From 1e58dddb1ff9f6b8f0c28ff0743d0d227f634e78 Mon Sep 17 00:00:00 2001 From: Andreas Fehlner Date: Sat, 10 Oct 2026 19:29:14 +0200 Subject: [PATCH] chore: add monthly Dependabot and harden checkout (#2713) ## What this changes This PR adds Dependabot configuration and hardens GitHub Actions checkout behavior. ## Dependabot - adds .github/dependabot.yml - enables grouped dependency updates - schedules updates monthly - configures a 7-day cooldown to avoid rapid follow-up bumps - includes GitHub Actions updates Configured update scopes: - pip in / - github-actions in / ## GitHub Actions hardening Sets persist-credentials: false for ctions/checkout@v4 in: - .github/workflows/windows_exe.yml - .github/workflows/packages.yml - .github/workflows/lint.yml - .github/workflows/documentation.yml ## Why - grouped updates reduce PR noise - monthly cadence is lower maintenance - cooldown helps avoid update churn - disabling persisted checkout credentials follows least-privilege CI practices --------- Co-authored-by: Alexander Graf <17130992+aandergr@users.noreply.github.com> --- .github/dependabot.yml | 15 +++++++++++++++ .github/workflows/documentation.yml | 5 +++-- .github/workflows/lint.yml | 6 ++++-- .github/workflows/packages.yml | 6 ++++-- .github/workflows/stale.yml | 4 ++-- .github/workflows/windows_exe.yml | 8 +++++--- docs/README.md | 7 ++++--- docs/requirements.txt | 2 -- 8 files changed, 37 insertions(+), 16 deletions(-) create mode 100644 .github/dependabot.yml delete mode 100644 docs/requirements.txt diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..988d0d4 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,15 @@ +version: 2 +updates: + - package-ecosystem: pip + directory: "/" + schedule: + interval: monthly + cooldown: + default-days: 7 + + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: monthly + cooldown: + default-days: 7 diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml index 515bdda..d116a59 100644 --- a/.github/workflows/documentation.yml +++ b/.github/workflows/documentation.yml @@ -8,11 +8,12 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout Instaloader Repository" - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 # needed for building docs + persist-credentials: false - name: "Setup Python" - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: 3.14 cache: 'pipenv' diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 8c15307..500961a 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -12,9 +12,11 @@ jobs: python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"] steps: - name: Checkout Instaloader Repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 + with: + persist-credentials: false - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: ${{ matrix.python-version }} cache: 'pipenv' diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml index 11fcf26..120d835 100644 --- a/.github/workflows/packages.yml +++ b/.github/workflows/packages.yml @@ -11,9 +11,11 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout Repository" - uses: actions/checkout@v4 + uses: actions/checkout@v7 + with: + persist-credentials: false - name: "Setup Python" - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: 3.14 - name: "Get the tagged version" diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 3b81dd7..70290d7 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/stale@v9 + - uses: actions/stale@v10 with: repo-token: ${{ secrets.GITHUB_TOKEN }} only-labels: 'question' @@ -21,7 +21,7 @@ jobs: days-before-stale: 21 days-before-close: -1 remove-stale-when-updated: false - - uses: actions/stale@v9 + - uses: actions/stale@v10 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-issue-message: 'There has been no activity on this issue for an extended period of time. This issue will be closed after further 14 days of inactivity.' diff --git a/.github/workflows/windows_exe.yml b/.github/workflows/windows_exe.yml index ee7be72..1a5714a 100644 --- a/.github/workflows/windows_exe.yml +++ b/.github/workflows/windows_exe.yml @@ -8,9 +8,11 @@ jobs: runs-on: windows-latest steps: - name: Checkout Instaloader repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 + with: + persist-credentials: false - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: "3.14" cache: 'pipenv' @@ -28,7 +30,7 @@ jobs: - name: Create draft release and upload EXE as release asset if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') id: create_release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: diff --git a/docs/README.md b/docs/README.md index bf6099f..65c1795 100644 --- a/docs/README.md +++ b/docs/README.md @@ -7,9 +7,10 @@ https://instaloader.github.io/ ## Build -The documentation is created with [Sphinx](http://www.sphinx-doc.org/). To build it, use +The documentation is created with [Sphinx](http://www.sphinx-doc.org/). To build it, use (in the top-level directory +of the Instaloader source tree): ``` -pip3 install -r requirements.txt -make html +pipenv sync --dev +make -C docs html ``` diff --git a/docs/requirements.txt b/docs/requirements.txt deleted file mode 100644 index 47bcd9f..0000000 --- a/docs/requirements.txt +++ /dev/null @@ -1,2 +0,0 @@ -requests -sphinx~=2.3