Merge pull request #459 from joshuagl/joshuagl/ci

Quick round of CI improvements

.github/workflows/check-upstream-ed25519.yml

@@ -5,24 +5,26 @@ on:
     - cron: '0 13 * * *'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   check-ed25519-upstream:
     name: Open an issue if upstream ed25519 has new commits
     runs-on: ubuntu-latest
     steps:
     - name: Check out repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
     - name: Test if ed25519 upstream master HEAD is what we expect
       id: test_ed25519
       run: |
         if output=$(securesystemslib/_vendor/test-ed25519-upstream.sh); then
-          echo "::set-output name=result::0"
+          echo "result=0" >> $GITHUB_OUTPUT
         else
-          echo "::set-output name=result::1"
-          echo "::set-output name=output::$output"
+          echo "result=1" >> $GITHUB_OUTPUT
+          echo "output=$output" >> $GITHUB_OUTPUT
         fi
     - name: Create issue (unless one is open already)
-      uses: actions/github-script@v3
+      uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0
       if: ${{ steps.test_ed25519.outputs.result == '1' }}
       with:
         script: |

.github/workflows/ci.yml

@@ -7,52 +7,42 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
     strategy:
       fail-fast: false
       # Run tests on each OS/Python combination
       matrix:
-        python-version: ["3.7", "3.8", "3.9", "3.10"]
+        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
         # TODO: Add windows-latest when gpg issues are solved
         os: [ubuntu-latest, macos-latest]
         toxenv: [py]
 
         include:
-          - python-version: 3.8
+          - python-version: "3.11"
             os: ubuntu-latest
-            toxenv: purepy38
-          - python-version: 3.8
+            toxenv: purepy311
+          - python-version: "3.11"
             os: ubuntu-latest
-            toxenv: py38-no-gpg
-          - python-version: 3.8
+            toxenv: py311-no-gpg
+          - python-version: "3.8"
             os: ubuntu-latest
             toxenv: lint
 
     runs-on: ${{ matrix.os }}
 
     steps:
       - name: Checkout securesystemslib
-        uses: actions/checkout@v2
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984
         with:
           python-version: ${{ matrix.python-version }}
-
-      - name: Find pip cache dir
-        id: pip-cache
-        run: echo "::set-output name=dir::$(pip cache dir)"
-
-      - name: pip cache
-        uses: actions/cache@v2
-        with:
-          # Use the os dependent pip cache directory found above
-          path: ${{ steps.pip-cache.outputs.dir }}
-          # A match with 'key' counts as cache hit
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements*.txt') }}
-          # A match with 'restore-keys' is used as fallback
-          restore-keys: ${{ runner.os }}-pip-
+          cache: "pip"
+          cache-dependency-path: "requirements*.txt"
 
       - name: Install dependencies
         run: |

tox.ini

@@ -4,7 +4,7 @@
 # and then run "tox" from this directory.
 
 [tox]
-envlist = lint, py37, py38, py39, py310, purepy38, py38-no-gpg, py38-test-gpg-fails
+envlist = lint, py37, py38, py39, py310, py311, purepy311, py311-no-gpg, py311-test-gpg-fails
 skipsdist = True
 
 [testenv]
@@ -20,22 +20,22 @@ commands =
     coverage run tests/aggregate_tests.py
     coverage report -m --fail-under 97
 
-[testenv:purepy38]
+[testenv:purepy311]
 deps =
 
 commands =
     python -m tests.check_gpg_available
     python -m tests.check_public_interfaces
 
-[testenv:py38-no-gpg]
+[testenv:py311-no-gpg]
 setenv =
     GNUPG = nonexisting-gpg-for-testing
 commands =
     python -m tests.check_public_interfaces_gpg
 
 # This checks that importing securesystemslib.gpg.constants doesn't shell out on
 # import.
-[testenv:py38-test-gpg-fails]
+[testenv:py311-test-gpg-fails]
 setenv =
     GNUPG = false
 commands =