fix: Maintenance missing or outdated check-vulnerabilities and check-actions-security ansys actions

.github/dependabot.yml

@@ -3,7 +3,9 @@ updates:
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
-      interval: monthly
+      interval: "monthly"
+    cooldown:
+      default-days: 7
     labels:
       - "maintenance"
       - "dependencies"
@@ -15,7 +17,9 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: monthly
+      interval: "monthly"
+    cooldown:
+      default-days: 7
     labels:
       - "maintenance"
     groups:

.github/workflows/ci_cd.yml

@@ -1,6 +1,10 @@
 name: GitHub CI
 on:
   pull_request:
+    # opened, reopened, and synchronize are default for pull_request
+    # edited - when PR title or body is changed
+    # labeled - when labels are added to PR
+    types: [opened, reopened, synchronize, edited, labeled]
   push:
     tags:
       - "*"
@@ -9,173 +13,60 @@ on:
   workflow_dispatch:
 
 env:
-  MAIN_PYTHON_VERSION: '3.10'
+  MAIN_PYTHON_VERSION: '3.12'
   DOCUMENTATION_CNAME: 'python-wrapper.scade.docs.pyansys.com'
   LIBRARY_NAME: 'ansys-scade-python-wrapper'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-jobs:
-
-  pr-name:
-    if: github.event_name == 'pull_request'
-    name: Check the name of the PR
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check commit name
-        uses: ansys/actions/check-pr-title@v10
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-  code-style:
-    name: "Code style"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: ansys/actions/code-style@v10
-        with:
-          python-version: ${{ env.MAIN_PYTHON_VERSION }}
-
-  doc-style:
-    name: "Documentation style"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: ansys/actions/doc-style@v10
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-  smoke-tests:
-    name: "Build and Smoke tests"
-    runs-on: ${{ matrix.os }}
-    needs: [code-style]
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest]
-        python-version: ['3.10']
-    steps:
-      - uses: ansys/actions/build-wheelhouse@v10
-        with:
-          library-name: ${{ env.LIBRARY_NAME }}
-          operating-system: ${{ matrix.os }}
-          python-version: ${{ matrix.python-version }}
-
-  tests:
-    name: "Tests"
-    runs-on: [self-hosted, 'SCADE']
-    needs: [smoke-tests]
-    strategy:
-      matrix:
-        os: [windows-latest]
-        scade-version: ['25.2']
-      fail-fast: false
-    steps:
-      - name: "Install Git and clone project"
-        uses: actions/checkout@v6
-
-      - uses: ansys/scade-actions/scade-tests-pytest@v2
-        with:
-          checkout: false
-          scade-version: ${{ matrix.scade-version }}
-
-      - name: "Upload coverage reports to Codecov"
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          slug: ansys/scade-python-wrapper
-          files: .cov/xml
+permissions: {}
 
-  doc-build:
-    name: "Build documentation"
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    needs: [doc-style]
-    steps:
-      - uses: ansys/actions/doc-build@v10
-        with:
-          python-version: ${{ env.MAIN_PYTHON_VERSION }}
-
-  build-library:
-    name: "Build library basic example"
-    runs-on: ubuntu-latest
-    needs: [tests, doc-build]
-    steps:
-      - uses: ansys/actions/build-library@v10
-        with:
-          library-name: ${{ env.LIBRARY_NAME }}
-          python-version: ${{ env.MAIN_PYTHON_VERSION }}
+jobs:
 
-  update-changelog:
-    name: "Update CHANGELOG (on release)"
-    if: github.event_name == 'push' && contains(github.ref, 'refs/tags')
-    runs-on: ubuntu-latest
+  sc:
+    uses: ansys/scade-actions/.github/workflows/scade-ext-workflow.yml@v3
     permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - uses: ansys/actions/doc-deploy-changelog@v10
-        with:
-          python-version: ${{ env.MAIN_PYTHON_VERSION }}
-          token: ${{ secrets.PYANSYS_CI_BOT_TOKEN }}
-          bot-user: ${{ secrets.PYANSYS_CI_BOT_USERNAME }}
-          bot-email: ${{ secrets.PYANSYS_CI_BOT_EMAIL }}
+      attestations: write # needed for build-wheelhouse and build-library jobs
+      contents: write # needed for update-changelog, doc-deploy-pr, release, doc-deploy-dev, and doc-deploy-stable jobs
+      id-token: write # needed for build-wheelhouse and build-library jobs
+      pull-requests: write # needed for labeler, changelog-fragment, update-changelog, and doc-deploy-pr jobs
+    with:
+      # ${{ env.XXX }} not accessible when calling a reusable workflow
+      documentation-cname: "python-wrapper.scade.docs.pyansys.com"
+      library-name: "ansys-scade-python-wrapper"
+      repository-name: "ansys/scade-python-wrapper"
+      is-public: true
+      main-python-version: '3.12'
+      # strategies
+      build-wheelhouse-versions: "['3.10']"
+      python-tests-versions: "['3.10']"
+    secrets:
+      PYANSYS_CI_BOT_TOKEN: ${{ secrets.PYANSYS_CI_BOT_TOKEN }}
+      PYANSYS_CI_BOT_USERNAME: ${{ secrets.PYANSYS_CI_BOT_USERNAME }}
+      PYANSYS_CI_BOT_EMAIL: ${{ secrets.PYANSYS_CI_BOT_EMAIL }}
+      PYANSYS_PYPI_PRIVATE_PAT: ${{ secrets.PYANSYS_PYPI_PRIVATE_PAT }}
 
   release:
     name: "Release project"
-    if: github.event_name == 'push' && contains(github.ref, 'refs/tags')
     runs-on: ubuntu-latest
-    needs: [build-library, update-changelog]
+    needs: [sc]
+    if: ${{ needs.sc.outputs.to-release }}
     permissions:
-      id-token: write
-      contents: write
+      id-token: write # mandatory for trusted publishing with pypa/gh-action-pypi-publish
+      contents: read
     steps:
       - name: "Download the library artifacts from build-library step"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: ${{ env.LIBRARY_NAME }}-artifacts
           path: ${{ env.LIBRARY_NAME }}-artifacts
 
       - name: "Upload artifacts to PyPI using trusted publisher"
-        uses: pypa/gh-action-pypi-publish@v1.13.0
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           repository-url: "https://upload.pypi.org/legacy/"
           print-hash: true
           packages-dir: ${{ env.LIBRARY_NAME }}-artifacts
           skip-existing: false
-
-      - name: "Release to GitHub"
-        uses: ansys/actions/release-github@v10
-        with:
-          library-name: ${{ env.LIBRARY_NAME }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-  doc-deploy-dev:
-    name: "Deploy development documentation"
-    # Deploy development only when merging or pushing to the 'main' branch
-    runs-on: ubuntu-latest
-    needs: [build-library]
-    if: github.event_name == 'push' && !contains(github.ref, 'refs/tags')
-    steps:
-      - uses: ansys/actions/doc-deploy-dev@v10
-        with:
-          doc-artifact-name: 'documentation-html'
-          cname: ${{ env.DOCUMENTATION_CNAME }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          bot-user: ${{ secrets.PYANSYS_CI_BOT_USERNAME }}
-          bot-email: ${{ secrets.PYANSYS_CI_BOT_EMAIL }}
-
-  doc-deploy-stable:
-    name: "Deploy stable documentation"
-    # Deploy release documentation when creating a new tag
-    runs-on: ubuntu-latest
-    needs: [release]
-    if: github.event_name == 'push' && contains(github.ref, 'refs/tags')
-    steps:
-      - uses: ansys/actions/doc-deploy-stable@v10
-        with:
-          doc-artifact-name: 'documentation-html'
-          cname: ${{ env.DOCUMENTATION_CNAME }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          bot-user: ${{ secrets.PYANSYS_CI_BOT_USERNAME }}
-          bot-email: ${{ secrets.PYANSYS_CI_BOT_EMAIL }}

doc/changelog.d/54.fixed.md

@@ -0,0 +1 @@
+Maintenance missing or outdated check-vulnerabilities and check-actions-security ansys actions