Feat(validation): Add support for Prefix keys

.github/actions/rn-pr-labeler-action/action.yml

@@ -9,33 +9,28 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: 'Looking up existing "rn:" label'
+    - name: Label PR for release notes
+      env:
+        AUTO_CREATE_LABEL: ${{ inputs.auto_create_label }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+        PR_TITLE: ${{ github.event.pull_request.title }}
       run: |
-        echo "OLD_LABEL=$(gh pr view ${{ github.event.pull_request.number }} --json labels -q .labels[].name | grep 'rn: ')" >> $GITHUB_ENV
-      shell: bash
-    - name: 'Delete existing "rn:" label if found'
-      run: gh pr edit ${{ github.event.pull_request.number }} --remove-label "${{ env.OLD_LABEL }}"
-      shell: bash
-      if: ${{ env.OLD_LABEL }}
-    - name: Set Label
-      # Using toJSON to support ' and " in commit messages
-      # https://stackoverflow.com/questions/73363167/github-actions-how-to-escape-characters-in-commit-message
-      run: echo "LABEL=$(echo ${{ toJSON(github.event.pull_request.title) }} | cut -d ':' -f 1 | tr -d ' ' | tr ',' '|')" >> $GITHUB_ENV
-      shell: bash
-      # an alternative to verifying if the target label already exist is to
-      # create the label with --force in the next step, it will keep on changing
-      # the color of the label though so it may not be desirable.
-    - name: Check if label exist
-      run: |
-        EXIST=$(gh label list -L 100 --search "rn:" --json name -q '.[] | select(.name=="rn: ${{ env.LABEL }}").name')
-        echo "EXIST=$EXIST" >> $GITHUB_ENV
-      shell: bash
-    - name: Create Label if auto-create and label does not exist already
-      run: |
-        gh label create "rn: ${{ env.LABEL }}"
-      shell: bash
-      if: ${{ inputs.auto_create_label  && ! env.EXIST }}
-    - name: Labelling PR
-      run: |
-        gh pr edit ${{ github.event.pull_request.number }} --add-label "rn: ${{ env.LABEL }}"
+        set -euo pipefail
+
+        old_label="$(gh pr view "$PR_NUMBER" --json labels -q '.labels[].name' | grep 'rn: ' || true)"
+        if [[ -n "$old_label" ]]; then
+          while IFS= read -r label; do
+            gh pr edit "$PR_NUMBER" --remove-label "$label"
+          done <<< "$old_label"
+        fi
+
+        label="$(printf '%s' "$PR_TITLE" | cut -d ':' -f 1 | tr -d ' ' | tr ',' '|')"
+        if [[ "$AUTO_CREATE_LABEL" == "true" ]]; then
+          existing_label="$(gh label list -L 100 --search "rn:" --json name -q '.[] | select(.name | startswith("rn: ")) | .name' | grep -Fx "rn: $label" || true)"
+          if [[ -z "$existing_label" ]]; then
+            gh label create "rn: $label"
+          fi
+        fi
+
+        gh pr edit "$PR_NUMBER" --add-label "rn: $label"
       shell: bash

.github/dependabot.yml

@@ -18,6 +18,8 @@ updates:
     commit-message:
       prefix: "Bump(requirements): "
       prefix-development: "CI(requirements):"
+    cooldown:
+      default-days: 7
   # Maintain dependencies for GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
@@ -26,6 +28,8 @@ updates:
       day: "monday"
     commit-message:
       prefix: "CI: "
+    cooldown:
+      default-days: 7
   # Maintain dependencies for Rust crates
   - package-ecosystem: "cargo"
     directory: "/"
@@ -34,6 +38,8 @@ updates:
       day: "monday"
     commit-message:
       prefix: "Bump(rust): "
+    cooldown:
+      default-days: 7
   # Maintain the pinned Rust toolchain
   - package-ecosystem: "rust-toolchain"
     directory: "/"
@@ -42,3 +48,5 @@ updates:
       day: "monday"
     commit-message:
       prefix: "Bump(rust): "
+    cooldown:
+      default-days: 7

.github/workflows/build-wheel.yml

@@ -19,6 +19,9 @@ env:
   # rust
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   # ------------------------------------------------------------ #
   # Build cross platform pyavd-utils wheels and upload artifacts
@@ -27,19 +30,23 @@ jobs:
     name: Build pyavd-utils wheel on ${{ inputs.runner }}
     runs-on: ${{ inputs.runner }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
       - name: Update version to ${{ inputs.TESTPYPI_VERSION }}
         if: ${{ inputs.TESTPYPI_VERSION != '' }}
         shell: bash # For our Windows friend
+        env:
+          TESTPYPI_VERSION: ${{ inputs.TESTPYPI_VERSION }}
         run: |-
           pip install bump-my-version
           bump-my-version replace \
             --regex \
             --search "__version__ = \"[^\n]*\"" \
-            --replace "__version__ = \"${{ inputs.TESTPYPI_VERSION }}\"" \
+            --replace "__version__ = \"${TESTPYPI_VERSION}\"" \
             --no-configured-files \
             -v \
             pyavd_utils/__init__.py
@@ -52,7 +59,7 @@ jobs:
         # and will not copy the parent Cargo.toml and we will be sad
         run: |-
           python -m cibuildwheel --output-dir dist
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pyavd-utils-wheels-${{ inputs.runner }}
           path: dist/*.whl
@@ -69,13 +76,15 @@ jobs:
       matrix:
         python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Download ${{ inputs.runner }} wheel(s)
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pyavd-utils-wheels-${{ inputs.runner }}
           path: dist
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python }}
       - name: Install tox
@@ -113,9 +122,11 @@ jobs:
           apk add nodejs --update-cache
           mkdir /opt/bin
           ln -s /usr/bin/node /opt/bin/node
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Download ${{ inputs.runner }} wheel(s)
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pyavd-utils-wheels-${{ inputs.runner }}
           path: dist

.github/workflows/codecov.yml

@@ -13,24 +13,26 @@ jobs:
       contents: read
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Download coverage from pytest
         continue-on-error: true
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: pytest-coverage
           path: .
 
       - name: Download coverage report from rust tests
         continue-on-error: true
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: rust-llvm-cov
           path: .
 
       - name: Upload results to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           use_oidc: true
           files: coverage.xml,lcov.info

.github/workflows/pull-request-autofix.yml

@@ -0,0 +1,48 @@
+---
+name: autofix.ci
+
+"on":
+  pull_request:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: autofix-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  autofix:
+    name: Run pre-commit and commit back any changes
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      # Needed until we move to prek and get proper support for toolchain profile - preferably per hook.
+      - name: Install Rust nightly formatter
+        run: rustup toolchain install nightly --component rustfmt --no-self-update
+
+      - name: Run pre-commit
+        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        continue-on-error: true
+        with:
+          extra_args: --all-files
+        # Allowing cargo installs to be unoptimized for install speed.
+        env:
+          CARGO_PROFILE_RELEASE_OPT_LEVEL: 0
+          CARGO_PROFILE_RELEASE_LTO: false
+          CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 256
+
+      - name: Commit back any git diff
+        uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4

.github/workflows/pull-request-conflict.yml

@@ -1,15 +1,20 @@
 name: "PR Conflicts checker"
-"on":
+"on": # zizmor: ignore[dangerous-triggers] Uses pull_request_target only to label/comment on PR metadata, not to check out or execute PR code.
   pull_request_target:
     types: [synchronize]
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   Conflict_Check:
     name: "Check PR status: conflicts and resolution"
     runs-on: ubuntu-latest
     steps:
       - name: Check if PRs are dirty
-        uses: eps1lon/actions-label-merge-conflict@releases/2.x
+        uses: eps1lon/actions-label-merge-conflict@0273be72a0bbd58fcd71d0d6c02c209b50d1e5e1 # v3.1.0
         with:
           dirtyLabel: "state: conflict"
           removeOnDirtyLabel: "state: conflict resolved"