Update all dependencies - #297
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #297 +/- ##
=======================================
Coverage 98.71% 98.71%
=======================================
Files 6 6
Lines 701 701
=======================================
Hits 692 692
Misses 9 9 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
04834e9 to
33c4995
Compare
renovate
Bot
changed the title
|
ed0e951 to
7fe25ef
Compare
7fe25ef to
155d685
Compare
afa6b24 to
d2a3e26
Compare
d2a3e26 to
7669111
Compare
7669111 to
acc7d05
Compare
60ab3d0 to
df6e28c
Compare
df6e28c to
c0d3cc8
Compare
6a360e2 to
7251445
Compare
2df3ed7 to
e79cc87
Compare
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe pull request updates pinned GitHub Actions revisions across documentation, release, test, coverage, and security workflows. It also upgrades the Poetry development dependency ChangesCI and tooling updates
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tox-test.yml:
- Line 9: Disable credential persistence on every actions/checkout step in
.github/workflows/tox-test.yml at lines 9-9, 25-25, 41-41, 59-59, 86-86, and
102-102, and in .github/workflows/docs.yml at 10-10 and
.github/workflows/release.yml at 12-12 by setting persist-credentials to false.
In docs.yml, give scripts/push-docs a separate narrowly scoped credential;
release.yml requires no persisted GitHub token.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 807014a7-44eb-4195-9fd2-e4bb85acfdac
📒 Files selected for processing (4)
.github/workflows/docs.yml.github/workflows/release.yml.github/workflows/tox-test.ymlpyproject.toml
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== workflow files ==\n'
git ls-files '.github/workflows/*.yml' '.github/workflows/*.yaml'
printf '\n== tox-test.yml ==\n'
cat -n .github/workflows/tox-test.yml
printf '\n== docs.yml ==\n'
cat -n .github/workflows/docs.yml
printf '\n== release.yml ==\n'
cat -n .github/workflows/release.yml
printf '\n== references to push-docs / git push / checkout ==\n'
rg -n "push-docs|git push|actions/checkout|persist-credentials|GITHUB_TOKEN|token:" .github/workflows README.md . -g '!**/.git/**'Repository: release-engineering/ubi-population-tool
Length of output: 8087
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== workflow file sizes ==\n'
wc -l .github/workflows/tox-test.yml .github/workflows/docs.yml .github/workflows/release.yml
printf '\n== targeted slices ==\n'
sed -n '1,140p' .github/workflows/tox-test.yml
printf '\n--- docs.yml ---\n'
sed -n '1,80p' .github/workflows/docs.yml
printf '\n--- release.yml ---\n'
sed -n '1,80p' .github/workflows/release.ymlRepository: release-engineering/ubi-population-tool
Length of output: 5819
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
for path in [Path('.github/workflows/tox-test.yml'), Path('.github/workflows/docs.yml'), Path('.github/workflows/release.yml')]:
print(f'== {path} ==')
for i, line in enumerate(path.read_text().splitlines(), 1):
if 'actions/checkout' in line or 'persist-credentials' in line or 'push-docs' in line or 'GITHUB_TOKEN' in line or 'token:' in line or 'uses:' in line and 'checkout' not in line:
print(f'{i}: {line}')
print()
PYRepository: release-engineering/ubi-population-tool
Length of output: 2345
Disable checkout credential persistence on these workflow steps.
Set persist-credentials: false on the actions/checkout steps in .github/workflows/tox-test.yml, .github/workflows/docs.yml, and .github/workflows/release.yml; otherwise later repository-controlled commands can read GITHUB_TOKEN from .git/config.
- In
docs.yml, givescripts/push-docsits own narrowly scoped credential. - In
release.yml, checkout does not need GitHub token persistence at all.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 9-9: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 3 files
.github/workflows/tox-test.yml#L9-L9(this comment).github/workflows/tox-test.yml#L25-L25.github/workflows/tox-test.yml#L41-L41.github/workflows/tox-test.yml#L59-L59.github/workflows/tox-test.yml#L86-L86.github/workflows/tox-test.yml#L102-L102.github/workflows/docs.yml#L10-L10.github/workflows/release.yml#L12-L12
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/tox-test.yml at line 9, Disable credential persistence on
every actions/checkout step in .github/workflows/tox-test.yml at lines 9-9,
25-25, 41-41, 59-59, 86-86, and 102-102, and in .github/workflows/docs.yml at
10-10 and .github/workflows/release.yml at 12-12 by setting persist-credentials
to false. In docs.yml, give scripts/push-docs a separate narrowly scoped
credential; release.yml requires no persisted GitHub token.
Sources: Path instructions, Linters/SAST tools
e79cc87 to
1493a69
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/tox-test.yml (1)
22-37: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSet explicit
permissions: contents: readon these jobs.
.github/workflows/tox-test.yml: add the block topy313andstatic; they only need repo read access for checkout.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/tox-test.yml around lines 22 - 37, Add job-level permissions to both the py313 and static jobs in tox-test.yml, setting contents to read for each. No other workflow behavior needs to change.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 12: Update the actions/checkout step in the release workflow to set
persist-credentials to false, preventing the GitHub token from being retained in
the repository configuration while leaving the pinned checkout action unchanged.
---
Nitpick comments:
In @.github/workflows/tox-test.yml:
- Around line 22-37: Add job-level permissions to both the py313 and static jobs
in tox-test.yml, setting contents to read for each. No other workflow behavior
needs to change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: b335f0ac-83b7-457f-a397-fa9f43e69b88
📒 Files selected for processing (4)
.github/workflows/docs.yml.github/workflows/release.yml.github/workflows/tox-test.ymlpyproject.toml
🚧 Files skipped from review as they are similar to previous changes (1)
- pyproject.toml
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable checkout credential persistence.
actions/checkout stores the GitHub token in the local repository configuration. If the release workspace is accidentally included in a build artifact or exposed by a later step, that token can leak. Add persist-credentials: false; the workflow does not need authenticated Git operations after checkout.
Proposed fix
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 12-12: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 12, Update the actions/checkout step
in the release workflow to set persist-credentials to false, preventing the
GitHub token from being retained in the repository configuration while leaving
the pinned checkout action unchanged.
Source: Linters/SAST tools
1493a69 to
cf18c05
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tox-test.yml:
- Around line 22-37: Declare workflow-level permissions in
.github/workflows/tox-test.yml with contents: read for the default jobs,
including py312, py313, static, bandit, and bandit-exitzero. Configure the
coverage job separately with contents: read and id-token: write so checkout and
Codecov continue to work.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: e6f5a9d4-db00-43e5-adbf-2840846d194d
📒 Files selected for processing (4)
.github/workflows/docs.yml.github/workflows/release.yml.github/workflows/tox-test.ymlpyproject.toml
🚧 Files skipped from review as they are similar to previous changes (1)
- pyproject.toml
| py313: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | ||
| - name: Setup Python | ||
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 | ||
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 | ||
| with: | ||
| python-version: "3.13" | ||
| - name: Install base packages | ||
| run: sudo apt-get install gcc python3-dev libkrb5-dev | ||
| - name: Install Tox | ||
| run: pip install tox | ||
| - name: Install Poetry | ||
| uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1 | ||
| uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1 | ||
| - name: Run Tox | ||
| run: tox -e py313 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
git ls-files .github/workflows/tox-test.yml .github/workflowsRepository: release-engineering/ubi-population-tool
Length of output: 265
🏁 Script executed:
cat -n .github/workflows/tox-test.ymlRepository: release-engineering/ubi-population-tool
Length of output: 5086
Declare explicit read-only permissions for this workflow.
py312, py313, static, bandit, and bandit-exitzero all inherit the repo-default GITHUB_TOKEN scope here. Set permissions: contents: read at the workflow level; keep coverage as contents: read, id-token: write so checkout and Codecov still work.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 22-37: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
📍 Affects 1 file
.github/workflows/tox-test.yml#L22-L37(this comment).github/workflows/tox-test.yml#L38-L53
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/tox-test.yml around lines 22 - 37, Declare workflow-level
permissions in .github/workflows/tox-test.yml with contents: read for the
default jobs, including py312, py313, static, bandit, and bandit-exitzero.
Configure the coverage job separately with contents: read and id-token: write so
checkout and Codecov continue to work.
Source: Linters/SAST tools
cf18c05 to
bfda9b2
Compare
bfda9b2 to
898a83a
Compare
898a83a to
823d556
Compare
This PR contains the following updates:
v6→v7v6→v7v5→v71.19.1→2.3.12.44.0→2.45.076e04a9→a783c32Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
actions/setup-python (actions/setup-python)
v7.0.0Compare Source
codecov/codecov-action (codecov/codecov-action)
v7.0.0Compare Source
codecovsecurityaccount. We have deleted the account and are usingcodecovsecopswith the original gpg keyWhat's Changed
Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0
v6.0.2Compare Source
This is a copy of the
v7.0.0release to make updates easierWhat's Changed
Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2
v6.0.1Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1
v6.0.0Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0
python/mypy (mypy)
v2.3.1Compare Source
v2.3.0Compare Source
v2.2.0Compare Source
v2.1.0Compare Source
v2.0.0Compare Source
v1.20.2Compare Source
v1.20.1Compare Source
dict.__or__typeshed change (Ivan Levkivskyi, PR 21186)type[T]in type calls (Shantanu, PR 21174)Anytyped variables (Shantanu, PR 21142)--warn-unused-configshould not be a strict flag (Ivan Levkivskyi, PR 21139)v1.20.0Compare Source
release-engineering/pubtools-pulplib (pubtools-pulplib)
v2.45.0Compare Source
Added
get_distribution()method for pulp3 clientConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.