Cancel any previously-started but still active runs on the same branch. @@ -41,13 +37,15 @@ jobs: timeout-minutes: 30 steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false fetch-depth: 1 submodules: recursive - name: Set up Python with caching of pip dependencies - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5 + # yamllint disable rule:line-length + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' cache: pip @@ -63,5 +61,5 @@ jobs: - name: Run Python tests env: - PYTEST_ADDOPTS: ${{inputs.debug && '-n auto -v' || '-n auto' }} + PYTEST_ADDOPTS: ${{runner.debug && '-n auto -v' || '-n auto' }} run: make -j run-py-tests diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml index 0f69dff11..7252d094c 100644 --- a/.github/workflows/pr-labeler.yaml +++ b/.github/workflows/pr-labeler.yaml @@ -24,12 +24,12 @@ on: # Note: do not copy-paste this workflow with `pull_request_target` left as-is. # Its use here is a special case where security implications are understood. # Workflows should normally use `pull_request` instead. + # zizmor: ignore[dangerous-triggers] pull_request_target: types: - opened - synchronize - # Allow manual invocation. workflow_dispatch: inputs: pr-number: @@ -41,8 +41,7 @@ on: type: boolean default: true -# Declare default workflow permissions as read only. -permissions: read-all +permissions: {} jobs: label-pr-size: @@ -61,8 +60,9 @@ jobs: SHELLOPTS: ${{inputs.debug && 'xtrace' || '' }} steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false sparse-checkout: | ./dev_tools/ci/size-labeler.sh diff --git a/.github/workflows/pr-text-checker.yaml b/.github/workflows/pr-text-checker.yaml index ededc464a..9caf86dce 100644 --- a/.github/workflows/pr-text-checker.yaml +++ b/.github/workflows/pr-text-checker.yaml @@ -31,7 +31,8 @@ on: branches: - main -permissions: read-all +permissions: + contents: read jobs: check-text-length: diff --git a/.github/workflows/scorecard-scanner.yaml b/.github/workflows/scorecard-scanner.yaml index 5a9eee6f3..37888c927 100644 --- a/.github/workflows/scorecard-scanner.yaml +++ b/.github/workflows/scorecard-scanner.yaml @@ -1,4 +1,4 @@ -# Copyright 2025 Google LLC +# Copyright 2026 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -13,7 +13,7 @@ # limitations under the License. name: Scorecard analysis -run-name: Run Scorecard scanner for security best practices +run-name: Run Scorecard analyzer # Scorecard (https://github.com/ossf/scorecard) is a repository-scanning tool # that evaluates a project's security practices. Its use is suggested by @@ -26,59 +26,69 @@ on: - cron: '30 9 * * 6' pull_request: - types: [opened, synchronize] + types: + - opened + - synchronize + - reopened + - ready_for_review branches: - main - # Allow manual invocation. workflow_dispatch: concurrency: - # Cancel any previously-started but still active runs on the same branch. cancel-in-progress: true group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}} -# Declare default workflow permissions as read only. -permissions: read-all +permissions: {} jobs: run-scorecard: - if: github.repository_owner == 'quantumlib' + # Skip fork PRs to avoid "Analysis configuration not found" errors. + if: >- + github.repository_owner == 'quantumlib' && + (github.event_name != 'pull_request' || + github.event.pull_request.head.repo.fork == false) name: Scorecard analyzer runs-on: ubuntu-24.04 permissions: security-events: write id-token: write + contents: read + actions: read + issues: read + pull-requests: read + checks: read timeout-minutes: 15 steps: - name: Check out a copy of the git repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Run Scorecard analysis # yamllint disable rule:line-length - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: - # Save the results results_file: scorecard-results.sarif results_format: sarif - # See https://github.com/ossf/scorecard-action#publishing-results. publish_results: true - name: Upload results to code-scanning dashboard # yamllint disable rule:line-length - uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: sarif_file: scorecard-results.sarif - # Scorecard currently (ver. 2.4.x) doesn't allow submissions from jobs having - # steps that use "run:". To print to the summary, we need to use another job. + # Scorecard doesn't allow submissions from jobs having steps that use "run:". + # Printing a summary needs to use "run:", so we have to use a separate job. write-summary: name: Scorecard results needs: run-scorecard runs-on: ubuntu-slim timeout-minutes: 5 + permissions: + actions: read steps: - name: Write the Scorecard report page link to the workflow summary run: |