From b21817e981094ec430ffae1ec5659469aacceaf5 Mon Sep 17 00:00:00 2001
From: Rafael Fontenelle <rffontenelle@gmail.com>
Date: Tue, 21 Jul 2026 16:11:15 -0300
Subject: [PATCH 1/2] Apply fixes for zizmor findings

---
 .github/dependabot.yml           |  4 +++
 .github/workflows/check.yml      | 43 ++++++++++++++-------------
 .github/workflows/python-310.yml | 11 +++++--
 .github/workflows/python-311.yml | 14 +++++++--
 .github/workflows/python-312.yml | 11 +++++--
 .github/workflows/python-313.yml | 11 +++++--
 .github/workflows/python-314.yml | 11 +++++--
 .github/workflows/python-315.yml | 12 ++++++--
 .github/workflows/python-37.yml  | 11 +++++--
 .github/workflows/python-38.yml  | 11 +++++--
 .github/workflows/python-39.yml  | 11 +++++--
 .github/workflows/sync.yml       | 50 +++++++++++++++++++-------------
 12 files changed, 142 insertions(+), 58 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e676ff624..a29702213 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     assignees:
       - "rffontenelle"
     commit-message:
@@ -17,6 +19,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     assignees:
       - "rffontenelle"
     commit-message:
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index dcd3d998b..06ae6521d 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -24,10 +24,10 @@ on:
         required: true
         type: string
     secrets:
-      TELEGRAM_TOKEN:
+      telegram_token:
         description: "Token required for interacting with Telegram API"
         required: false
-      TELEGRAM_TO:
+      telegram_to:
         description: "Account ID that will receive the telegram notification"
         required: false
 
@@ -52,12 +52,13 @@ jobs:
       matrix:
         format: [ html, latex, epub ]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: Set up Python 3
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ inputs.version }}
           cache: pip
@@ -75,7 +76,7 @@ jobs:
         run: sudo apt update -y && sudo apt install librsvg2-bin -y
 
       - name: Add problem matcher
-        uses: sphinx-doc/github-problem-matcher@v1.1
+        uses: sphinx-doc/github-problem-matcher@1f74d6599f4a5e89a20d3c99aab4e6a70f7bda0f # v1.1
 
       - name: Build docs
         id: build
@@ -93,24 +94,24 @@ jobs:
 
       - name: Notify via Telegram
         if: always() && steps.prepare.outcome == 'success' && github.event_name == 'schedule' && inputs.tx_project == 'python-newest'
-        uses: appleboy/telegram-action@v1.0.1
+        uses: appleboy/telegram-action@221e6b684967abe813051ee4a37dd61770a83ad3 # v1.0.1
         with:
-          to: ${{ secrets.TELEGRAM_TO }}
-          token: ${{ secrets.TELEGRAM_TOKEN }}
+          to: ${{ secrets.telegram_to }}
+          token: ${{ secrets.telegram_token }}
           format: markdown
           disable_web_page_preview: true
           message_file: logs/notify.txt
 
       - name: Upload artifact - log files
         if: always() && steps.build.outcome == 'failure'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: logs-${{ inputs.version }}-${{ matrix.format }}
           path: logs/*
           
       - name: Upload artifact - docs
         if: always() && steps.build.outcome == 'success'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: python-docs-pt-br-${{ inputs.version }}-${{ matrix.format }}
           path: cpython/Doc/build/${{ matrix.format }}
@@ -121,13 +122,13 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ 'build' ]
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: python-docs-pt-br-${{ inputs.version }}-latex
       - run: sudo apt-get update
       - run: sudo apt-get install -y latexmk texlive-xetex fonts-freefont-otf xindy texlive-lang-portuguese
       - run: make
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         if: always()
         with:
           name: python-docs-pt-br-${{ inputs.version }}-pdf
@@ -139,12 +140,13 @@ jobs:
     name: Lint translations
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: Set up Python 3
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ inputs.version }}
           cache: pip
@@ -158,7 +160,7 @@ jobs:
         run: ./scripts/setup.sh
 
       - name: Add problem matcher
-        uses: rffontenelle/sphinx-lint-problem-matcher@v1.0.0
+        uses: rffontenelle/sphinx-lint-problem-matcher@4270bf50b2c93640a7cbb231c09f8e694699af9f #v1.0.0
 
       - name: lint translations files
         id: lint
@@ -176,17 +178,17 @@ jobs:
 
       - name: Notify via Telegram
         if: always() && steps.prepare.outcome == 'success' && github.event_name == 'schedule' && inputs.tx_project == 'python-newest'
-        uses: appleboy/telegram-action@v1.0.1
+        uses: appleboy/telegram-action@221e6b684967abe813051ee4a37dd61770a83ad3 # v1.0.1
         with:
-          to: ${{ secrets.TELEGRAM_TO }}
-          token: ${{ secrets.TELEGRAM_TOKEN }}
+          to: ${{ secrets.telegram_to }}
+          token: ${{ secrets.telegram_token }}
           format: markdown
           disable_web_page_preview: true
           message_file: logs/notify.txt
 
       - name: Upload artifact - log files
         if: always() && steps.lint.outcome == 'failure'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: ${{ inputs.version }}-lint-logs
           path: logs/*
@@ -199,9 +201,10 @@ jobs:
     name: Check for zero-width space characters
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.version }}
+          persist-credentials: false
 
       - name: Make sure the repository is up to date
         if: github.event_name != 'pull_request'
diff --git a/.github/workflows/python-310.yml b/.github/workflows/python-310.yml
index 2cb3a2d71..76d0d9bc5 100644
--- a/.github/workflows/python-310.yml
+++ b/.github/workflows/python-310.yml
@@ -8,14 +8,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: '3.10'
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: '3.10'
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}
diff --git a/.github/workflows/python-311.yml b/.github/workflows/python-311.yml
index a62785b3d..7a69e561c 100644
--- a/.github/workflows/python-311.yml
+++ b/.github/workflows/python-311.yml
@@ -5,17 +5,27 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions:
+  contents: write
+
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: '3.11'
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: '3.11'
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}
diff --git a/.github/workflows/python-312.yml b/.github/workflows/python-312.yml
index 2b2b26072..5544f9990 100644
--- a/.github/workflows/python-312.yml
+++ b/.github/workflows/python-312.yml
@@ -8,14 +8,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: '3.12'
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: '3.12'
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}
diff --git a/.github/workflows/python-313.yml b/.github/workflows/python-313.yml
index 85340a6bd..54a0b0b14 100644
--- a/.github/workflows/python-313.yml
+++ b/.github/workflows/python-313.yml
@@ -16,14 +16,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: 3.13
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: 3.13
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}
diff --git a/.github/workflows/python-314.yml b/.github/workflows/python-314.yml
index d800e9529..1a47f7edd 100644
--- a/.github/workflows/python-314.yml
+++ b/.github/workflows/python-314.yml
@@ -16,14 +16,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: python-314
       version: 3.14
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: python-314
       version: 3.14
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}
diff --git a/.github/workflows/python-315.yml b/.github/workflows/python-315.yml
index c1413a42a..5a397a991 100644
--- a/.github/workflows/python-315.yml
+++ b/.github/workflows/python-315.yml
@@ -13,17 +13,25 @@ on:
       - main
       - '3.15'
 
+
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: python-newest
       version: 3.15
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: python-newest
       version: 3.15
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}
diff --git a/.github/workflows/python-37.yml b/.github/workflows/python-37.yml
index 2b1cadd25..dff254979 100644
--- a/.github/workflows/python-37.yml
+++ b/.github/workflows/python-37.yml
@@ -6,14 +6,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: 3.7
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: 3.7
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}
diff --git a/.github/workflows/python-38.yml b/.github/workflows/python-38.yml
index 50cc843c1..1328cbf51 100644
--- a/.github/workflows/python-38.yml
+++ b/.github/workflows/python-38.yml
@@ -6,14 +6,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: 3.8
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: 3.8
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}
diff --git a/.github/workflows/python-39.yml b/.github/workflows/python-39.yml
index a49ac9dbf..4fb361dbc 100644
--- a/.github/workflows/python-39.yml
+++ b/.github/workflows/python-39.yml
@@ -6,14 +6,21 @@ on:
 jobs:
   sync:
     uses: ./.github/workflows/sync.yml
+    permissions:
+      contents: write
     with:
       tx_project: ${{ github.workflow }}
       version: 3.9
-    secrets: inherit
+    secrets:
+      tx_token: ${{ secrets.TX_TOKEN }}
   check:
     uses: ./.github/workflows/check.yml
+    permissions:
+      contents: read
     needs: sync
     with:
       tx_project: ${{ github.workflow }}
       version: 3.9
-    secrets: inherit
+    secrets:
+      telegram_token: ${{ secrets.TELEGRAM_TOKEN }}
+      telegram_to: ${{ secrets.TELEGRAM_TO }}
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index e49c7a203..456b9eafa 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -12,7 +12,7 @@ on:
         required: true
         type: string
     secrets:
-      TX_TOKEN:
+      tx_token:
         description: "Token required for interacting with Transifex API"
         required: false
 
@@ -33,15 +33,18 @@ jobs:
       # 1- Set up environment
 
       - name: Check out this repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout this repository ${{ env.PYDOC_VERSION }}
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.PYDOC_VERSION }}
           path: ${{ env.PYDOC_LANG_DIR }}
+          persist-credentials: false
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ inputs.version }}
           allow-prereleases: true
@@ -52,7 +55,7 @@ jobs:
       - name: Install Transifex CLI tool
         run: |
           cd /usr/local/bin
-          curl -o- https://raw.githubusercontent.com/transifex/cli/master/install.sh | bash -s -- v$TX_CLI_VERSION
+          curl -o- https://raw.githubusercontent.com/transifex/cli/master/install.sh | bash -s -- v${TX_CLI_VERSION}
 
       - name: Install Python packages
         run: |
@@ -66,39 +69,39 @@ jobs:
 
       - name: Generate updated .tx/config
         if: ${{ contains(fromJSON('["schedule", "workflow_dispatch"]'), github.event_name) }}
-        run: python scripts/generate_txconfig.py -p ./${{ env.PYDOC_LANG_DIR }} ${{ env.PYDOC_TX_PROJECT }}
+        run: python scripts/generate_txconfig.py -p ./${PYDOC_LANG_DIR} ${PYDOC_TX_PROJECT}
         env:
-          TX_TOKEN: ${{ secrets.TX_TOKEN }}
+          TX_TOKEN: ${{ secrets.tx_token }}
 
       - name: Pull translations from Transifex
         id: pull
         if: ${{ contains(fromJSON('["schedule", "workflow_dispatch"]'), github.event_name) }}
         run: |
           # Clean up obsolete files
-          find ./${{ env.PYDOC_LANG_DIR }} -name '*.po' -exec rm {} \;
+          find ./${PYDOC_LANG_DIR} -name '*.po' -exec rm {} \;
           ./scripts/pull_translations.sh
         env:
-          TX_TOKEN: ${{ secrets.TX_TOKEN }}
+          TX_TOKEN: ${{ secrets.tx_token }}
 
       - name: Merge translations from newer branch
         if: inputs.tx_project != 'python-newest' # python-newest doesn't have a newer branch
         run: |
           newer_branch=${PYDOC_VERSION%%.*}.$((${PYDOC_VERSION##*.}+1))
           git clone --depth 1 --single-branch --branch $newer_branch https://github.com/python/python-docs-pt-br ${newer_branch}-dir
-          pomerge --from ./${newer_branch}-dir/{**/,}*.po --to ./${{ env.PYDOC_LANG_DIR }}/{**/,}*.po
+          pomerge --from ./${newer_branch}-dir/{**/,}*.po --to ./${PYDOC_LANG_DIR}/{**/,}*.po
           rm -rf ./${newer_branch}-dir
 
       - name: powrap
         if: steps.pull.outcome == 'success'
         run: |
-          cd ./${{ env.PYDOC_LANG_DIR }}
+          cd ./${PYDOC_LANG_DIR}
           powrap *.po **/*.po
 
       - name: Update statistics
         if: always()
         run: |
           ./scripts/stats.py
-          git -C ./${{ env.PYDOC_LANG_DIR }} diff stats.json
+          git -C ./${PYDOC_LANG_DIR} diff stats.json
         env:
           PYDOC_LANG_DIR: ${{ env.PYDOC_LANG_DIR }}
 
@@ -106,12 +109,12 @@ jobs:
         if: always()
         run: |
           ./scripts/potodo.sh
-          git -C ./${{ env.PYDOC_LANG_DIR }} diff potodo.md
+          git -C ./${PYDOC_LANG_DIR} diff potodo.md
         env:
           PYDOC_LANG_DIR: ${{ env.PYDOC_LANG_DIR }}
 
       - name: Upload translation artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: python-${{ env.PYDOC_VERSION }}
           path: |
@@ -131,15 +134,18 @@ jobs:
       # 1- Set up environment
 
       - name: Check out this repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout this repository ${{ env.PYDOC_VERSION }}
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.PYDOC_VERSION }}
           path: ${{ env.PYDOC_LANG_DIR }}
+          persist-credentials: false
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ inputs.version }}
           allow-prereleases: true
@@ -153,10 +159,10 @@ jobs:
       # 2- Remove PO files and the download files (excluding obsolete)
 
       - name: Clean PO files
-        run: find ${{ env.PYDOC_LANG_DIR }} -name '*.po' | xargs -r rm
+        run: find ${PYDOC_LANG_DIR} -name '*.po' | xargs -r rm
 
       - name: Download translation artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: python-${{ env.PYDOC_VERSION }}
 
@@ -169,6 +175,10 @@ jobs:
 
       - name: Push
         if: ${{ contains(fromJSON('["schedule", "workflow_dispatch"]'), github.event_name) }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          cd ./${{ env.PYDOC_LANG_DIR }}
+          cd ./${PYDOC_LANG_DIR}
+          git remote set-url origin \
+            "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           git push

From b497cbc1fa4aca285bde8828354b00122d5c710b Mon Sep 17 00:00:00 2001
From: Rafael Fontenelle <rffontenelle@gmail.com>
Date: Tue, 21 Jul 2026 16:22:40 -0300
Subject: [PATCH 2/2] Add security analysis with zizmor

---
 .github/workflows/security-analysis.yml | 28 +++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 .github/workflows/security-analysis.yml

diff --git a/.github/workflows/security-analysis.yml b/.github/workflows/security-analysis.yml
new file mode 100644
index 000000000..f59ebe79a
--- /dev/null
+++ b/.github/workflows/security-analysis.yml
@@ -0,0 +1,28 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read # only needed for private or internal repos
+      actions: read # only needed for private or internal repos
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        with:
+          inputs: |
+            .github/