Merge branch 'main' into dependabot/github_actions/github/codeql-action-4.35.2

Author: acabarbaye

.github/workflows/dependabot.yml

@@ -23,7 +23,7 @@ jobs:
           python -m pip list
       - name: Dependabot metadata
         id: dependabot-metadata
-        uses: dependabot/fetch-metadata@v3.0.0
+        uses: dependabot/fetch-metadata@v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Add a label

.github/workflows/dependency-review.yml

@@ -17,4 +17,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@v6.0.2
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@v5

CHANGELOG.md

@@ -17,6 +17,18 @@ This project was forked from version 1.7.4 of [mbed-tools-ci-scripts](https://gi
 
 [//]: # (begin_release_notes)
 
+"3.4.1" (2026-06-01)
+====================
+
+Bugfixes
+--------
+
+- Dependency upgrade: jinja2-3.0.3 (#202202230717)
+- Dependency upgrade: fetch-metadata-3.1.0 (#20260420065012)
+- Dependency upgrade: dependency-review-action-5 (#20260511075632)
+- :bug: Ensure that if a fetch fails it retries with authentication in the same way as clone (#20260601135433)
+
+
 "3.4.0" (2026-04-07)
 ====================
 

continuous_delivery_scripts/_version.py

@@ -11,8 +11,8 @@
 This file is autogenerated, do not modify by hand.
 """
 
-__version__ = "3.4.0"
-COMMIT = "593860a336acbead96e80e1a5c55aee240dbf97e"
+__version__ = "3.4.1"
+COMMIT = "3cb7eefdafb8306ca4750f371325574e1a2ec9c7"
 MAJOR = 3
 MINOR = 4
-PATCH = 0
+PATCH = 1

continuous_delivery_scripts/utils/git_helpers.py

@@ -196,7 +196,13 @@ def is_release_branch(self, branch_name: Optional[str]) -> bool:
 
     def fetch(self) -> None:
         """Fetches latest changes."""
-        self.repo.git.fetch(all=True, tags=True, force=True)
+        try:
+            self.repo.git.fetch(all=True, tags=True, force=True)
+        except GitCommandError as e:
+            logger.info("failed fetching repository: %s" % e)
+            logger.info("Retrying a different way")
+            self.set_remote_url(self._git_url_ssh_to_https(self.get_remote_url()))
+            self.repo.git.fetch(all=True, tags=True, force=True)
 
     def get_branch(self, branch_name: str) -> Any:
         """Gets a specific local branch.

docs/utils/git_helpers.html

@@ -229,7 +229,13 @@ <h1 class="title">Module <code>continuous_delivery_scripts.utils.git_helpers</co
 
     def fetch(self) -&gt; None:
         &#34;&#34;&#34;Fetches latest changes.&#34;&#34;&#34;
-        self.repo.git.fetch(all=True, tags=True, force=True)
+        try:
+            self.repo.git.fetch(all=True, tags=True, force=True)
+        except GitCommandError as e:
+            logger.info(&#34;failed fetching repository: %s&#34; % e)
+            logger.info(&#34;Retrying a different way&#34;)
+            self.set_remote_url(self._git_url_ssh_to_https(self.get_remote_url()))
+            self.repo.git.fetch(all=True, tags=True, force=True)
 
     def get_branch(self, branch_name: str) -&gt; Any:
         &#34;&#34;&#34;Gets a specific local branch.
@@ -1319,7 +1325,13 @@ <h2 id="args">Args</h2>
 
     def fetch(self) -&gt; None:
         &#34;&#34;&#34;Fetches latest changes.&#34;&#34;&#34;
-        self.repo.git.fetch(all=True, tags=True, force=True)
+        try:
+            self.repo.git.fetch(all=True, tags=True, force=True)
+        except GitCommandError as e:
+            logger.info(&#34;failed fetching repository: %s&#34; % e)
+            logger.info(&#34;Retrying a different way&#34;)
+            self.set_remote_url(self._git_url_ssh_to_https(self.get_remote_url()))
+            self.repo.git.fetch(all=True, tags=True, force=True)
 
     def get_branch(self, branch_name: str) -&gt; Any:
         &#34;&#34;&#34;Gets a specific local branch.
@@ -2278,7 +2290,13 @@ <h2 id="args">Args</h2>
 </summary>
 <pre><code class="python">def fetch(self) -&gt; None:
     &#34;&#34;&#34;Fetches latest changes.&#34;&#34;&#34;
-    self.repo.git.fetch(all=True, tags=True, force=True)</code></pre>
+    try:
+        self.repo.git.fetch(all=True, tags=True, force=True)
+    except GitCommandError as e:
+        logger.info(&#34;failed fetching repository: %s&#34; % e)
+        logger.info(&#34;Retrying a different way&#34;)
+        self.set_remote_url(self._git_url_ssh_to_https(self.get_remote_url()))
+        self.repo.git.fetch(all=True, tags=True, force=True)</code></pre>
 </details>
 </dd>
 <dt id="continuous_delivery_scripts.utils.git_helpers.GitWrapper.force_pull"><code class="name flex">

news/202202230717.bugfix

@@ -2,7 +2,9 @@
 # Copyright (C) 2020-2026 Arm Limited or its affiliates and Contributors. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 #
-from unittest import TestCase
+from unittest import TestCase, mock
+
+from git import GitCommandError
 
 from continuous_delivery_scripts.utils.configuration import (
     configuration,
@@ -37,6 +39,30 @@ def test_list_tracked_files(self):
         self.assertTrue(len(tracked_files) > 0)
         self.assertIn("setup.py", tracked_files)
 
+    @mock.patch.object(GitWrapper, "set_remote_url")
+    @mock.patch.object(
+        GitWrapper,
+        "_git_url_ssh_to_https",
+        return_value="https://test-token:x-oauth-basic@github.com/example/repository.git",
+    )
+    @mock.patch.object(
+        GitWrapper,
+        "get_remote_url",
+        return_value="https://github.com/example/repository.git",
+    )
+    def test_fetch_retries_with_authentication(self, _get_remote_url, _git_url_ssh_to_https, set_remote_url):
+        """Ensures fetch retries with authentication when needed."""
+        repo = mock.Mock(spec_set=["git"])
+        repo.git = mock.Mock(spec_set=["fetch"])
+        repo.git.fetch.side_effect = [GitCommandError("fetch", 128, stderr="fatal"), None]
+
+        git = GitWrapper(path=Path("."), repo=repo)
+
+        git.fetch()
+
+        self.assertEqual(2, repo.git.fetch.call_count)
+        set_remote_url.assert_called_once_with("https://test-token:x-oauth-basic@github.com/example/repository.git")
+
 
 class TestGitTempClone(TestCase):
     def test_git_clone(self):