Skip to content

Commit 137323d

Browse files
MattyTheHackerMattyTheHacker
committed
Merge branch 'main' into msl-auth
2 parents de2980b + 6b27c5c commit 137323d

14 files changed

Lines changed: 726 additions & 525 deletions

‎.github/renovate.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@
2020
"replacements:all",
2121
"workarounds:all"
2222
],
23+
"gitIgnoredAuthors": [
24+
"autofix-ci@users.noreply.github.com",
25+
"autofix-ci[bot]@users.noreply.github.com",
26+
"114827586+autofix-ci[bot]@users.noreply.github.com"
27+
],
2328
"labels": [
2429
"dependencies"
2530
],

‎.github/workflows/autofix-pre-commit.yaml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: autofix.ci
2+
3+
"on":
4+
pull_request:
5+
branches: [main]
6+
workflow_call:
7+
inputs:
8+
skip-autofix:
9+
default: false
10+
required: false
11+
type: boolean
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
autofix-pre-commit:
18+
env:
19+
UV_FROZEN: true
20+
UV_NO_SYNC: true
21+
UV_PYTHON_DOWNLOADS: never
22+
runs-on: ubuntu-latest
23+
24+
steps:
25+
- uses: actions/checkout@v6
26+
27+
- name: Add GB Locale
28+
run: |
29+
sudo apt-get update
30+
sudo apt-get install -y locales
31+
sudo locale-gen en_GB.UTF-8
32+
shell: bash
33+
34+
- name: Set Up Python
35+
uses: actions/setup-python@v6
36+
with:
37+
python-version-file: .python-version
38+
39+
- name: Install uv
40+
uses: astral-sh/setup-uv@v8.1.0
41+
with:
42+
enable-cache: true
43+
44+
- name: Install prek From Locked Dependencies
45+
run: uv sync --only-group pre-commit
46+
47+
- id: store-hashed-python-version
48+
name: Store Hashed Python Version
49+
run: echo "hashed_python_version=$(uv run -- python -VV | sha256sum | cut -d' ' -f1)"
50+
>> "$GITHUB_OUTPUT"
51+
52+
- uses: actions/cache@v5
53+
with:
54+
key: prek|${{steps.store-hashed-python-version.outputs.hashed_python_version}}|${{hashFiles('.pre-commit-config.yaml')}}
55+
path: ~/.cache/prek
56+
57+
- name: Setup pre-commit Environments
58+
run: uv run -- prek install-hooks
59+
60+
- name: Run prek
61+
run: |
62+
set -o pipefail
63+
if [[ "${{github.event_name}}" == "push" && "${{github.ref_name}}" == "${{github.event.repository.default_branch}}" ]]; then
64+
uv run -- prek run --all-files --hook-stage manual --color never --skip ruff-check --skip uv-lock --skip gitlint-ci | tee /tmp/prek.log
65+
else
66+
uv run -- prek run --all-files --hook-stage manual --color never --skip ruff-check --skip uv-lock | tee /tmp/prek.log
67+
fi
68+
69+
- name: Ensure No Warnings
70+
run: "if grep -q '^warning: ' /tmp/prek.log; then exit 1; fi"
71+
72+
- if: "!cancelled() && inputs.skip-autofix != true"
73+
uses: autofix-ci/action@v1.3.4

‎.github/workflows/check-build-deploy.yaml‎

Lines changed: 19 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ name: Check, Build and Deploy
77
branches: [main]
88
tags: [v*]
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
uv-check:
1215
runs-on: ubuntu-latest
@@ -15,7 +18,7 @@ jobs:
1518
- uses: actions/checkout@v6
1619

1720
- name: Install uv
18-
uses: astral-sh/setup-uv@v7
21+
uses: astral-sh/setup-uv@v8.1.0
1922
with:
2023
enable-cache: true
2124

@@ -38,7 +41,7 @@ jobs:
3841
python-version: 3.14
3942

4043
- name: Install uv
41-
uses: astral-sh/setup-uv@v7
44+
uses: astral-sh/setup-uv@v8.1.0
4245
with:
4346
enable-cache: true
4447

@@ -69,7 +72,7 @@ jobs:
6972
python-version-file: .python-version
7073

7174
- name: Install uv
72-
uses: astral-sh/setup-uv@v7
75+
uses: astral-sh/setup-uv@v8.1.0
7376
with:
7477
enable-cache: true
7578

@@ -110,62 +113,9 @@ jobs:
110113
uv run -- mypy "${ARGS[@]}"
111114
112115
pre-commit: # yamllint disable-line rule:key-ordering
113-
env:
114-
UV_FROZEN: true
115-
UV_NO_SYNC: true
116-
UV_PYTHON_DOWNLOADS: never
117-
runs-on: ubuntu-latest
118-
119-
steps:
120-
- uses: actions/checkout@v6
121-
122-
- name: Add GB Locale
123-
run: |
124-
sudo apt-get update
125-
sudo apt-get install -y locales
126-
sudo locale-gen en_GB.UTF-8
127-
shell: bash
128-
129-
- name: Set Up Python
130-
uses: actions/setup-python@v6
131-
with:
132-
python-version-file: .python-version
133-
134-
- name: Install uv
135-
uses: astral-sh/setup-uv@v7
136-
with:
137-
enable-cache: true
138-
139-
- name: Install prek From Locked Dependencies
140-
run: uv sync --only-group pre-commit
141-
142-
- id: store-hashed-python-version
143-
name: Store Hashed Python Version
144-
run: echo "hashed_python_version=$(uv run -- python -VV | sha256sum | cut -d' ' -f1)"
145-
>> "$GITHUB_OUTPUT"
146-
147-
- uses: actions/cache@v5
148-
with:
149-
key: prek|${{steps.store-hashed-python-version.outputs.hashed_python_version}}|${{hashFiles('.pre-commit-config.yaml')}}
150-
path: ~/.cache/prek
151-
152-
- name: Setup pre-commit Environments
153-
run: uv run -- prek install-hooks
154-
155-
- name: Run prek
156-
run: |
157-
set -o pipefail
158-
if [[ "${{github.event_name}}" == "push" && "${{github.ref_name}}" == "${{github.event.repository.default_branch}}" ]]; then
159-
uv run -- prek run --all-files --hook-stage manual --color never --skip ruff-check --skip uv-lock --skip gitlint-ci | tee /tmp/prek.log
160-
else
161-
uv run -- prek run --all-files --hook-stage manual --color never --skip ruff-check --skip uv-lock | tee /tmp/prek.log
162-
fi
163-
164-
- name: Ensure No Warnings
165-
run: "if grep -q '^warning: ' /tmp/prek.log; then exit 1; fi"
166-
167-
- if: ${{!cancelled()}}
168-
uses: pre-commit-ci/lite-action@v1.1.0
116+
uses: ./.github/workflows/autofix-pre-commit.yaml
117+
with:
118+
skip-autofix: true
169119

170120
pymarkdown: # yamllint disable-line rule:key-ordering
171121
env:
@@ -183,7 +133,7 @@ jobs:
183133
python-version-file: .python-version
184134

185135
- name: Install uv
186-
uses: astral-sh/setup-uv@v7
136+
uses: astral-sh/setup-uv@v8.1.0
187137
with:
188138
enable-cache: true
189139

@@ -212,7 +162,7 @@ jobs:
212162
python-version-file: .python-version
213163

214164
- name: Install uv
215-
uses: astral-sh/setup-uv@v7
165+
uses: astral-sh/setup-uv@v8.1.0
216166
with:
217167
enable-cache: true
218168

@@ -240,7 +190,7 @@ jobs:
240190

241191
- if: ${{!cancelled()}}
242192
name: Upload coverage report to Codecov
243-
uses: codecov/codecov-action@v5
193+
uses: codecov/codecov-action@v6
244194
with:
245195
use_oidc: true
246196

@@ -260,7 +210,7 @@ jobs:
260210
python-version-file: .python-version
261211

262212
- name: Install uv
263-
uses: astral-sh/setup-uv@v7
213+
uses: astral-sh/setup-uv@v8.1.0
264214
with:
265215
enable-cache: true
266216

@@ -289,26 +239,26 @@ jobs:
289239
== 'CSSUoB/TeX-Bot-Py-V2'
290240
needs: [mypy, pre-commit, pymarkdown, pytest, ruff-lint, uv-check]
291241
permissions:
242+
artifact-metadata: write
292243
attestations: write
293-
contents: read
294244
id-token: write
295245
packages: write
296246
runs-on: ubuntu-latest
297247

298248
steps:
299249
- name: Log in to the Container registry
300-
uses: docker/login-action@v3.7.0
250+
uses: docker/login-action@v4.1.0
301251
with:
302252
password: ${{secrets.GITHUB_TOKEN}}
303253
registry: ${{env.REGISTRY}}
304254
username: ${{github.actor}}
305255

306256
- name: Set up Docker Buildx
307-
uses: docker/setup-buildx-action@v3
257+
uses: docker/setup-buildx-action@v4
308258

309259
- id: docker-extract-metadata
310260
name: Extract metadata (tags, labels) for Docker
311-
uses: docker/metadata-action@v5.10.0
261+
uses: docker/metadata-action@v6.0.0
312262
with:
313263
images: ${{env.REGISTRY}}/${{env.IMAGE_NAME}}
314264
tags: |-
@@ -320,14 +270,14 @@ jobs:
320270
321271
- id: build-and-publish
322272
name: Build and Publish
323-
uses: docker/build-push-action@v6
273+
uses: docker/build-push-action@v7
324274
with:
325275
labels: ${{steps.docker-extract-metadata.outputs.labels}}
326276
push: true
327277
tags: ${{steps.docker-extract-metadata.outputs.tags}}
328278

329279
- name: Generate Artifact Attestation
330-
uses: actions/attest-build-provenance@v3
280+
uses: actions/attest-build-provenance@v4
331281
with:
332282
push-to-registry: true
333283
subject-digest: ${{steps.build-and-publish.outputs.digest}}

‎.github/workflows/pr-auto-updater.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
steps:
1414
- id: generate-token
1515
name: Generate Access Token
16-
uses: actions/create-github-app-token@v2
16+
uses: actions/create-github-app-token@v3
1717
with:
1818
app-id: ${{vars.PR_AUTO_UPDATE_CLIENT_ID}}
1919
private-key: ${{secrets.PR_AUTO_UPDATE_PRIVATE_KEY}}

‎.github/workflows/prevent-migrations-deletion.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212

1313
steps:
1414
- name: Prevent migrations files being changed or deleted
15-
uses: xalvarez/prevent-file-change-action@v3.0.0
15+
uses: xalvarez/prevent-file-change-action@v3.0.1
1616
with:
1717
allowNewFiles: true
1818
githubToken: ${{secrets.GITHUB_TOKEN}}

‎.pre-commit-config.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,23 +5,23 @@ default_stages: [pre-commit, pre-merge-commit, manual]
55

66
repos:
77
- repo: https://github.com/astral-sh/uv-pre-commit
8-
rev: 0.10.3
8+
rev: 0.11.13
99
hooks:
1010
- id: uv-lock
1111
always_run: true
1212

1313
- repo: https://github.com/gitleaks/gitleaks
14-
rev: v8.30.0
14+
rev: v8.30.1
1515
hooks:
1616
- id: gitleaks
1717

1818
- repo: https://github.com/codespell-project/codespell
19-
rev: v2.4.1
19+
rev: v2.4.2
2020
hooks:
2121
- id: codespell
2222

2323
- repo: https://github.com/tombi-toml/tombi-pre-commit
24-
rev: v0.7.29
24+
rev: v0.11.2
2525
hooks:
2626
- id: tombi-format
2727
- id: tombi-lint
@@ -32,7 +32,7 @@ repos:
3232
- id: sync-with-uv
3333

3434
- repo: https://github.com/rhysd/actionlint
35-
rev: v1.7.11
35+
rev: v1.7.12
3636
hooks:
3737
- id: actionlint
3838
additional_dependencies: [github.com/wasilibs/go-shellcheck/cmd/shellcheck@latest] # yamllint disable-line rule:key-ordering
@@ -56,14 +56,14 @@ repos:
5656
args: [--strict]
5757

5858
- repo: https://github.com/renovatebot/pre-commit-hooks
59-
rev: 43.19.2
59+
rev: 43.150.0
6060
hooks:
6161
- id: renovate-config-validator
6262
args: [--strict]
6363
stages: [manual]
6464

6565
- repo: https://github.com/python-jsonschema/check-jsonschema
66-
rev: 0.36.2
66+
rev: 0.37.2
6767
hooks:
6868
- id: check-jsonschema
6969
args: [--schemafile, 'https://json.schemastore.org/yamllint.json'] # yamllint disable-line rule:quoted-strings
@@ -116,7 +116,7 @@ repos:
116116
args: [--autofix]
117117

118118
- repo: https://github.com/astral-sh/ruff-pre-commit
119-
rev: v0.15.1
119+
rev: v0.15.12
120120
hooks:
121121
- id: ruff-check
122122
args: [--fix]

‎Dockerfile‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,17 @@ COPY cogs/ /app/cogs/
2222

2323
FROM python:3.13-slim-trixie
2424

25+
RUN groupadd --system --gid 999 nonroot && useradd --system --gid 999 --uid 999 --create-home nonroot
26+
2527
LABEL org.opencontainers.image.source=https://github.com/CSSUoB/TeX-Bot-Py-V2
2628
LABEL org.opencontainers.image.licenses=Apache-2.0
2729

28-
COPY --from=builder --chown=app:app /app /app
30+
COPY --from=builder --chown=nonroot:nonroot /app /app
2931

3032
ENV LANG=C.UTF-8 PATH="/app/.venv/bin:$PATH"
3133

3234
WORKDIR /app
3335

36+
USER nonroot
37+
3438
ENTRYPOINT ["python", "-m", "main"]

0 commit comments

Comments
 (0)