cleanup+sec

Author: mamico

.github/workflows/bandit.yml

@@ -1,4 +1,7 @@
 name: Security check - Bandit
+permissions:
+  contents: read
+  pull-requests: write
 
 on: push
 
@@ -10,7 +13,7 @@ jobs:
     - uses: actions/checkout@v4
 
     - name: Security check - Bandit
-      uses: ioggstream/[email protected]
+      uses: ioggstream/bandit-report-artifacts#b306975a803883a5ae3a0a0eb9a173970dd8a4ac  # @v1.7.4
       with:
         project_path: src
         # ignore_failure: true

.github/workflows/black.yml

@@ -1,4 +1,7 @@
 name: Black
+permissions:
+  contents: read
+  pull-requests: write
 on: [push]
 jobs:
   build:

.github/workflows/flake8.yml

@@ -1,4 +1,7 @@
 name: Flake8
+permissions:
+  contents: read
+  pull-requests: write
 on: [push]
 jobs:
   build:

.github/workflows/isort.yml

@@ -1,4 +1,7 @@
 name: Isort
+permissions:
+  contents: read
+  pull-requests: write
 on: [push]
 
 jobs:

.github/workflows/pyroma.yml

@@ -1,4 +1,7 @@
 name: Pyroma
+permissions:
+  contents: read
+  pull-requests: write
 on: [push]
 jobs:
   build:

.github/workflows/tests.yml

@@ -1,4 +1,7 @@
 name: Tests
+permissions:
+  contents: read
+  pull-requests: write
 on:
   push:
     branches: ["*"]

.github/workflows/zpretty.yml

@@ -1,4 +1,7 @@
 name: zpretty
+permissions:
+  contents: read
+  pull-requests: write
 on: [push]
 jobs:
   build:

constraints_plone60.txt

@@ -1,14 +1 @@
-# Keep these the same as in base.cfg please.
-pip==22.2.2
-setuptools==65.3.0
-zc.buildout>=3.0.0rc3
-wheel==0.37.1
-
-# Windows specific down here (has to be installed here, fails in buildout)
-# Dependency of zope.sendmail:
-pywin32 ; platform_system == 'Windows'
-# SSL Certs on Windows, because Python is missing them otherwise:
-certifi ; platform_system == 'Windows'
-# Dependency of collective.recipe.omelette:
-ntfsutils ; platform_system == 'Windows' and python_version < '3.0'
-
+-r https://dist.plone.org/release/6.0-latest/requirements.txt