update GitHub actions, validate common versions

.github/workflows/codeql.yml

@@ -21,7 +21,7 @@ on:
     - cron: '44 21 * * 0'
 
 jobs:
-  analyze:
+  run:
     name: Analyze
     # Runner size impacts CodeQL analysis time. To learn more, please see:
     #   - https://gh.io/recommended-hardware-resources-for-running-codeql
@@ -43,11 +43,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4.1.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         config-file: ./.github/codeql/config.yml
         languages: ${{ matrix.language }}
@@ -59,6 +59,6 @@ jobs:
         # queries: security-extended,security-and-quality
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/docs.yml

@@ -15,16 +15,16 @@ jobs:
     steps:
 
       - name: Acquire sources
-        uses: actions/checkout@v3.1.0
+        uses: actions/checkout@v4.1.1
 
       - name: Setup Python
-        uses: actions/setup-python@v4.3.0
+        uses: actions/setup-python@v5.0.0
         with:
           python-version: "3.12"
           architecture: x64
 
       - name: Apply caching of dependencies
-        uses: actions/cache@v3.0.11
+        uses: actions/cache@v3.3.2
         with:
           path: ~/.cache/pip
           key: pip-${{ hashFiles('**/requirements-*.txt') }}

.github/workflows/mypy.yml

@@ -14,16 +14,16 @@ jobs:
     steps:
 
       - name: Acquire sources
-        uses: actions/checkout@v3.1.0
+        uses: actions/checkout@v4.1.1
 
       - name: Setup Python
-        uses: actions/setup-python@v4.3.0
+        uses: actions/setup-python@v5.0.0
         with:
-          python-version: 3.11
+          python-version: "3.12"
           architecture: x64
 
       - name: Apply caching of dependencies
-        uses: actions/cache@v3.0.11
+        uses: actions/cache@v3.3.2
         with:
           path: ~/.cache/pip
           key: pip-${{ hashFiles('**/requirements-*.txt') }}

.github/workflows/quality.yml

@@ -15,16 +15,16 @@ jobs:
     steps:
 
       - name: Acquire sources
-        uses: actions/checkout@v3.1.0
+        uses: actions/checkout@v4.1.1
 
       - name: Setup Python
-        uses: actions/setup-python@v4.3.0
+        uses: actions/setup-python@v5.0.0
         with:
-          python-version: "3.11"
+          python-version: "3.12"
           architecture: x64
 
       - name: Apply caching of dependencies
-        uses: actions/cache@v3.0.11
+        uses: actions/cache@v3.3.2
         with:
           path: ~/.cache/pip
           key: pip-${{ hashFiles('**/requirements-*.txt') }}

.github/workflows/tests.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
 
-  tests:
+  run:
     runs-on: ${{ matrix.os }}
 
     strategy:
@@ -25,27 +25,24 @@ jobs:
     steps:
 
       - name: Acquire sources
-        uses: actions/checkout@v3.1.0
+        uses: actions/checkout@v4.1.1
 
       - name: Setup Python
-        uses: actions/setup-python@v4.3.0
+        uses: actions/setup-python@v5.0.0
         with:
           python-version: ${{ matrix.python-version }}
           architecture: x64
 
       - name: Apply caching of dependencies
-        uses: actions/cache@v3.0.11
+        uses: actions/cache@v3.3.2
         with:
           path: ~/.cache/pip
           key: os=${{ matrix.os }}-python=${{ matrix.python-version }}-pip-${{ hashFiles('**/requirements-*.txt') }}
 
       - name: Install dependencies
         run: |
           pip install -U pip setuptools wheel
-          pip install -r requirements.txt -r requirements/requirements-test.txt -r requirements/requirements-docs.txt django~=${{ matrix.django-version }} cryptography~=${{ matrix.cryptography-version }}
-
-      - name: Install program
-        run: pip install -e .
+          pip install -r requirements.txt -r requirements/requirements-test.txt django~=${{ matrix.django-version }} cryptography~=${{ matrix.cryptography-version }}
 
       - name: Initialize demo
         run: python dev.py init-demo

.readthedocs.yaml

@@ -7,7 +7,7 @@ version: 2
 build:
   os: ubuntu-22.04
   tools:
-    python: "3.10"
+    python: "3.12"
   jobs:
     pre_build:
       - make -C docs extra-files

devscripts/config.py

@@ -49,7 +49,8 @@ def minor_to_major(version: str) -> str:
 
 
 with open(PYPROJECT_PATH, "rb") as _pyproject_stream:
-    _release_config = tomllib.load(_pyproject_stream)["django-ca"]["release"]
+    _pyproject_toml = tomllib.load(_pyproject_stream)
+_release_config = _pyproject_toml["django-ca"]["release"]
 
 PYTHON_RELEASES = tuple(typing.cast(List[str], _release_config["python"]))
 DJANGO = tuple(typing.cast(List[str], _release_config["django"]))
@@ -59,6 +60,7 @@ def minor_to_major(version: str) -> str:
 ALPINE_RELEASES = tuple(typing.cast(List[str], _release_config["alpine"]))
 DEBIAN_RELEASES = tuple(typing.cast(List[str], _release_config["debian-releases"]))
 UBUNTU_RELEASES = tuple(typing.cast(List[str], _release_config["ubuntu-releases"]))
+GITHUB_CONFIG = _release_config["github"]
 
 # Compute list of valid alpine images
 _alpine_images = ["default"]

devscripts/validation/state.py

@@ -100,17 +100,48 @@ def check(
     return errors
 
 
+def check_github_action_versions(job) -> int:
+    """Check versions of/in GitHub actions."""
+    errors = 0
+    expected_action_versions = config.GITHUB_CONFIG["actions"]
+    for step_config in job["steps"]:
+        if step_uses := step_config.get("uses"):
+            action, action_version = step_uses.split("@", 1)
+
+            if expected_action_version := expected_action_versions.get(action):
+                if expected_action_version != action_version:
+                    errors += err(f"{action}: Have {action_version}, expected {expected_action_version}")
+            else:
+                info(f"{action}: action version not configured")
+
+            if action == "actions/setup-python":
+                py_version = step_config["with"]["python-version"]
+                if py_version != "${{ matrix.python-version }}" and py_version != config.PYTHON_RELEASES[-1]:
+                    errors += err(f"Outdated Python version: {py_version}")
+    return errors
+
+
 def check_github_actions_tests() -> int:
     """Check GitHub actions."""
-    relpath = Path(".github", "workflows", "tests.yml")
-    check_path(relpath)
-    with open(config.ROOT_DIR / relpath, encoding="utf-8") as stream:
-        action_config = yaml.safe_load(stream)
-    matrix = action_config["jobs"]["tests"]["strategy"]["matrix"]
-
-    errors = simple_diff("Python versions", tuple(matrix["python-version"]), config.PYTHON_RELEASES)
-    errors += simple_diff("Django versions", tuple(matrix["django-version"]), config.DJANGO)
-    errors += simple_diff("cryptography versions", tuple(matrix["cryptography-version"]), config.CRYPTOGRAPHY)
+    errors = 0
+    for workflow in Path(".github", "workflows").glob("*.yml"):
+        check_path(workflow)
+        with open(config.ROOT_DIR / workflow, encoding="utf-8") as stream:
+            action_config = yaml.safe_load(stream)
+
+        for job_name, job in action_config["jobs"].items():
+            check_github_action_versions(job)
+
+            if workflow.name == "tests.yml":
+                matrix = job["strategy"]["matrix"]
+                errors += simple_diff(
+                    "Python versions", tuple(matrix["python-version"]), config.PYTHON_RELEASES
+                )
+                errors += simple_diff("Django versions", tuple(matrix["django-version"]), config.DJANGO)
+                errors += simple_diff(
+                    "cryptography versions", tuple(matrix["cryptography-version"]), config.CRYPTOGRAPHY
+                )
+
     return errors
 
 

pyproject.toml

@@ -40,6 +40,17 @@ ubuntu-releases = [
     "mantic",  # 23.10, until 2024-07
 ]
 
+[django-ca.release.github]
+# Action versions can be retrieved directly from the GitHub "marketplace", e.g.:
+#   https://github.com/marketplace/actions/checkout
+actions."actions/checkout" = "v4.1.1"
+actions."actions/setup-python" = "v5.0.0"
+actions."actions/cache" = "v3.3.2"
+# CodeQL actions are actually all in the same repository:
+#   https://github.com/github/codeql-action
+actions."github/codeql-action/init" = "v3"
+actions."github/codeql-action/analyze" = "v3"
+
 [django-ca.validation]
 # list glob-style patterns to exclude from any check (currently only license headers)
 excludes = [