ci: Resolve GitHub Actions security and fix Zizmor findings for TFMA

.github/workflows/ci-lint.yml

@@ -3,19 +3,25 @@ name: pre-commit
 on:
   pull_request:
   push:
-     branches: [master]
+    branches: [master]
+
+permissions:
+  contents: read
 
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         # Ensure the full history is fetched
         # This is required to run pre-commit on a specific set of commits
         # TODO: Remove this when all the pre-commit issues are fixed
         fetch-depth: 0
-    - uses: actions/setup-python@v5.1.1
+        persist-credentials: false
+    - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
-        python-version: 3.13
-    - uses: pre-commit/action@v3.0.1
+        python-version: "3.13"
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.github/workflows/ci-test.yml

@@ -1,6 +1,7 @@
 # Github action definitions for unit-tests with PRs.
 
 name: tfma-unit-tests
+
 on:
   push:
   pull_request:
@@ -10,23 +11,27 @@ on:
       - 'docs/**'
   workflow_dispatch:
 
-env:
-  USE_BAZEL_VERSION: 7.7.0
+permissions:
+  contents: read
 
 jobs:
   unit-tests:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     strategy:
       matrix:
         python-version: ['3.10', '3.11', '3.12', '3.13']
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: ${{ matrix.python-version }}
         cache: 'pip'

.github/workflows/docs.yml

@@ -1,52 +1,40 @@
-name: Deploy docs
+name: docs
+
 on:
-  workflow_dispatch:
   push:
     branches:
-      - 'master'
+      - master
   pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+
 permissions:
-  contents: write
+  contents: read
+
 jobs:
-  deploy:
+  build:
+    name: Build docs
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Configure Git Credentials
-        run: |
-          git config user.name github-actions[bot]
-          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-        if: (github.event_name != 'pull_request')
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
-      - name: Set up Python 3.9
-        uses: actions/setup-python@v5
+      - name: Set up Python 3.12
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
-          python-version: '3.9'
+          python-version: '3.12'
           cache: 'pip'
           cache-dependency-path: |
             setup.py
             requirements-docs.txt
 
-      - name: Save time for cache for mkdocs
-        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-
-      - name: Caching
-        uses: actions/cache@v4
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: .cache
-          restore-keys: |
-            mkdocs-material-
-
       - name: Install Dependencies
         run: pip install -r requirements-docs.txt
 
-      - name: Deploy to GitHub Pages
-        run: mkdocs gh-deploy --force
-        if: (github.event_name != 'pull_request')
-
       - name: Build docs to check for errors
         run: mkdocs build
-        if: (github.event_name == 'pull_request')

.github/workflows/wheels.yml

@@ -6,24 +6,31 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 env:
   USE_BAZEL_VERSION: 7.7.0
 
 jobs:
   build_wheels:
     name: Build wheels
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - name: Check out the repo
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Set up python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: '3.10'
 
     - name: Install Protoc
-      uses: arduino/setup-protoc@v3
+      uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
 
     - name: Remove buggy sitecustomize
       run: |
@@ -47,7 +54,7 @@ jobs:
         twine check wheelhouse/*
 
     - name: Upload wheel
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
       with:
         name: wheels
         path: ./wheelhouse/*.whl
@@ -61,10 +68,11 @@ jobs:
       name: pypi
       url: https://pypi.org/p/tensorflow-model-analysis
     permissions:
+      contents: read
       id-token: write
     steps:
       - name: Retrieve wheels and sdist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           merge-multiple: true
           path: wheels/
@@ -74,9 +82,10 @@ jobs:
           ls -lAs wheels/
 
       - name: Upload to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        # zizmor: ignore[use-trusted-publishing]
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
-          packages_dir: wheels/
+          packages-dir: wheels/
           verify-metadata: false
           verbose: true

mkdocs.yml

@@ -43,6 +43,8 @@ plugins:
   - autorefs
   - mkdocstrings:
       default_handler: python
+      inventories:
+        - https://docs.python.org/3/objects.inv
       handlers:
         python:
           options:
@@ -70,8 +72,6 @@ plugins:
               - "!^logger"
             extensions:
               - griffe_inherited_docstrings
-          import:
-            - https://docs.python.org/3/objects.inv
 
 extra_css:
   - stylesheets/extra.css