fix: critical findings from package audit (C1, C3, C5)#27
Open
shpaker wants to merge 3 commits into
Open
Conversation
…ve assertions `registry_key_should_not_exist` and `registry_value_should_not_exist` previously raised FileExistsError to signal that a key/value existed when the test expected it to be missing. Robot Framework treats this as an unexpected error rather than a failed assertion, leading to confusing reports. Switch to AssertionError with a descriptive message so the failure is reported as a proper assertion failure. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The previous badges linked to pypi.python.org, which has been deprecated since 2018. Update links to pypi.org/project/winregistry/ and add two informative badges (supported Python versions and license). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replace long-lived API token (PYPI_PASS secret) with PyPI Trusted Publisher authentication via GitHub OIDC. Add a `pypi` environment and `id-token: write` permission so uv publish can request the short-lived OIDC token. Setup required on PyPI side: - Add a Trusted Publisher at https://pypi.org/manage/project/winregistry/settings/publishing/ (owner: shpaker, repo: winregistry, workflow: pypi.yml, environment: pypi) - After the next successful release, the PYPI_PASS secret can be removed from repository settings. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three critical fixes from the package audit:
Robot FrameworkkeywordsRegistry Key Should Not ExistandRegistry Value Should Not Existnow raiseAssertionError(with descriptive message) instead ofFileExistsError. Robot reports this as a proper failed assertion rather than an unexpected error.READMEbadges migrated from the deprecatedpypi.python.orgdomain topypi.org/project/winregistry/; added Python-versions and license badges for discoverability..github/workflows/pypi.ymlnow uses PyPI Trusted Publisher (OIDC) viauv publish --trusted-publishing always, with a dedicatedpypienvironment andid-token: writepermission. Removes the long-livedPYPI_PASStoken from the publish flow.Out-of-scope per audit decisions:
sed-based version substitution inpypi.ymlis kept as-is.Required PyPI-side setup before next release
shpakerwinregistrypypi.ymlpypiPYPI_PASSrepository secret can be removed.Test plan
robot.ymlworkflow stays green on the full Python 3.8–3.14 matrix (Robot tests on Windows).pypi.ymlruns successfully and publishes via OIDC (noPYPI_PASSreference triggered).Registry Key Should Not Existkeyword against an existing key and confirm Robot reports a failed assertion (not error).Notes
just lintstill reports 6 pre-existingEM102/TRY003/UP032warnings on lines unrelated to this change (the audit identified this as finding I2 — CI does not currently run the linter). Those are intentionally not fixed here to keep the PR scoped to the three critical items.🤖 Generated with Claude Code