From 3ed80c84643c684dd8c6a7574753cb160d560f84 Mon Sep 17 00:00:00 2001 From: Michael Dawson-Haggerty Date: Wed, 21 Oct 2026 17:56:22 -0400 Subject: [PATCH] pin actions versions --- .github/workflows/push.yml | 17 ++++++++++++----- .github/workflows/release.yml | 26 +++++++++++++++++--------- build_dependencies/install_linux.sh | 21 ++++++++++++--------- build_dependencies/install_macos.sh | 21 ++++++++++++--------- build_dependencies/install_windows.ps1 | 15 ++++++++++++--- pyproject.toml | 8 ++++++-- src/fcl/version.py | 2 +- 7 files changed, 72 insertions(+), 38 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index a60fa69..e09e957 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -2,15 +2,20 @@ name: Build Pull Requests on: [pull_request] +permissions: + contents: read + jobs: formatting: name: Check Formatting runs-on: ubuntu-latest steps: - name: Check out source repository - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Python environment - uses: actions/setup-python@v4 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: ruff @@ -26,10 +31,12 @@ jobs: matrix: platform: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, macos-15-intel] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Build wheels - uses: pypa/cibuildwheel@v3.2.1 - - uses: actions/upload-artifact@v4 + uses: pypa/cibuildwheel@8c2dcd2e96041a619f5ff03c9638d7941e2553a4 # v4.3.3 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: path: ./wheelhouse/*.whl name: wheels-${{ matrix.platform }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 854583c..26ecfb7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,6 +5,9 @@ on: branches: - master +permissions: + contents: read + jobs: build_wheels: name: Build wheel on ${{matrix.platform}} @@ -13,10 +16,12 @@ jobs: matrix: platform: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, macos-15-intel] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Build wheels - uses: pypa/cibuildwheel@v3.2.1 - - uses: actions/upload-artifact@v4 + uses: pypa/cibuildwheel@8c2dcd2e96041a619f5ff03c9638d7941e2553a4 # v4.3.3 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: path: ./wheelhouse/*.whl name: wheels-${{ matrix.platform }} @@ -28,38 +33,41 @@ jobs: permissions: id-token: write steps: - - uses: actions/setup-python@v4 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist pattern: wheels-* merge-multiple: true - - uses: pypa/gh-action-pypi-publish@v1.13.0 + - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: password: ${{ secrets.PYPI_API_TOKEN }} create_release: name: Create GitHub Release runs-on: ubuntu-latest needs: [build_wheels, upload_pypi] + permissions: + contents: write steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 + persist-credentials: false - name: Tag Version id: set_tag run: | export VER=v$(python -c "exec(open('src/fcl/version.py','r').read());print(__version__)") echo "tag_name=${VER}" >> $GITHUB_OUTPUT - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: dist pattern: wheels-* merge-multiple: true - - uses: ncipollo/release-action@v1.14.0 + - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 with: artifacts: "dist/*" tag: ${{ steps.set_tag.outputs.tag_name }} diff --git a/build_dependencies/install_linux.sh b/build_dependencies/install_linux.sh index ad899cf..d1dc81c 100644 --- a/build_dependencies/install_linux.sh +++ b/build_dependencies/install_linux.sh @@ -8,20 +8,23 @@ export CMAKE="$(dirname $(which python))/cmake" $CMAKE --version +# clone a tag and refuse to build if it doesn't point at the expected commit +clone_pinned() { + rm -rf "$4" + git clone --depth 1 --branch "$2" "$1" "$4" + test "$(git -C "$4" rev-parse HEAD)" = "$3" +} + mkdir -p deps cd deps -curl -OL https://gitlab.com/libeigen/eigen/-/archive/3.3.9/eigen-3.3.9.tar.gz +curl -fsSLO https://gitlab.com/libeigen/eigen/-/archive/3.3.9/eigen-3.3.9.tar.gz +echo "7985975b787340124786f092b3a07d594b2e9cd53bbfe5f3d9b1daee7d55f56f eigen-3.3.9.tar.gz" | sha256sum -c - tar -zxf eigen-3.3.9.tar.gz -rm -rf libccd -git clone --depth 1 --branch v2.1 https://github.com/danfis/libccd.git - -rm -rf octomap -git clone --depth 1 --branch v1.9.8 https://github.com/OctoMap/octomap.git - -rm -rf fcl -git clone --depth 1 --branch v0.7.0 https://github.com/ambi-robotics/fcl.git +clone_pinned https://github.com/danfis/libccd.git v2.1 7931e764a19ef6b21b443376c699bbc9c6d4fba8 libccd +clone_pinned https://github.com/OctoMap/octomap.git v1.9.8 d417c181868be79931ec94fd1a407c323e9f0fd3 octomap +clone_pinned https://github.com/ambi-robotics/fcl.git v0.7.0 06d38ed83d7bf33a0eeb7acb8e1d8edf13b12fb9 fcl # Install eigen $CMAKE -B build -S eigen-3.3.9 diff --git a/build_dependencies/install_macos.sh b/build_dependencies/install_macos.sh index 0ab672c..9b99e49 100644 --- a/build_dependencies/install_macos.sh +++ b/build_dependencies/install_macos.sh @@ -7,21 +7,24 @@ export CMAKE="$(dirname $(which python))/cmake" $CMAKE --version +# clone a tag and refuse to build if it doesn't point at the expected commit +clone_pinned() { + rm -rf "$4" + git clone --depth 1 --branch "$2" "$1" "$4" + test "$(git -C "$4" rev-parse HEAD)" = "$3" +} + mkdir -p deps cd deps -curl -OL https://gitlab.com/libeigen/eigen/-/archive/3.3.9/eigen-3.3.9.tar.gz +curl -fsSLO https://gitlab.com/libeigen/eigen/-/archive/3.3.9/eigen-3.3.9.tar.gz +echo "7985975b787340124786f092b3a07d594b2e9cd53bbfe5f3d9b1daee7d55f56f eigen-3.3.9.tar.gz" | shasum -a 256 -c - tar -zxf eigen-3.3.9.tar.gz mv eigen-3.3.9 eigen -rm -rf libccd -git clone --depth 1 --branch v2.1 https://github.com/danfis/libccd.git - -rm -rf octomap -git clone --depth 1 --branch v1.9.8 https://github.com/OctoMap/octomap.git - -rm -rf fcl -git clone --depth 1 --branch v0.7.0 https://github.com/ambi-robotics/fcl.git +clone_pinned https://github.com/danfis/libccd.git v2.1 7931e764a19ef6b21b443376c699bbc9c6d4fba8 libccd +clone_pinned https://github.com/OctoMap/octomap.git v1.9.8 d417c181868be79931ec94fd1a407c323e9f0fd3 octomap +clone_pinned https://github.com/ambi-robotics/fcl.git v0.7.0 06d38ed83d7bf33a0eeb7acb8e1d8edf13b12fb9 fcl # Install eigen $CMAKE -B build -S eigen diff --git a/build_dependencies/install_windows.ps1 b/build_dependencies/install_windows.ps1 index e0d9f77..094ae7f 100644 --- a/build_dependencies/install_windows.ps1 +++ b/build_dependencies/install_windows.ps1 @@ -23,12 +23,21 @@ $generator = "Visual Studio 17 2022" # All compiled dependencies will be installed in following folder $install_dir = "$base_dir\deps\install" +# Clone a tag and refuse to build if it doesn't point at the expected commit +function Get-PinnedRepo($url, $tag, $sha, $dir) { + git clone --depth 1 --branch $tag $url $dir + $head = git -C $dir rev-parse HEAD + if ($head -ne $sha) { throw "$dir is at $head, expected $sha" } +} + #------------------------------------------------------------------------------ # Eigen Write-Host "Building Eigen" $eigen_ver = "3.3.9" Invoke-WebRequest -Uri https://gitlab.com/libeigen/eigen/-/archive/$eigen_ver/eigen-$eigen_ver.tar.gz -Outfile eigen-$eigen_ver.tar.gz +$eigen_sha256 = "7985975b787340124786f092b3a07d594b2e9cd53bbfe5f3d9b1daee7d55f56f" +if ((Get-FileHash "eigen-$eigen_ver.tar.gz" -Algorithm SHA256).Hash -ne $eigen_sha256) { throw "eigen-$eigen_ver.tar.gz checksum mismatch" } tar -zxf "eigen-$eigen_ver.tar.gz" Set-Location "eigen-$eigen_ver" @@ -45,7 +54,7 @@ Set-Location .. # ------------------------------------------------------------------------------ # LibCCD Write-Host "Building LibCCD" -git clone --depth 1 --branch v2.1 https://github.com/danfis/libccd +Get-PinnedRepo https://github.com/danfis/libccd v2.1 7931e764a19ef6b21b443376c699bbc9c6d4fba8 libccd Set-Location libccd cmake -B build ` @@ -62,7 +71,7 @@ Set-Location .. # ------------------------------------------------------------------------------ # Octomap Write-Host "Building Octomap" -git clone --depth 1 --branch v1.9.8 https://github.com/OctoMap/octomap +Get-PinnedRepo https://github.com/OctoMap/octomap v1.9.8 d417c181868be79931ec94fd1a407c323e9f0fd3 octomap Set-Location octomap cmake -B build ` @@ -81,7 +90,7 @@ Set-Location .. # ------------------------------------------------------------------------------ # FCL Write-Host "Building FCL" -git clone --depth 1 --branch v0.7.0 https://github.com/ambi-robotics/fcl.git +Get-PinnedRepo https://github.com/ambi-robotics/fcl.git v0.7.0 06d38ed83d7bf33a0eeb7acb8e1d8edf13b12fb9 fcl Set-Location fcl cmake -B build ` diff --git a/pyproject.toml b/pyproject.toml index 30750c6..0fa215a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -26,12 +26,13 @@ classifiers = [ "Operating System :: MacOS", "Operating System :: Microsoft :: Windows", "Programming Language :: Python :: 3", - "Programming Language :: Python :: 3.7", - "Programming Language :: Python :: 3.8", "Programming Language :: Python :: 3.9", "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", + "Programming Language :: Python :: 3.13", + "Programming Language :: Python :: 3.14", + "Programming Language :: Python :: 3.15", "Programming Language :: Python :: Implementation :: CPython", ] keywords = ["fcl collision distance"] @@ -111,3 +112,6 @@ repair-wheel-command = "delocate-wheel -w {dest_dir} -v {wheel}" [tool.cibuildwheel.windows] before-all = "powershell build_dependencies\\install_windows.ps1" archs = ["AMD64"] +# cibuildwheel 4 defaults to delvewheel, but the dependency DLLs +# are already copied into the package by install_windows.ps1 +repair-wheel-command = "" diff --git a/src/fcl/version.py b/src/fcl/version.py index 11a4304..33e02d6 100644 --- a/src/fcl/version.py +++ b/src/fcl/version.py @@ -1 +1 @@ -__version__ = "0.7.0.11" +__version__ = "0.7.0.12"