Merge pull request #3 from firebase/nc.sec

build: secure CI workflows and remove unused poetry dependencies

.github/workflows/spm.yml

@@ -1,5 +1,8 @@
 name: spm
 
+permissions:
+  contents: read
+
 on:
   push:
   pull_request:
@@ -8,7 +11,7 @@ jobs:
   swift-build-run:
     runs-on: macOS-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Build
       run: swift build
     - name: Run

.github/workflows/tests.yml

@@ -1,4 +1,8 @@
 name: Test after code changes
+
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -29,7 +33,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           path: nanopb
 
@@ -51,7 +55,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           path: nanopb
           fetch-depth: "0"
@@ -73,7 +77,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           path: nanopb
           fetch-depth: "0"

extra/poetry/poetry_build.sh

@@ -1,9 +0,0 @@
-#!/bin/bash
-
-rm -rf nanopb
-mkdir nanopb
-cp -pr ../../generator nanopb/
-touch nanopb/__init__.py nanopb/generator/__init__.py
-cp -pr ../../README.md .
-sed -i -e 's/\(version =.*\)-dev.*/\1-dev'$(git rev-list HEAD --count)'"/' pyproject.toml
-poetry build

extra/poetry/pyproject.toml

@@ -1,26 +0,0 @@
-[tool.poetry]
-name = "nanopb"
-version = "0.3.9.10"
-description = "Nanopb is a small code-size Protocol Buffers implementation in ansi C. It is especially suitable for use in microcontrollers, but fits any memory restricted system."
-authors = ["Petteri Aimonen <jpa@npb.mail.kapsi.fi>"]
-license = "Zlib"
-repository = "https://github.com/nanopb/nanopb/"
-readme = "README.md"
-homepage = "https://jpa.kapsi.fi/nanopb/"
-documentation = "https://jpa.kapsi.fi/nanopb/docs/index.html"
-keywords = ["protobuf", "protoc"]
-classifiers = ["Topic :: Software Development :: Build Tools"]
-
-[tool.poetry.scripts]
-nanopb_generator = "nanopb.generator.nanopb_generator:main_cli"
-protoc-gen-nanopb = "nanopb.generator.nanopb_generator:main_plugin"
-
-[tool.poetry.dependencies]
-python = ">=2.7"
-protobuf = ">=3.6"
-
-[tool.poetry.dev-dependencies]
-
-[build-system]
-requires = ["poetry>=0.12"]
-build-backend = "poetry.masonry.api"

tools/set_version.sh

@@ -12,5 +12,3 @@ VERSION_ONLY=$(echo $1 | sed 's/nanopb-//')
 if [[ $1 != *dev ]]
 then sed -i -e 's/"version":\s*"[^"]*"/"version": "'$VERSION_ONLY'"/' library.json
 fi
-
-sed -i -e 's/version =.*/version = "'$VERSION_ONLY'"/' extra/poetry/pyproject.toml