Fix workflows following security review.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: brynpickering

.github/actionlint.yaml

@@ -3,3 +3,6 @@ paths:
     ignore:
       - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
       - 'reusable workflow call "\$/[^"]+" at "uses" is not following the format'
+  .github/workflows/release.yml:
+    ignore:
+      - 'property "pypsa_bot_private_key" is not defined'

.github/actions/pypsa-eur-swap/action.yml

@@ -11,7 +11,7 @@ inputs:
     description: Commit SHA (40 hex chars) or branch to install.
     required: true
   also-upgrade:
-    description: Space-separated packages to upgrade afterwards.
+    description: Space-separated packages to upgrade afterwards. They and the swapped package skip the pypsa-eur exclude-newer cooldown.
     default: ''
   working-directory:
     description: pypsa-eur checkout.
@@ -30,7 +30,16 @@ runs:
       run: |
         set -euo pipefail
         PACKAGE="${PACKAGE:-${GITHUB_REPOSITORY#*/}}"
-        sed -i.bak '/^exclude-newer[[:space:]]*=/d' pixi.toml && rm pixi.toml.bak
+        awk -v pkgs="$PACKAGE $ALSO_UPGRADE" '
+          function exempt() { for (i = 1; i <= n; i++) print "\"" p[i] "\" = \"0d\""; done = 1 }
+          BEGIN { n = split(pkgs, p, " "); for (i = 1; i <= n; i++) skip[p[i]] = 1 }
+          /^\[/ { section = $1 }
+          section == "[exclude-newer]" { key = $1; gsub(/"/, "", key); if (key in skip) next }
+          { print }
+          $1 == "[exclude-newer]" { exempt() }
+          END { if (!done) { print ""; print "[exclude-newer]"; exempt() } }
+        ' pixi.toml >pixi.toml.new
+        mv pixi.toml.new pixi.toml
         pixi remove "$PACKAGE"
         if [[ "$REV" =~ ^[0-9a-f]{40}$ ]]; then ref_flag=--rev; else ref_flag=--branch; fi
         pixi add --pypi --git "https://github.com/$REPOSITORY.git" "$PACKAGE" "$ref_flag" "$REV"

.github/actions/secret-env/action.yml

@@ -16,6 +16,9 @@ inputs:
   uv-locked:
     description: Library mode only. Install dependencies from uv.lock with uv sync before the wheel.
     default: 'false'
+  cooldown:
+    description: Library mode only. Ignore conda and PyPI releases newer than this age, e.g. 7d. Empty disables. uv-locked installs ignore it.
+    default: 7d
   wheel-dir:
     description: Directory, relative to working-directory or absolute, that holds exactly one wheel.
     default: dist
@@ -28,14 +31,11 @@ inputs:
   pixi-version:
     description: pixi version.
     default: v0.81.0
-  secrets-json:
-    description: Pass toJSON(secrets).
-    default: '{}'
   vars-json:
     description: Pass toJSON(vars).
     default: '{}'
-  secret-env:
-    description: Space-separated secret or variable names to export as env vars.
+  vars-env:
+    description: Space-separated variable names to export as env vars.
     default: ''
   working-directory:
     description: Directory of the caller package or project.
@@ -54,12 +54,11 @@ runs:
         echo "::error::mode must be library or project" >&2
         exit 1
 
-    - if: inputs.secret-env != ''
-      uses: $/.github/actions/secret-env
+    - if: inputs.vars-env != ''
+      uses: $/.github/actions/vars-env
       with:
-        secrets-json: ${{ inputs.secrets-json }}
         vars-json: ${{ inputs.vars-json }}
-        names: ${{ inputs.secret-env }}
+        names: ${{ inputs.vars-env }}
 
     - name: Prepare library environment
       id: library-prep
@@ -68,9 +67,11 @@ runs:
       env:
         PYTHON_VERSION: ${{ inputs.python-version }}
         PIXI_ADD: ${{ inputs.pixi-add }}
+        COOLDOWN: ${{ inputs.cooldown }}
       run: |
         set -euo pipefail
         [ -n "$PYTHON_VERSION" ] || { echo "::error::python-version is required in library mode" >&2; exit 1; }
+        [[ "$COOLDOWN" =~ ^([0-9]+d)?$ ]] || { echo "::error::cooldown must be empty or a number of days such as 7d, got '$COOLDOWN'" >&2; exit 1; }
         case "$RUNNER_OS-$RUNNER_ARCH" in
           Linux-X64) platform=linux-64 ;;
           Linux-ARM64) platform=linux-aarch64 ;;
@@ -87,6 +88,7 @@ runs:
         done
         mkdir -p "$temp/env"
         printf '[workspace]\nname = "env"\nchannels = [%s]\nplatforms = ["%s"]\n' "$channels" "$platform" >"$temp/env/pixi.toml"
+        [ -z "$COOLDOWN" ] || printf 'exclude-newer = "%s"\n' "$COOLDOWN" >>"$temp/env/pixi.toml"
         cat "$temp/env/pixi.toml"
         {
           echo "PIXI_CACHE_DIR=$temp/pixi-cache"
@@ -140,6 +142,7 @@ runs:
         EXTRAS: ${{ inputs.extras }}
         UV_LOCKED: ${{ inputs.uv-locked }}
         WHEEL_DIR: ${{ inputs.wheel-dir }}
+        COOLDOWN: ${{ inputs.cooldown }}
       run: |
         set -euo pipefail
         read -ra specs <<<"$PIXI_ADD"
@@ -156,10 +159,9 @@ runs:
           UV_PROJECT_ENVIRONMENT="$(dirname "$MANIFEST")/.pixi/envs/default" \
             $run uv sync --locked --inexact --no-install-project ${extra_args[@]+"${extra_args[@]}"}
           $run uv pip install --no-deps "$wheel"
-        elif [ -n "$EXTRAS" ]; then
-          $run uv pip install "$wheel[$EXTRAS]"
         else
-          $run uv pip install "$wheel"
+          [ -z "$COOLDOWN" ] || export UV_EXCLUDE_NEWER="$COOLDOWN"
+          $run uv pip install "$wheel${EXTRAS:+[$EXTRAS]}"
         fi
         echo "run=$run" >>"$GITHUB_OUTPUT"
 

.github/actions/setup-env/action.yml

@@ -0,0 +1,27 @@
+name: Export variable env
+description: Export named repository or organization variables as env vars. A missing name fails.
+inputs:
+  vars-json:
+    description: Pass toJSON(vars).
+    default: '{}'
+  names:
+    description: Space-separated variable names.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Export variable env
+      shell: bash
+      env:
+        VARS_JSON: ${{ inputs.vars-json }}
+        NAMES: ${{ inputs.names }}
+      run: |
+        set -euo pipefail
+        set -f
+        for name in $NAMES; do
+          [[ "$name" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || { echo "::error::vars-env: invalid name '$name'" >&2; exit 1; }
+          jq -e --arg n "$name" 'has($n)' <<<"$VARS_JSON" >/dev/null || { echo "::error::vars-env: '$name' is not a variable" >&2; exit 1; }
+          value=$(jq -r --arg n "$name" '.[$n]' <<<"$VARS_JSON")
+          delim="EOF_$(openssl rand -hex 16)"
+          printf '%s<<%s\n%s\n%s\n' "$name" "$delim" "$value" "$delim" >>"$GITHUB_ENV"
+        done

.github/actions/vars-env/action.yml

@@ -23,6 +23,10 @@ on:
         type: string
         default: ""
         description: Space-separated conda-forge specs to add to the env.
+      cooldown:
+        type: string
+        default: 7d
+        description: Ignore conda and PyPI releases newer than this age, e.g. 7d. Empty disables. uv-locked installs ignore it.
       pytest-args:
         type: string
         default: ""
@@ -39,14 +43,23 @@ on:
         type: string
         default: ""
         description: Fail if a benchmark mean regresses by more than this percent. Empty never fails (compare mode only).
-      secret-env:
+      vars-env:
         type: string
         default: ""
-        description: Space-separated secret or variable names to export to the job env.
+        description: Space-separated repository or organization variable (`vars`) names to export to the job env.
       working-directory:
         type: string
         default: .
         description: Directory of the package, relative to the repo root.
+    secrets:
+      CDSAPI_TOKEN:
+        required: false
+      EARTHDATAHUB_API_KEY:
+        required: false
+      MSK_LICENSE:
+        required: false
+      GUROBI_LIC:
+        required: false
 
 permissions: {}
 
@@ -59,6 +72,13 @@ jobs:
     outputs:
       legs: ${{ steps.legs.outputs.legs }}
     steps:
+      - uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+      - if: github.event_name == 'pull_request_target'
+        run: |
+          echo "::error::pull_request_target runs fork code with secrets. Use pull_request." >&2
+          exit 1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
@@ -92,6 +112,10 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.build.outputs.legs) }}
     steps:
+      - uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        if: matrix.runner != 'codspeed-macro'
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
@@ -105,15 +129,19 @@ jobs:
           python-version: ${{ inputs.python-version }}
           pixi-add: ${{ inputs.pixi-add }}
           extras: ${{ inputs.extras }}
+          cooldown: ${{ inputs.cooldown }}
           wheel-dir: ${{ runner.temp }}/wheels
-          secrets-json: ${{ toJSON(secrets) }}
           vars-json: ${{ toJSON(vars) }}
-          secret-env: ${{ inputs.secret-env }}
+          vars-env: ${{ inputs.vars-env }}
           working-directory: ${{ inputs.working-directory }}
       - uses: CodSpeedHQ/action@c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5 # v5.4.0
         env:
           BENCHMARK_PATH: ${{ inputs.benchmark-path }}
           PYTEST_ARGS: ${{ inputs.pytest-args }}
+          CDSAPI_TOKEN: ${{ secrets.CDSAPI_TOKEN }}
+          EARTHDATAHUB_API_KEY: ${{ secrets.EARTHDATAHUB_API_KEY }}
+          MSK_LICENSE: ${{ secrets.MSK_LICENSE }}
+          GUROBI_LIC: ${{ secrets.GUROBI_LIC }}
         with:
           mode: ${{ matrix.mode }}
           working-directory: ${{ inputs.working-directory }}
@@ -131,6 +159,13 @@ jobs:
       EXTRAS: ${{ inputs.extras }}
       IS_PR: ${{ github.event_name == 'pull_request' }}
     steps:
+      - uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+      - if: github.event_name == 'pull_request_target'
+        run: |
+          echo "::error::pull_request_target runs fork code with secrets. Use pull_request." >&2
+          exit 1
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
@@ -189,13 +224,18 @@ jobs:
           python-version: ${{ inputs.python-version }}
           pixi-add: ${{ inputs.pixi-add }}
           extras: ${{ inputs.extras }}
+          cooldown: ${{ inputs.cooldown }}
           wheel-dir: ${{ steps.wheels.outputs.first }}
-          secrets-json: ${{ toJSON(secrets) }}
           vars-json: ${{ toJSON(vars) }}
-          secret-env: ${{ inputs.secret-env }}
+          vars-env: ${{ inputs.vars-env }}
           working-directory: ${{ steps.base.outputs.present == 'true' && 'base' || 'head' }}/${{ inputs.working-directory }}
       - if: steps.base.outputs.present == 'true'
         working-directory: base/${{ inputs.working-directory }}
+        env:
+          CDSAPI_TOKEN: ${{ secrets.CDSAPI_TOKEN }}
+          EARTHDATAHUB_API_KEY: ${{ secrets.EARTHDATAHUB_API_KEY }}
+          MSK_LICENSE: ${{ secrets.MSK_LICENSE }}
+          GUROBI_LIC: ${{ secrets.GUROBI_LIC }}
         run: |
           set -euo pipefail
           if [ -e "$BENCHMARK_PATH" ]; then
@@ -209,6 +249,11 @@ jobs:
           WHEEL: ${{ steps.wheels.outputs.head }}
         run: $RUN uv pip install --reinstall-package "$PACKAGE" "$WHEEL[$EXTRAS]"
       - working-directory: head/${{ inputs.working-directory }}
+        env:
+          CDSAPI_TOKEN: ${{ secrets.CDSAPI_TOKEN }}
+          EARTHDATAHUB_API_KEY: ${{ secrets.EARTHDATAHUB_API_KEY }}
+          MSK_LICENSE: ${{ secrets.MSK_LICENSE }}
+          GUROBI_LIC: ${{ secrets.GUROBI_LIC }}
         run: $RUN pytest "$BENCHMARK_PATH" --benchmark-only --benchmark-json="$RUNNER_TEMP/head.json" $PYTEST_ARGS
       - working-directory: head/${{ inputs.working-directory }}
         run: |

.github/workflows/benchmark.yml

@@ -16,17 +16,27 @@ jobs:
     permissions:
       contents: read
     steps:
+      - uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-      - run: uvx --from actionlint-py actionlint
-      - run: uvx zizmor --offline .github
+        with:
+          version: 0.13.0
+      - run: uvx --from actionlint-py==1.7.12.25 actionlint
+      - env:
+          GH_TOKEN: ${{ github.token }}
+        run: uvx zizmor@1.30.1 .github
 
   matrix-action:
     runs-on: ubuntu-latest
     permissions: {}
     steps:
+      - uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
       - id: lean
         uses: $/.github/actions/matrix
         with:
@@ -50,7 +60,7 @@ jobs:
     uses: ./.github/workflows/test.yml
     permissions:
       contents: read
-    secrets: inherit
+      id-token: write
     with:
       working-directory: tests/fixture-package
       pixi-add: glpk
@@ -60,6 +70,7 @@ jobs:
     uses: ./.github/workflows/test.yml
     permissions:
       contents: read
+      id-token: write
     with:
       working-directory: tests/fixture-project
       pixi-task: test
@@ -72,7 +83,6 @@ jobs:
       contents: read
       pull-requests: write
       id-token: write
-    secrets: inherit
     with:
       mode: compare
       benchmark-path: benchmarks
@@ -90,7 +100,6 @@ jobs:
     permissions:
       contents: write
       id-token: write
-    secrets: inherit
     with:
       dry-run: true
       test: false
@@ -103,7 +112,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    secrets: inherit
     with:
       package: pypsa
       repository: PyPSA/PyPSA

.github/workflows/ci.yml

@@ -28,6 +28,9 @@ jobs:
     permissions:
       contents: read
     steps:
+      - uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false