Skip to content

chore(deps): Update GitHub Actions #51

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
williaby wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): Update GitHub Actions #51

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 15 additions & 15 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,15 +43,15 @@
steps.filter.outputs.shared == 'true' }}
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Detect path changes
uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
id: filter
with:
filters: |
Expand Down Expand Up @@ -79,15 +79,15 @@
python-version: ['3.10', '3.11', '3.12', '3.13']
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

Expand All @@ -95,11 +95,11 @@
run: uv python install ${{ matrix.python-version }}

- name: Install workspace dependencies
run: uv sync --all-extras

Check warning on line 98 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxB&open=AZ-AlOLuO_cy1Xx4GIxB&pullRequest=51

Check warning on line 98 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxA&open=AZ-AlOLuO_cy1Xx4GIxA&pullRequest=51

- name: Run tests with coverage
run: |
uv run pytest packages/cloudflare-auth/tests \

Check warning on line 102 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxC&open=AZ-AlOLuO_cy1Xx4GIxC&pullRequest=51
--cov=packages/cloudflare-auth/src/cloudflare_auth \
--cov-report=xml:coverage-cloudflare-auth.xml \
--cov-report=term-missing \
Expand All @@ -108,10 +108,10 @@
-v

- name: Run type checker
run: uv run basedpyright packages/cloudflare-auth/src/

Check warning on line 111 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxE&open=AZ-AlOLuO_cy1Xx4GIxE&pullRequest=51

Check warning on line 111 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxD&open=AZ-AlOLuO_cy1Xx4GIxD&pullRequest=51

- name: Run linter
run: uv run ruff check packages/cloudflare-auth/

Check warning on line 114 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxF&open=AZ-AlOLuO_cy1Xx4GIxF&pullRequest=51

Check warning on line 114 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxG&open=AZ-AlOLuO_cy1Xx4GIxG&pullRequest=51

- name: Upload coverage artifact
if: matrix.python-version == '3.12'
Expand All @@ -134,15 +134,15 @@
python-version: ['3.10', '3.11', '3.12', '3.13']
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

Expand All @@ -150,11 +150,11 @@
run: uv python install ${{ matrix.python-version }}

- name: Install workspace dependencies
run: uv sync --all-extras

Check warning on line 153 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxH&open=AZ-AlOLuO_cy1Xx4GIxH&pullRequest=51

Check warning on line 153 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxI&open=AZ-AlOLuO_cy1Xx4GIxI&pullRequest=51

- name: Run tests with coverage
run: |
uv run pytest packages/gcs-utilities/tests \

Check warning on line 157 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxJ&open=AZ-AlOLuO_cy1Xx4GIxJ&pullRequest=51
--cov=packages/gcs-utilities/src/gcs_utilities \
--cov-report=xml:coverage-gcs-utilities.xml \
--cov-report=term-missing \
Expand All @@ -163,10 +163,10 @@
-v

- name: Run type checker
run: uv run basedpyright packages/gcs-utilities/src/

Check warning on line 166 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxL&open=AZ-AlOLuO_cy1Xx4GIxL&pullRequest=51

Check warning on line 166 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxK&open=AZ-AlOLuO_cy1Xx4GIxK&pullRequest=51

- name: Run linter
run: uv run ruff check packages/gcs-utilities/

Check warning on line 169 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxN&open=AZ-AlOLuO_cy1Xx4GIxN&pullRequest=51

Check warning on line 169 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxM&open=AZ-AlOLuO_cy1Xx4GIxM&pullRequest=51

- name: Upload coverage artifact
if: matrix.python-version == '3.12'
Expand All @@ -185,15 +185,15 @@
contents: read
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

Expand All @@ -201,11 +201,11 @@
run: uv python install 3.12

- name: Install dependencies
run: uv sync --all-extras

Check warning on line 204 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxP&open=AZ-AlOLuO_cy1Xx4GIxP&pullRequest=51

Check warning on line 204 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxO&open=AZ-AlOLuO_cy1Xx4GIxO&pullRequest=51

- name: Run Bandit security scan
run: |
uv run bandit -r packages/cloudflare-auth/src/ packages/gcs-utilities/src/ -c pyproject.toml || true

Check warning on line 208 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxR&open=AZ-AlOLuO_cy1Xx4GIxR&pullRequest=51

Check warning on line 208 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOLuO_cy1Xx4GIxQ&open=AZ-AlOLuO_cy1Xx4GIxQ&pullRequest=51

# Upload combined coverage to Codecov
coverage:
Expand All @@ -217,12 +217,12 @@
contents: read
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Download coverage artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
Expand Down Expand Up @@ -250,7 +250,7 @@
contents: read
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/codecov.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
name: Upload Coverage
# Only run on successful CI completion
if: ${{ github.event.workflow_run.conclusion == 'success' }}
uses: ByronWilliamsCPA/.github/.github/workflows/python-codecov.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-codecov.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
artifact-name: 'coverage-reports'
coverage-files: '*.xml'
Expand All @@ -41,7 +41,7 @@ jobs:
contents: read
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,36 +34,36 @@

steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
with:
python-version: "3.12"

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

- name: Install dependencies
run: uv sync --no-dev

Check warning on line 57 in .github/workflows/codeql.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOPpO_cy1Xx4GIxg&open=AZ-AlOPpO_cy1Xx4GIxg&pullRequest=51

Check warning on line 57 in .github/workflows/codeql.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOPpO_cy1Xx4GIxf&open=AZ-AlOPpO_cy1Xx4GIxf&pullRequest=51

- name: Initialize CodeQL
uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
with:
languages: python
build-mode: none
queries: security-extended,security-and-quality

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
with:
category: "/language:python"
2 changes: 1 addition & 1 deletion .github/workflows/coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
upload-coverage:
name: Upload Coverage to Qlty
if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
coverage-artifact-name: coverage-reports
coverage-file-path: coverage.xml
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,12 +23,12 @@ jobs:
pull-requests: write
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Dependency Review
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
contents: write
pages: write
id-token: write
uses: ByronWilliamsCPA/.github/.github/workflows/python-docs.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-docs.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
# Repo uses hatchling; --no-build cannot install the editable root package
no-build: false
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/fips-compatibility.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ jobs:
permissions:
contents: read
pull-requests: write
uses: ByronWilliamsCPA/.github/.github/workflows/python-fips-compatibility.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-fips-compatibility.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
# Repo uses hatchling; --no-build cannot install the editable root package
no-build: false
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/mutation-testing.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ permissions:
jobs:
mutation:
name: Mutation Testing
uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow snippet =="
if [ -f .github/workflows/mutation-testing.yml ]; then
  nl -ba .github/workflows/mutation-testing.yml | sed -n '1,120p'
else
  echo "missing .github/workflows/mutation-testing.yml"
fi

echo
echo "== referenced reusable workflow references in repo =="
rg -n "python-mutation|mutation-testing|secrets:\s*inherit|secrets:" .github/workflows 2>/dev/null || true

echo
echo "== external repo commit/branch info =="
OWNER="ByronWilliamsCPA"
REPO=".github"
SHA="7d12f5486ab5c856397ebaa4acd3c99ca385227c"
BRANCH="main"
if command -v gh >/dev/null 2>&1; then
  echo "-- ref head --"
  gh api "repos/${OWNER}/${REPO}/git/ref/${BRANCH//\//%2F}" --jq '.object.sha'
  echo "-- tag/object info (if exists) --"
  gh api "repos/${OWNER}/${REPO}/git/refs/tags/$SHA" --bare 2>/dev/null || true
  echo "-- sha existence --"
  gh api "repos/${OWNER}/${REPO}/commits/$SHA" --jq '{sha:.sha, message:.commit.message}'
  echo "-- file existence/content HEAD --"
  FILE="python-mutation.yml"
  gh api "repos/${OWNER}/${REPO}/contents/${FILE}?ref=$BRANCH" --jq '{path:.path, sha:.sha}' || true
  gh api "repos/${OWNER}/${REPO}/contents/${FILE}?ref=$BRANCH" --jq '.content | `@base64d`' || true
  echo "-- file existence/content commit --"
  gh api "repos/${OWNER}/${REPO}/contents/${FILE}?ref=$SHA" --jq '{path:.path, sha:.sha}' || true
  gh api "repos/${OWNER}/${REPO}/contents/${FILE}?ref=$SHA" --jq '.content | `@base64d`' || true
else
  echo "gh unavailable"
fi

Repository: ByronWilliamsCPA/python-libs

Length of output: 229

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow snippet =="
if [ -f .github/workflows/mutation-testing.yml ]; then
  awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/mutation-testing.yml | head -n 140
else
  echo "missing .github/workflows/mutation-testing.yml"
fi

echo
echo "== referenced reusable workflow references in repo =="
grep -RInE "python-mutation|mutation-testing|secrets:\s*inherit|secrets:" .github/workflows 2>/dev/null || true

echo
echo "== external repo file existence/content =="
OWNER="ByronWilliamsCPA"
REPO=".github"
SHA="7d12f5486ab5c856397ebaa4acd3c99ca385227c"
BRANCH="main"
FILE="python-mutation.yml"
python3 - <<'PY' "$OWNER" "$REPO" "$SHA" "$BRANCH" "$FILE"
import json, sys, urllib.request
owner, repo, sha, branch, file = sys.argv[1:6]
base = f"https://api.github.com/repos/{owner}/{repo}"
for ref in [branch, sha]:
    url = f"{base}/contents/{file}?ref={ref}"
    headers = {"User-Agent": "coderabbit-verification", "Accept": "application/vnd.github+json"}
    req = urllib.request.Request(url, headers=headers)
    try:
        with urllib.request.urlopen(req, timeout=20) as r:
            data = json.load(r)
        print(f"--- ref {ref} exists: {data.get('path')}, sha: {data.get('sha')}")
        import base64
        try:
            decoded = base64.b64decode(data.get("content", "")).decode("utf-8")
            for i,line in enumerate(decoded.splitlines(), 1):
                print(f"{i:04d}\t{line}")
        except Exception as e:
            print("decode error:", e)
    except urllib.error.HTTPError as e:
        print(f"--- ref {ref} absent/error: {e.code} {e.reason}")
PY

echo
echo "== pyyaml secrets extraction =="
python3 - <<'PY'
try:
    import urllib3
    import yaml
    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
    client = urllib3.PoolManager()
    url = "https://raw.githubusercontent.com/ByronWilliamsCPA/.github/7d12f5486ab5c856397ebaa4acd3c99ca385227c/python-mutation.yml"
    data = client.request("GET", url).data.decode("utf-8")
    parsed = yaml.safe_load(data)
    print("top-level:", list(parsed.get("joins", [])))
    for join in parsed.get("joins", []):
        print("join:", join.get("id"), "uses:", join.get("uses"), "requires:", join.get("requires"), "secrets:", join.get("secrets"))
except Exception as e:
    print("yaml inspection error:", repr(e))
PY

Repository: ByronWilliamsCPA/python-libs

Length of output: 5361

🌐 Web query:

GitHub Actions reusable workflows secrets inherit inherited secrets passed to child workflow

💡 Result:

In GitHub Actions, the secrets: inherit keyword is a convenient way to pass all secrets available to the calling workflow to a reusable workflow [1][2]. When you use secrets: inherit in a job that calls a reusable workflow, all repository, organization, and environment secrets accessible to the calling workflow are automatically made available to the reusable workflow [1][3]. Key behaviors and requirements regarding secrets: inherit include: Scope: The inherited secrets are available to the directly called reusable workflow [1][4]. If your workflow execution involves a chain of calls (e.g., Workflow A calls Workflow B, which calls Workflow C), secrets are only passed to the directly called workflow [1][3]. For Workflow C to receive secrets, they must be explicitly passed or inherited from Workflow B [3]. Definition: When using secrets: inherit, you are not required to explicitly define the secrets in the on section of the reusable workflow to use them [1][4]. However, defining them remains a best practice for clarity and documentation [1]. Security and Usage: Because secrets: inherit shares all accessible secrets, it is generally recommended for use with trusted workflows within the same organization or enterprise [1][4]. For third-party or untrusted reusable workflows, it is safer to pass only the specific secrets required by the workflow individually [5]. Example configuration in the caller workflow: jobs: call-reusable-workflow: uses: octo-org/example-repo/.github/workflows/reusable-workflow.yml@main secrets: inherit

Citations:

🌐 Web query:

ByronWilliamsCPA .github python-mutation.yml line 1-200

💡 Result:

The file python-mutation.yml mentioned in the ByronWilliamsCPA GitHub organization is a reusable GitHub Actions workflow used for mutation testing [1]. It is designed to validate the effectiveness of a project's test suite by introducing code mutations (using mutmut) and checking if the tests detect them [1][2]. Projects within the ByronWilliamsCPA organization (such as fragrance-rater) typically invoke this workflow as an org-level reusable workflow [2][3]. The workflow is generally called with parameters like python-version, source-directory, test-directory, and mutation-threshold [2]. Because this file exists within the.github repository as a template for other projects to call, it does not typically contain project-specific logic in its first 200 lines, but rather defines the reusable CI structure [1][2]. To view the specific contents of the file, you can access the ByronWilliamsCPA/.github repository directly at https://github.com/ByronWilliamsCPA/.github [1].

Citations:

🌐 Web query:

ByronWilliamsCPA .github python-mutation.yml secrets inherit mutated_code_mutations github_token

💡 Result:

The reference to python-mutation.yml within the ByronWilliamsCPA/.github organization repository refers to a centralized, reusable GitHub Actions workflow designed for mutation testing, typically using the mutmut library [1][2][3]. In various caller workflows (such as those found in ByronWilliamsCPA/fragrance-rater), this reusable workflow is invoked as follows [2][3][4]: uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@<version_sha> secrets: inherit The inclusion of secrets: inherit allows the caller workflow to pass all of its available secrets to the reusable python-mutation.yml workflow [5]. Security Context: While secrets: inherit is a convenient way to pass credentials, it is widely considered a security anti-pattern in GitHub Actions [6][7][8]. By using inherit, the reusable workflow—which may be maintained by another team or reside in a different repository—gains access to every secret defined in the caller's repository [5]. This violates the principle of least privilege, as it widens the "blast radius" should the reusable workflow be compromised [7][5]. Modern security tools (such as Semgrep, OpenRewrite, and specialized ESLint plugins) often flag this practice as a high-severity risk and recommend explicitly passing only the specific secrets required by the called workflow [6][7][5][8].

Citations:

Avoid passing all repository secrets into the reusable workflow.

secrets: inherit exposes every repository/organization secret available to this workflow to python-mutation.yml. Set secrets: inherit only if this reusable workflow actually consumes a secret; otherwise pass only the required secrets explicitly or remove the inheritance.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 42-42: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow

(secrets-inherit)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/mutation-testing.yml at line 42, Update the reusable
workflow invocation in the mutation-testing workflow to remove secrets: inherit
unless python-mutation.yml requires a secret; if it does, pass only the specific
required secret explicitly.

Sources: Path instructions, Linters/SAST tools

with:
# Repo uses hatchling; --no-build cannot install the editable root package
no-build: false
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/pr-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
# Supplemental PR Checks (Changelog, Link Validation)
# ==========================================================================
supplemental-checks:
uses: ByronWilliamsCPA/.github/.github/workflows/python-supplemental-checks.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-supplemental-checks.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Pass only the secrets required by the reusable workflow.

secrets: inherit at Line 49 exposes every caller secret to this reusable workflow. Remove it if no secret is needed, or map only the specific required secret names.

As per path instructions, workflows must use proper secret handling and minimal permissions.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 32-32: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow

(secrets-inherit)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-validation.yml at line 32, Update the reusable workflow
invocation using the python-supplemental-checks workflow reference to remove
secrets: inherit when no secrets are required, or replace it with an explicit
secrets mapping containing only the names consumed by that workflow; preserve
the existing workflow call and use minimal secret exposure.

Sources: Path instructions, Linters/SAST tools

with:
# Changelog enforcement
enable-changelog-check: true
Expand All @@ -56,15 +56,15 @@
runs-on: ubuntu-latest
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Install UV
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

Expand All @@ -72,12 +72,12 @@
run: uv python install 3.12

- name: Install dependencies
run: uv sync --all-extras

Check warning on line 75 in .github/workflows/pr-validation.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlONoO_cy1Xx4GIxS&open=AZ-AlONoO_cy1Xx4GIxS&pullRequest=51

Check warning on line 75 in .github/workflows/pr-validation.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlONoO_cy1Xx4GIxT&open=AZ-AlONoO_cy1Xx4GIxT&pullRequest=51

- name: Run vulture
run: |
echo "## Dead Code Report" >> $GITHUB_STEP_SUMMARY
uv run vulture src/ packages/ --min-confidence 90 | tee vulture-report.txt || true

Check warning on line 80 in .github/workflows/pr-validation.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlONoO_cy1Xx4GIxU&open=AZ-AlONoO_cy1Xx4GIxU&pullRequest=51

Check warning on line 80 in .github/workflows/pr-validation.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlONoO_cy1Xx4GIxV&open=AZ-AlONoO_cy1Xx4GIxV&pullRequest=51
if [ -s vulture-report.txt ]; then
echo '```' >> $GITHUB_STEP_SUMMARY
cat vulture-report.txt >> $GITHUB_STEP_SUMMARY
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/publish-artifact-registry.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,12 +62,12 @@ jobs:
id-token: write
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
with:
fetch-depth: 0

Expand Down Expand Up @@ -197,7 +197,7 @@ jobs:
echo "📦 Registry URL: $AR_URL"

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
version: ${{ env.UV_VERSION }}
enable-cache: true
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/python-compatibility.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ permissions:

jobs:
compatibility:
uses: ByronWilliamsCPA/.github/.github/workflows/python-compatibility.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-compatibility.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
# Repo uses hatchling; --no-build cannot install the editable root package
no-build: false
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/qlty.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ concurrency:
jobs:
qlty:
if: ${{ github.event.workflow_run.conclusion == 'success' }}
uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-qlty-coverage.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
permissions:
contents: read
actions: read
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,17 +46,17 @@
contents: read
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0
Comment on lines 53 to 56

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disable checkout credential persistence in read-only jobs.

These checkout steps do not need Git authentication after checkout. Add persist-credentials: false at each site.

  • .github/workflows/release.yml#L53-L56: add persist-credentials: false to the pre-release test checkout.
  • .github/workflows/reuse.yml#L37-L38: add a with block containing persist-credentials: false.
  • .github/workflows/slsa-provenance.yml#L50-L53: add persist-credentials: false beside fetch-depth: 0.

As per path instructions, workflows must use proper secret handling and minimal permissions.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 53-56: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 3 files
  • .github/workflows/release.yml#L53-L56 (this comment)
  • .github/workflows/reuse.yml#L37-L38
  • .github/workflows/slsa-provenance.yml#L50-L53
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 53 - 56, Disable persisted
checkout credentials at all three read-only checkout sites: add
persist-credentials: false in .github/workflows/release.yml lines 53-56 and
.github/workflows/slsa-provenance.yml lines 50-53 alongside the existing
checkout options, and add a with block containing it in
.github/workflows/reuse.yml lines 37-38.

Sources: Path instructions, Linters/SAST tools


- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

Expand All @@ -64,10 +64,10 @@
run: uv python install 3.12

- name: Install dependencies
run: uv sync --all-extras

Check warning on line 67 in .github/workflows/release.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOOtO_cy1Xx4GIxX&open=AZ-AlOOtO_cy1Xx4GIxX&pullRequest=51

Check warning on line 67 in .github/workflows/release.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOOtO_cy1Xx4GIxW&open=AZ-AlOOtO_cy1Xx4GIxW&pullRequest=51

- name: Run tests
run: uv run pytest -v --cov=src --cov-report=xml --cov-fail-under=80

Check warning on line 70 in .github/workflows/release.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOOtO_cy1Xx4GIxY&open=AZ-AlOOtO_cy1Xx4GIxY&pullRequest=51

release:
name: Semantic Release
Expand All @@ -79,18 +79,18 @@
pull-requests: write
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
fetch-depth: 0
token: "${{ secrets.GITHUB_TOKEN }}"

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

Expand All @@ -98,11 +98,11 @@
run: uv python install 3.12

- name: Install dependencies
run: uv sync --all-extras

Check warning on line 101 in .github/workflows/release.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOOtO_cy1Xx4GIxZ&open=AZ-AlOOtO_cy1Xx4GIxZ&pullRequest=51

Check warning on line 101 in .github/workflows/release.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOOtO_cy1Xx4GIxa&open=AZ-AlOOtO_cy1Xx4GIxa&pullRequest=51

- name: Python Semantic Release
id: release
uses: python-semantic-release/python-semantic-release@350c48fcb3ffcdfd2e0a235206bc2ecea6b69df0 # v10.5.3
uses: python-semantic-release/python-semantic-release@39dd2052f2ce8282a5d932c31d58a2ca06d2550e # v10.6.1
with:
github_token: "${{ secrets.GITHUB_TOKEN }}"

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/reuse.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,12 @@ jobs:
contents: read
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: REUSE Compliance Check
uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
2 changes: 1 addition & 1 deletion .github/workflows/sbom.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ jobs:
permissions:
contents: read
security-events: write
uses: ByronWilliamsCPA/.github/.github/workflows/python-sbom.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main
uses: ByronWilliamsCPA/.github/.github/workflows/python-sbom.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main
with:
python-version: '3.12'
fail-on-vulnerabilities: true
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/security-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,15 +35,15 @@
contents: read
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
enable-cache: true

Expand All @@ -51,10 +51,10 @@
run: uv python install 3.12

- name: Install dependencies
run: uv sync --all-extras

Check warning on line 54 in .github/workflows/security-analysis.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOPKO_cy1Xx4GIxc&open=AZ-AlOPKO_cy1Xx4GIxc&pullRequest=51

Check warning on line 54 in .github/workflows/security-analysis.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOPKO_cy1Xx4GIxb&open=AZ-AlOPKO_cy1Xx4GIxb&pullRequest=51

- name: Run Bandit security scan
run: uv run bandit -r src/ -c pyproject.toml -f json -o bandit-report.json || true

Check warning on line 57 in .github/workflows/security-analysis.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOPKO_cy1Xx4GIxe&open=AZ-AlOPKO_cy1Xx4GIxe&pullRequest=51

Check warning on line 57 in .github/workflows/security-analysis.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-AlOPKO_cy1Xx4GIxd&open=AZ-AlOPKO_cy1Xx4GIxd&pullRequest=51

- name: Run OSV-Scanner dependency scan
uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
Expand Down Expand Up @@ -86,7 +86,7 @@
contents: read
steps:
- name: Harden the runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: audit

Expand Down
Loading
Loading