Skip to content

chore(deps)!: Update GitHub Actions (major) #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
williaby wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps)!: Update GitHub Actions (major) #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Detect path changes
uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
Expand Down Expand Up @@ -84,10 +84,10 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand All @@ -95,11 +95,11 @@
run: uv python install ${{ matrix.python-version }}

- name: Install workspace dependencies
run: uv sync --all-extras

Check warning on line 98 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzPu&open=AZ-QkQ2A9U3Zh3IAfzPu&pullRequest=53

Check warning on line 98 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzPv&open=AZ-QkQ2A9U3Zh3IAfzPv&pullRequest=53

- name: Run tests with coverage
run: |
uv run pytest packages/cloudflare-auth/tests \

Check warning on line 102 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzPw&open=AZ-QkQ2A9U3Zh3IAfzPw&pullRequest=53
--cov=packages/cloudflare-auth/src/cloudflare_auth \
--cov-report=xml:coverage-cloudflare-auth.xml \
--cov-report=term-missing \
Expand All @@ -108,10 +108,10 @@
-v

- name: Run type checker
run: uv run basedpyright packages/cloudflare-auth/src/

Check warning on line 111 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzPx&open=AZ-QkQ2A9U3Zh3IAfzPx&pullRequest=53

Check warning on line 111 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzPy&open=AZ-QkQ2A9U3Zh3IAfzPy&pullRequest=53

- name: Run linter
run: uv run ruff check packages/cloudflare-auth/

Check warning on line 114 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP0&open=AZ-QkQ2A9U3Zh3IAfzP0&pullRequest=53

Check warning on line 114 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzPz&open=AZ-QkQ2A9U3Zh3IAfzPz&pullRequest=53

- name: Upload coverage artifact
if: matrix.python-version == '3.12'
Expand Down Expand Up @@ -139,10 +139,10 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand All @@ -150,11 +150,11 @@
run: uv python install ${{ matrix.python-version }}

- name: Install workspace dependencies
run: uv sync --all-extras

Check warning on line 153 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP2&open=AZ-QkQ2A9U3Zh3IAfzP2&pullRequest=53

Check warning on line 153 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP1&open=AZ-QkQ2A9U3Zh3IAfzP1&pullRequest=53

- name: Run tests with coverage
run: |
uv run pytest packages/gcs-utilities/tests \

Check warning on line 157 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP3&open=AZ-QkQ2A9U3Zh3IAfzP3&pullRequest=53
--cov=packages/gcs-utilities/src/gcs_utilities \
--cov-report=xml:coverage-gcs-utilities.xml \
--cov-report=term-missing \
Expand All @@ -163,10 +163,10 @@
-v

- name: Run type checker
run: uv run basedpyright packages/gcs-utilities/src/

Check warning on line 166 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP5&open=AZ-QkQ2A9U3Zh3IAfzP5&pullRequest=53

Check warning on line 166 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP4&open=AZ-QkQ2A9U3Zh3IAfzP4&pullRequest=53

- name: Run linter
run: uv run ruff check packages/gcs-utilities/

Check warning on line 169 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP6&open=AZ-QkQ2A9U3Zh3IAfzP6&pullRequest=53

Check warning on line 169 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP7&open=AZ-QkQ2A9U3Zh3IAfzP7&pullRequest=53

- name: Upload coverage artifact
if: matrix.python-version == '3.12'
Expand All @@ -190,10 +190,10 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand All @@ -201,11 +201,11 @@
run: uv python install 3.12

- name: Install dependencies
run: uv sync --all-extras

Check warning on line 204 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP9&open=AZ-QkQ2A9U3Zh3IAfzP9&pullRequest=53

Check warning on line 204 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP8&open=AZ-QkQ2A9U3Zh3IAfzP8&pullRequest=53

- name: Run Bandit security scan
run: |
uv run bandit -r packages/cloudflare-auth/src/ packages/gcs-utilities/src/ -c pyproject.toml || true

Check warning on line 208 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP-&open=AZ-QkQ2A9U3Zh3IAfzP-&pullRequest=53

Check warning on line 208 in .github/workflows/ci.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ2A9U3Zh3IAfzP_&open=AZ-QkQ2A9U3Zh3IAfzP_&pullRequest=53

# Upload combined coverage to Codecov
coverage:
Expand All @@ -222,7 +222,7 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Download coverage artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,22 +39,22 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.12"

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

- name: Install dependencies
run: uv sync --no-dev

Check warning on line 57 in .github/workflows/codeql.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ4G9U3Zh3IAfzQO&open=AZ-QkQ4G9U3Zh3IAfzQO&pullRequest=53

Check warning on line 57 in .github/workflows/codeql.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ4G9U3Zh3IAfzQN&open=AZ-QkQ4G9U3Zh3IAfzQN&pullRequest=53

- name: Initialize CodeQL
uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Dependency Review
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/pr-validation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,10 +61,10 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Install UV
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand All @@ -72,12 +72,12 @@
run: uv python install 3.12

- name: Install dependencies
run: uv sync --all-extras

Check warning on line 75 in .github/workflows/pr-validation.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ239U3Zh3IAfzQA&open=AZ-QkQ239U3Zh3IAfzQA&pullRequest=53

Check warning on line 75 in .github/workflows/pr-validation.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ239U3Zh3IAfzQB&open=AZ-QkQ239U3Zh3IAfzQB&pullRequest=53

- name: Run vulture
run: |
echo "## Dead Code Report" >> $GITHUB_STEP_SUMMARY
uv run vulture src/ packages/ --min-confidence 90 | tee vulture-report.txt || true

Check warning on line 80 in .github/workflows/pr-validation.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ239U3Zh3IAfzQC&open=AZ-QkQ239U3Zh3IAfzQC&pullRequest=53

Check warning on line 80 in .github/workflows/pr-validation.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ239U3Zh3IAfzQD&open=AZ-QkQ239U3Zh3IAfzQD&pullRequest=53
if [ -s vulture-report.txt ]; then
echo '```' >> $GITHUB_STEP_SUMMARY
cat vulture-report.txt >> $GITHUB_STEP_SUMMARY
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/publish-artifact-registry.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ jobs:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
fetch-depth: 0

Expand Down Expand Up @@ -197,7 +197,7 @@ jobs:
echo "📦 Registry URL: $AR_URL"

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
version: ${{ env.UV_VERSION }}
enable-cache: true
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,12 +51,12 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand All @@ -64,10 +64,10 @@
run: uv python install 3.12

- name: Install dependencies
run: uv sync --all-extras

Check warning on line 67 in .github/workflows/release.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ3N9U3Zh3IAfzQF&open=AZ-QkQ3N9U3Zh3IAfzQF&pullRequest=53

Check warning on line 67 in .github/workflows/release.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ3N9U3Zh3IAfzQE&open=AZ-QkQ3N9U3Zh3IAfzQE&pullRequest=53

- name: Run tests
run: uv run pytest -v --cov=src --cov-report=xml --cov-fail-under=80

Check warning on line 70 in .github/workflows/release.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ3N9U3Zh3IAfzQG&open=AZ-QkQ3N9U3Zh3IAfzQG&pullRequest=53

release:
name: Semantic Release
Expand All @@ -84,13 +84,13 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
token: "${{ secrets.GITHUB_TOKEN }}"

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand All @@ -98,7 +98,7 @@
run: uv python install 3.12

- name: Install dependencies
run: uv sync --all-extras

Check warning on line 101 in .github/workflows/release.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ3N9U3Zh3IAfzQI&open=AZ-QkQ3N9U3Zh3IAfzQI&pullRequest=53

Check warning on line 101 in .github/workflows/release.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ3N9U3Zh3IAfzQH&open=AZ-QkQ3N9U3Zh3IAfzQH&pullRequest=53

- name: Python Semantic Release
id: release
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/reuse.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ jobs:
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: REUSE Compliance Check
uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
4 changes: 2 additions & 2 deletions .github/workflows/security-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,10 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand All @@ -51,10 +51,10 @@
run: uv python install 3.12

- name: Install dependencies
run: uv sync --all-extras

Check warning on line 54 in .github/workflows/security-analysis.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ3z9U3Zh3IAfzQK&open=AZ-QkQ3z9U3Zh3IAfzQK&pullRequest=53

Check warning on line 54 in .github/workflows/security-analysis.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ3z9U3Zh3IAfzQJ&open=AZ-QkQ3z9U3Zh3IAfzQJ&pullRequest=53

- name: Run Bandit security scan
run: uv run bandit -r src/ -c pyproject.toml -f json -o bandit-report.json || true

Check warning on line 57 in .github/workflows/security-analysis.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Omitting "--no-build" can lead to the execution of setup scripts. Make sure it is safe here. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ3z9U3Zh3IAfzQL&open=AZ-QkQ3z9U3Zh3IAfzQL&pullRequest=53

Check warning on line 57 in .github/workflows/security-analysis.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Using dependencies without locking resolved versions is security-sensitive. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ3z9U3Zh3IAfzQM&open=AZ-QkQ3z9U3Zh3IAfzQM&pullRequest=53

- name: Run OSV-Scanner dependency scan
uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/slsa-provenance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,17 +48,17 @@
egress-policy: audit

- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0

- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.12"

- name: Install UV
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: true

Expand All @@ -79,7 +79,7 @@
id: hashes
run: |
cd dist
HASHES=$(sha256sum * | base64 -w0)

Check warning on line 82 in .github/workflows/slsa-provenance.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Prefix files and paths with "./" or "--" when using glob. 


See more on https://sonarcloud.io/project/issues?id=ByronWilliamsCPA_python-libs&issues=AZ-QkQ4c9U3Zh3IAfzQP&open=AZ-QkQ4c9U3Zh3IAfzQP&pullRequest=53
echo "hashes=$HASHES" >> $GITHUB_OUTPUT

- name: Upload build artifacts
Expand Down
Loading