ci: Resolve GitHub Actions security and fix Zizmor audit findings

.bazelrc

@@ -21,5 +21,10 @@ build --proto_compiler=@com_google_protobuf//:protoc
 build --cxxopt="-Iexternal/com_google_protobuf/src"
 build --host_cxxopt="-Iexternal/com_google_protobuf/src"
 
+build:macos --apple_platform_type=macos
+build:macos --repo_env=BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
+build:macos_arm64 --cpu=darwin_arm64
+build:macos_arm64 --repo_env=BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
+
 # Disable Bzlmod to avoid conflicts with WORKSPACE
 common --noenable_bzlmod

.github/reusable-build/action.yml

@@ -12,21 +12,23 @@ runs:
   using: 'composite'
   steps:
   - name: Set up Python ${{ inputs.python-version }}
-    uses: actions/setup-python@v5
+    uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
     with:
       python-version: ${{ inputs.python-version }}
 
-  - name: Build the package for Python ${{ inputs.python-version }}
+  - name: Build the package for Python
     shell: bash
+    env:
+      PYTHON_VERSION: ${{ inputs.python-version }}
     run: |
-      version="${{ matrix.python-version }}"
+      version="$PYTHON_VERSION"
       docker compose run -e PYTHON_VERSION=$(echo "$version" | sed 's/\.//') manylinux2010
 
-  - name: Upload wheel artifact for Python ${{ matrix.python-version }}
+  - name: Upload wheel artifact
     if: ${{ inputs.upload-artifact == 'true' }}
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
     with:
-      name: data-validation-wheel-py${{ matrix.python-version }}
+      name: data-validation-wheel-py${{ inputs.python-version }}
       path: dist/*.whl
 
   - name: Check the wheel

.github/workflows/ci-lint.yml

@@ -3,19 +3,25 @@ name: pre-commit
 on:
   pull_request:
   push:
-     branches: [master]
+    branches: [master]
+
+permissions:
+  contents: read
 
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         # Ensure the full history is fetched
         # This is required to run pre-commit on a specific set of commits
         # TODO: Remove this when all the pre-commit issues are fixed
         fetch-depth: 0
-    - uses: actions/setup-python@v5.1.1
+        persist-credentials: false
+    - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
-        python-version: 3.13
-    - uses: pre-commit/action@v3.0.1
+        python-version: "3.13"
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.github/workflows/conda-build.yml

@@ -11,9 +11,14 @@ on:
     types: [published]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -22,10 +27,12 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Setup Micromamba
-      uses: mamba-org/setup-micromamba@v1
+      uses: mamba-org/setup-micromamba@4b9113af4fba0e9e1124b252dd6497a419e7396d # v1.11.0
       with:
         environment-name: tfdv-build
         cache-environment: true
@@ -51,23 +58,16 @@ jobs:
         sudo mv /tmp/bazelisk /usr/local/bin/bazel
         bazel --version
 
-    # Needed for Xcode 26.x in some CI environments; without this patch,
-    # Bazel Apple toolchain may fail with an "LC_UUID missing" linker error.
-    # Currently CI is passing, so keep this disabled. Uncomment if CI starts
-    # failing with an "LC_UUID missing" error.
-    # - name: Patch Apple CC toolchain (macOS only)
-    #   if: runner.os == 'macOS'
-    #   shell: bash -l {0}
-    #   run: bazel build //:patch_local_config_apple_cc
-
     - name: Install build tooling
       shell: bash -l {0}
       run: |
-        python -m pip install numpy>=1.22.0
+        python -m pip install "numpy>=1.22.0"
         python -m pip install --upgrade pip build wheel "setuptools<69.3"
 
     - name: Build and install package
       shell: bash -l {0}
+      env:
+        BAZEL_USE_CPP_ONLY_TOOLCHAIN: "1"
       run: |
         python -m build --wheel --no-isolation
         if [ "$(uname)" == "Linux" ]; then
@@ -101,7 +101,7 @@ jobs:
         mv tensorflow_data_validation_bak tensorflow_data_validation
 
     - name: Upload wheel artifact
-      uses: actions/upload-artifact@v4.4.0
+      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
       with:
         name: data-validation-wheel-${{ matrix.os }}-py${{ matrix.python-version }}
         path: dist/*.whl
@@ -115,10 +115,11 @@ jobs:
       name: pypi
       url: https://pypi.org/p/tensorflow-data-validation/
     permissions:
+      contents: read
       id-token: write
     steps:
       - name: Retrieve wheels
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           merge-multiple: true
           path: wheels
@@ -128,10 +129,10 @@ jobs:
           ls -lAs wheels/
 
       - name: Upload to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1.9
+        # zizmor: ignore[use-trusted-publishing]
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
         with:
-          user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}
-          packages_dir: wheels/
+          packages-dir: wheels/
           verify-metadata: true
           verbose: true

.github/workflows/docs.yml

@@ -1,52 +1,40 @@
-name: Deploy docs
+name: docs
+
 on:
-  workflow_dispatch:
   push:
     branches:
-      - 'master'
+      - master
   pull_request:
+    branches:
+      - master
+  workflow_dispatch:
+
 permissions:
-  contents: write
+  contents: read
+
 jobs:
-  deploy:
+  build:
+    name: Build docs
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Configure Git Credentials
-        run: |
-          git config user.name github-actions[bot]
-          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-        if: (github.event_name != 'pull_request')
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
-      - name: Set up Python 3.9
-        uses: actions/setup-python@v5
+      - name: Set up Python 3.12
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
-          python-version: '3.9'
+          python-version: '3.12'
           cache: 'pip'
           cache-dependency-path: |
             setup.py
             requirements-docs.txt
 
-      - name: Save time for cache for mkdocs
-        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-
-      - name: Caching
-        uses: actions/cache@v4
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: .cache
-          restore-keys: |
-            mkdocs-material-
-
       - name: Install Dependencies
         run: pip install -r requirements-docs.txt
 
-      - name: Deploy to GitHub Pages
-        run: mkdocs gh-deploy --force
-        if: (github.event_name != 'pull_request')
-
       - name: Build docs to check for errors
         run: mkdocs build
-        if: (github.event_name == 'pull_request')

mkdocs.yml

@@ -43,6 +43,8 @@ plugins:
   - autorefs
   - mkdocstrings:
       default_handler: python
+      inventories:
+        - https://docs.python.org/3/objects.inv
       handlers:
         python:
           options:
@@ -73,8 +75,6 @@ plugins:
               - "!_test$"
             extensions:
               - griffe_inherited_docstrings
-          import:
-            - https://docs.python.org/3/objects.inv
 
 extra_css:
   - stylesheets/extra.css

setup.py

@@ -79,7 +79,20 @@ def finalize_options(self):
             )
         self._additional_build_options = []
         if platform.system() == "Darwin":
-            self._additional_build_options = ["--macos_minimum_os=10.14"]
+            if platform.machine() == "arm64":
+                self._additional_build_options = [
+                    "--macos_minimum_os=11.0",
+                    "--config=macos_arm64",
+                    "--repo_env=BAZEL_USE_CPP_ONLY_TOOLCHAIN=1",
+                ]
+            else:
+                self._additional_build_options = [
+                    "--macos_minimum_os=10.14",
+                    "--repo_env=BAZEL_USE_CPP_ONLY_TOOLCHAIN=1",
+                ]
+            os.environ.pop("APPLE_SDK_VERSION_OVERRIDE", None)
+            os.environ.pop("XCODE_VERSION_OVERRIDE", None)
+            os.environ["BAZEL_USE_CPP_ONLY_TOOLCHAIN"] = "1"
 
     def run(self):
         bazelversion_path = os.path.join(