From 6764c2751fafee4c2f32d15b487f132eec9179c6 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Wed, 28 Jan 2026 03:44:46 +0000 Subject: [PATCH 1/4] chore(deps): update all dependencies --- .github/workflows/publish.yaml | 2 +- .github/workflows/test.yaml | 4 ++-- http-proxy-configurator-operator/requirements.txt | 2 +- http-proxy-policy-operator/requirements.txt | 2 +- http-proxy-policy/requirements.txt | 2 +- squid-forward-proxy-operator/requirements.txt | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index d649352..b901cf9 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -37,7 +37,7 @@ jobs: id: snapcraft-build uses: snapcore/action-build@v1 - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@v6 with: name: charmed-http-proxy-policy-snap path: "*.snap" diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 7b3a96b..7af40c1 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -40,7 +40,7 @@ jobs: name: HTTP Proxy Policy Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.1 + - uses: actions/checkout@v6.0.2 - uses: actions/setup-python@v6 with: python-version: '3.x' @@ -67,7 +67,7 @@ jobs: id: snapcraft-build uses: snapcore/action-build@v1 - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@v6 with: name: charmed-http-proxy-policy-snap path: "*.snap" diff --git a/http-proxy-configurator-operator/requirements.txt b/http-proxy-configurator-operator/requirements.txt index f157cae..4bcb95f 100644 --- a/http-proxy-configurator-operator/requirements.txt +++ b/http-proxy-configurator-operator/requirements.txt @@ -1,2 +1,2 @@ -ops==3.4.0 +ops==3.5.1 pydantic==2.12.5 diff --git a/http-proxy-policy-operator/requirements.txt b/http-proxy-policy-operator/requirements.txt index 6a9d2c1..b222c13 100644 --- a/http-proxy-policy-operator/requirements.txt +++ b/http-proxy-policy-operator/requirements.txt @@ -1,3 +1,3 @@ -ops==3.4.0 +ops==3.5.1 pydantic==2.12.5 requests==2.32.5 diff --git a/http-proxy-policy/requirements.txt b/http-proxy-policy/requirements.txt index 4417270..b3ce86f 100644 --- a/http-proxy-policy/requirements.txt +++ b/http-proxy-policy/requirements.txt @@ -1,4 +1,4 @@ -django==6.0 +django==6.0.1 djangorestframework==3.16.1 djangorestframework-simplejwt==5.5.1 pydantic==2.12.5 diff --git a/squid-forward-proxy-operator/requirements.txt b/squid-forward-proxy-operator/requirements.txt index f157cae..4bcb95f 100644 --- a/squid-forward-proxy-operator/requirements.txt +++ b/squid-forward-proxy-operator/requirements.txt @@ -1,2 +1,2 @@ -ops==3.4.0 +ops==3.5.1 pydantic==2.12.5 From 3e3abff758b9e3ddb9ddfc915ab0626037fc826a Mon Sep 17 00:00:00 2001 From: Christopher Bartz Date: Thu, 29 Jan 2026 11:34:17 +0100 Subject: [PATCH 2/4] fix: Add nosec comments to test credentials to pass bandit --- .../tests/unit/test_charm.py | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/http-proxy-policy-operator/tests/unit/test_charm.py b/http-proxy-policy-operator/tests/unit/test_charm.py index 4c1c152..f55a8a1 100644 --- a/http-proxy-policy-operator/tests/unit/test_charm.py +++ b/http-proxy-policy-operator/tests/unit/test_charm.py @@ -121,7 +121,7 @@ def test_reply_requests(mock_policy): "database": "http-proxy-policy", "endpoints": "postgresql.test:5432", "username": "postgres", - "password": "postgres", + "password": "postgres", # nosec }, ) mock_policy.HttpProxyPolicyClient.refresh.return_value = EXAMPLE_EVALUATED_REQUESTS @@ -192,7 +192,7 @@ def test_relay_responses(mock_policy): }, ) mock_policy.HttpProxyPolicyClient.refresh.return_value = [EXAMPLE_EVALUATED_REQUESTS[0]] - backend_secret = ops.testing.Secret(tracked_content={"username": "test", "password": "test"}) + backend_secret = ops.testing.Secret(tracked_content={"username": "test", "password": "test"} # nosec) backend_relation = ops.testing.Relation( endpoint="http-proxy-backend", remote_app_data={ @@ -216,7 +216,7 @@ def test_relay_responses(mock_policy): "database": "http-proxy-policy", "endpoints": "postgresql.test:5432", "username": "postgres", - "password": "postgres", + "password": "postgres", # nosec }, ) state_in = ops.testing.State( @@ -277,7 +277,7 @@ def test_invalid_requests(mock_policy): "database": "http-proxy-policy", "endpoints": "postgresql.test:5432", "username": "postgres", - "password": "postgres", + "password": "postgres", # nosec }, ) backend_relation = ops.testing.Relation( @@ -363,7 +363,7 @@ def test_unsupported_requests(mock_policy): # pylint: disable=unused-argument "database": "http-proxy-policy", "endpoints": "postgresql.test:5432", "username": "postgres", - "password": "postgres", + "password": "postgres", # nosec }, ) backend_relation = ops.testing.Relation( @@ -422,7 +422,7 @@ def test_ignore_duplicate_requests(mock_policy): "database": "http-proxy-policy", "endpoints": "postgresql.test:5432", "username": "postgres", - "password": "postgres", + "password": "postgres", # nosec }, ) backend_relation = ops.testing.Relation( @@ -469,7 +469,7 @@ def test_cleanup_responses(mock_policy): }, ) mock_policy.HttpProxyPolicyClient.refresh.return_value = [EXAMPLE_EVALUATED_REQUESTS[0]] - backend_secret = ops.testing.Secret(tracked_content={"username": "test", "password": "test"}) + backend_secret = ops.testing.Secret(tracked_content={"username": "test", "password": "test"} # nosec) backend_relation = ops.testing.Relation( endpoint="http-proxy-backend", local_app_data={ @@ -504,7 +504,7 @@ def test_cleanup_responses(mock_policy): "database": "http-proxy-policy", "endpoints": "postgresql.test:5432", "username": "postgres", - "password": "postgres", + "password": "postgres", # nosec }, ) state_in = ops.testing.State( @@ -547,7 +547,7 @@ def test_invalid_backend_response(mock_policy): }, ) mock_policy.HttpProxyPolicyClient.refresh.return_value = [EXAMPLE_EVALUATED_REQUESTS[0]] - backend_secret = ops.testing.Secret(tracked_content={"username": "test", "password": "test"}) + backend_secret = ops.testing.Secret(tracked_content={"username": "test", "password": "test"} # nosec) backend_relation = ops.testing.Relation( endpoint="http-proxy-backend", remote_app_data={ @@ -560,7 +560,7 @@ def test_invalid_backend_response(mock_policy): "database": "http-proxy-policy", "endpoints": "postgresql.test:5432", "username": "postgres", - "password": "postgres", + "password": "postgres", # nosec }, ) state_in = ops.testing.State( @@ -611,7 +611,7 @@ def test_missing_backend_relation(mock_policy): "database": "http-proxy-policy", "endpoints": "postgresql.test:5432", "username": "postgres", - "password": "postgres", + "password": "postgres", # nosec }, ) state_in = ops.testing.State( From 9c25f84eaf343ce3395328425651f95de8e56223 Mon Sep 17 00:00:00 2001 From: "Sebastien Georget (charmkeeper)" Date: Wed, 17 Jun 2026 10:50:20 +0200 Subject: [PATCH 3/4] Add pull-requests:write permission to bot_pr_approval workflow The bot_pr_approval workflow requires pull-requests:write permission to approve bot-authored PRs via the GitHub API. This permission was missing from the workflow configuration. --- .github/workflows/bot_pr_approval.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/bot_pr_approval.yaml b/.github/workflows/bot_pr_approval.yaml index f284fd7..638e931 100644 --- a/.github/workflows/bot_pr_approval.yaml +++ b/.github/workflows/bot_pr_approval.yaml @@ -6,5 +6,7 @@ on: jobs: bot_pr_approval: uses: canonical/operator-workflows/.github/workflows/bot_pr_approval.yaml@main + permissions: + pull-requests: write secrets: inherit From c552c7e3aae5449d0d0945d6b035bdf015327276 Mon Sep 17 00:00:00 2001 From: "Sebastien Georget (charmkeeper)" Date: Thu, 18 Jun 2026 14:59:51 +0200 Subject: [PATCH 4/4] Add missing job-level permissions to CI workflows Add required permissions at the job level for reusable workflows: - unit-tests: contents:read, pull-requests:write (for charming-actions/check-libraries) - integration-tests: contents:read, packages:write, pull-requests:write - allure-report: contents:write (for pushing to gh-pages) These permissions allow the workflows to perform their intended operations without requiring broader workflow-level permissions. --- .github/workflows/test.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 7af40c1..452aac2 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -12,6 +12,9 @@ jobs: matrix: charm: [squid-forward-proxy, http-proxy-policy, http-proxy-configurator] uses: canonical/operator-workflows/.github/workflows/test.yaml@main + permissions: + contents: read + pull-requests: write secrets: inherit with: self-hosted-runner: false @@ -24,6 +27,10 @@ jobs: charm: [squid-forward-proxy, http-proxy-policy, http-proxy-configurator] uses: canonical/operator-workflows/.github/workflows/integration_test.yaml@main + permissions: + contents: read + packages: write + pull-requests: write secrets: inherit with: juju-channel: '3/stable' @@ -34,6 +41,8 @@ jobs: if: ${{ !cancelled() && github.event_name == 'schedule' }} needs: - integration-tests + permissions: + contents: write uses: canonical/operator-workflows/.github/workflows/allure_report.yaml@main http-proxy-policy: