Skip to content

Commit 7b5f220

Browse files
saquibsaifeesaquibsaifee
authored
Merge branch 'main' into implement-fix-for-validation-error-messages
2 parents 8a6efce + 0daf3f9 commit 7b5f220

38 files changed

Lines changed: 731 additions & 101 deletions

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ provide the required disclosure, your PR will not be merged.
2424
<!-- ✍️-->
2525
A clear and concise summary of the change and which issue (if any) it fixes. Should also include relevant motivation and context.
2626

27-
Resolves or fixes issue: <!-- ✍️ Add GitHub issue number in format `#0000` or `none` -->
27+
Resolves or fixes issue: <!-- ✍️ Add GitHub issue number in format `#0000` - if there is none fitting, create one -->
2828

2929
### AI Tool Disclosure
3030

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ updates:
77
schedule:
88
interval: 'weekly'
99
day: 'saturday'
10+
cooldown:
11+
default-days: 7
1012
allow:
1113
- dependency-type: 'all'
1214
versioning-strategy: 'auto'
@@ -21,6 +23,8 @@ updates:
2123
schedule:
2224
interval: 'weekly'
2325
day: 'saturday'
26+
cooldown:
27+
default-days: 7
2428
labels: [ 'dependencies' ]
2529
commit-message:
2630
## prefix maximum string length of 15

‎.github/workflows/python.yml‎

Lines changed: 39 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -33,16 +33,18 @@ jobs:
3333
steps:
3434
- name: Checkout
3535
# see https://github.com/actions/checkout
36-
uses: actions/checkout@v6
36+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
37+
with:
38+
persist-credentials: false
3739
- name: Setup Python Environment
3840
# see https://github.com/actions/setup-python
39-
uses: actions/setup-python@v6
41+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
4042
with:
4143
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
4244
architecture: 'x64'
4345
- name: Install poetry
4446
# see https://github.com/marketplace/actions/setup-poetry
45-
uses: Gr1N/setup-poetry@v9
47+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
4648
with:
4749
poetry-version: ${{ env.POETRY_VERSION }}
4850
- name: Install dependencies
@@ -57,16 +59,18 @@ jobs:
5759
steps:
5860
- name: Checkout
5961
# see https://github.com/actions/checkout
60-
uses: actions/checkout@v6
62+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
63+
with:
64+
persist-credentials: false
6165
- name: Setup Python Environment
6266
# see https://github.com/actions/setup-python
63-
uses: actions/setup-python@v6
67+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
6468
with:
6569
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
6670
architecture: 'x64'
6771
- name: Install poetry
6872
# see https://github.com/marketplace/actions/setup-poetry
69-
uses: Gr1N/setup-poetry@v9
73+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
7074
with:
7175
poetry-version: ${{ env.POETRY_VERSION }}
7276
- name: Install dependencies
@@ -81,16 +85,18 @@ jobs:
8185
steps:
8286
- name: Checkout
8387
# see https://github.com/actions/checkout
84-
uses: actions/checkout@v6
88+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
89+
with:
90+
persist-credentials: false
8591
- name: Setup Python Environment
8692
# see https://github.com/actions/setup-python
87-
uses: actions/setup-python@v6
93+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
8894
with:
8995
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
9096
architecture: 'x64'
9197
- name: Install poetry
9298
# see https://github.com/marketplace/actions/setup-poetry
93-
uses: Gr1N/setup-poetry@v9
99+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
94100
with:
95101
poetry-version: ${{ env.POETRY_VERSION }}
96102
- name: Install dependencies
@@ -105,16 +111,18 @@ jobs:
105111
steps:
106112
- name: Checkout
107113
# see https://github.com/actions/checkout
108-
uses: actions/checkout@v6
114+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
115+
with:
116+
persist-credentials: false
109117
- name: Setup Python Environment
110118
# see https://github.com/actions/setup-python
111-
uses: actions/setup-python@v6
119+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
112120
with:
113121
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
114122
architecture: 'x64'
115123
- name: Install poetry
116124
# see https://github.com/marketplace/actions/setup-poetry
117-
uses: Gr1N/setup-poetry@v9
125+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
118126
with:
119127
poetry-version: ${{ env.POETRY_VERSION }}
120128
- name: Install dependencies
@@ -141,16 +149,18 @@ jobs:
141149
steps:
142150
- name: Checkout
143151
# see https://github.com/actions/checkout
144-
uses: actions/checkout@v6
152+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
153+
with:
154+
persist-credentials: false
145155
- name: Setup Python Environment
146156
# see https://github.com/actions/setup-python
147-
uses: actions/setup-python@v6
157+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
148158
with:
149159
python-version: ${{ matrix.python-version }}
150160
architecture: 'x64'
151161
- name: Install poetry
152162
# see https://github.com/marketplace/actions/setup-poetry
153-
uses: Gr1N/setup-poetry@v9
163+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
154164
with:
155165
poetry-version: ${{ env.POETRY_VERSION }}
156166
- name: Install dependencies
@@ -191,12 +201,14 @@ jobs:
191201
git config --global core.eol lf
192202
- name: Checkout
193203
# see https://github.com/actions/checkout
194-
uses: actions/checkout@v6
204+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
205+
with:
206+
persist-credentials: false
195207
- name: Create reports directory
196208
run: mkdir ${{ env.REPORTS_DIR }}
197209
- name: Setup Python Environment
198210
# see https://github.com/actions/setup-python
199-
uses: actions/setup-python@v6
211+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
200212
with:
201213
python-version: ${{ matrix.python-version }}
202214
architecture: 'x64'
@@ -207,7 +219,7 @@ jobs:
207219
print('Python %s on %s in %s' % (sys.version, sys.platform, sys.getdefaultencoding()))
208220
- name: Install poetry
209221
# see https://github.com/marketplace/actions/setup-poetry
210-
uses: Gr1N/setup-poetry@v9
222+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
211223
with:
212224
poetry-version: ${{ env.POETRY_VERSION }}
213225
- name: Install dependencies
@@ -226,7 +238,7 @@ jobs:
226238
- name: Artifact reports
227239
if: ${{ ! cancelled() }}
228240
# see https://github.com/actions/upload-artifact
229-
uses: actions/upload-artifact@v6
241+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
230242
with:
231243
name: ${{ env.TESTS_REPORTS_ARTIFACT }}-${{ matrix.os }}-py${{ matrix.python-version }}${{ matrix.toxenv-factors }}
232244
path: ${{ env.REPORTS_DIR }}
@@ -236,11 +248,11 @@ jobs:
236248
name: Publish test coverage
237249
needs: [ "build-and-test" ]
238250
runs-on: ubuntu-latest
239-
timeout-minutes: 5
251+
timeout-minutes: 10
240252
steps:
241253
- name: fetch test artifacts
242254
# see https://github.com/actions/download-artifact
243-
uses: actions/download-artifact@v7
255+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
244256
with:
245257
path: ${{ env.REPORTS_DIR }}
246258
pattern: ${{ env.TESTS_REPORTS_ARTIFACT }}-*
@@ -250,7 +262,7 @@ jobs:
250262
CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
251263
if: ${{ env.CODACY_PROJECT_TOKEN != '' }} ## see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
252264
# see https://github.com/codacy/codacy-coverage-reporter-action
253-
uses: codacy/codacy-coverage-reporter-action@v1
265+
uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1
254266
with:
255267
project-token: ${{ env.CODACY_PROJECT_TOKEN }}
256268
coverage-reports: ${{ env.REPORTS_DIR }}/coverage/*
@@ -269,10 +281,12 @@ jobs:
269281
steps:
270282
- name: Checkout
271283
# see https://github.com/actions/checkout
272-
uses: actions/checkout@v6
284+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
285+
with:
286+
persist-credentials: false
273287
- name: Setup Python Environment
274288
# see https://github.com/actions/setup-python
275-
uses: actions/setup-python@v6
289+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
276290
with:
277291
python-version: '>=3.9 <=3.14' # supported version range
278292
- name: Validate Python Environment
@@ -282,7 +296,7 @@ jobs:
282296
print('Python %s on %s in %s' % (sys.version, sys.platform, sys.getdefaultencoding()))
283297
- name: Install poetry
284298
# see https://github.com/marketplace/actions/setup-poetry
285-
uses: Gr1N/setup-poetry@v9
299+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
286300
with:
287301
poetry-version: ${{ env.POETRY_VERSION }}
288302
- name: Install package and prod dependencies

‎.github/workflows/release.yml‎

Lines changed: 39 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -48,16 +48,18 @@ jobs:
4848
steps:
4949
- name: Checkout code
5050
# see https://github.com/actions/checkout
51-
uses: actions/checkout@v6
51+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
52+
with:
53+
persist-credentials: false
5254
- name: Setup Python Environment
5355
# see https://github.com/actions/setup-python
54-
uses: actions/setup-python@v6
56+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
5557
with:
5658
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
5759
architecture: 'x64'
5860
- name: Install poetry
5961
# see https://github.com/marketplace/actions/setup-poetry
60-
uses: Gr1N/setup-poetry@v9
62+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
6163
with:
6264
poetry-version: ${{ env.POETRY_VERSION }}
6365
- name: Install dependencies
@@ -70,16 +72,18 @@ jobs:
7072
steps:
7173
- name: Checkout code
7274
# see https://github.com/actions/checkout
73-
uses: actions/checkout@v6
75+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
76+
with:
77+
persist-credentials: false
7478
- name: Setup Python Environment
7579
# see https://github.com/actions/setup-python
76-
uses: actions/setup-python@v6
80+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
7781
with:
7882
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
7983
architecture: 'x64'
8084
- name: Install poetry
8185
# see https://github.com/marketplace/actions/setup-poetry
82-
uses: Gr1N/setup-poetry@v9
86+
uses: Gr1N/setup-poetry@48b0f77c8c1b1b19cb962f0f00dff7b4be8f81ec # v9
8387
with:
8488
poetry-version: ${{ env.POETRY_VERSION }}
8589
- name: Install dependencies
@@ -103,21 +107,40 @@ jobs:
103107
id-token: write
104108
contents: write
105109
steps:
110+
- name: Generate GitHub App Token
111+
id: release-bot-token
112+
# see https://github.com/actions/create-github-app-token
113+
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3
114+
with:
115+
# see https://github.com/organizations/CycloneDX/settings/apps/cyclonedx-releases
116+
client-id: 3335294
117+
private-key: ${{ secrets.CDX_RELEASE_BOT_PRIVATE_KEY }}
118+
# for `permission-*` see `permissions` above
119+
permission-contents: write
120+
- name: Get GitHub App User ID
121+
id: release-bot-user-id
122+
env:
123+
APP_SLUG: ${{ steps.release-bot-token.outputs.app-slug }}
124+
GH_TOKEN: ${{ steps.release-bot-token.outputs.token }}
125+
run: echo "user-id=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
126+
106127
- name: Checkout code
107128
# see https://github.com/actions/checkout
108-
uses: actions/checkout@v6
129+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
109130
with:
110131
fetch-depth: 0
132+
token: ${{ steps.release-bot-token.outputs.token }}
133+
persist-credentials: false
111134

112135
- name: Setup python
113136
# see https://github.com/actions/setup-python
114-
uses: actions/setup-python@v6
137+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
115138
with:
116139
python-version: ${{ env.PYTHON_VERSION_DEFAULT }}
117140
architecture: 'x64'
118141
- name: Install and configure Poetry
119142
# See https://github.com/marketplace/actions/install-poetry-action
120-
uses: snok/install-poetry@v1
143+
uses: snok/install-poetry@76e04a911780d5b312d89783f7b1cd627778900a # v1
121144
with:
122145
version: ${{ env.POETRY_VERSION }}
123146
virtualenvs-create: true
@@ -132,24 +155,26 @@ jobs:
132155
id: release
133156
# see https://python-semantic-release.readthedocs.io/en/latest/automatic-releases/github-actions.html
134157
# see https://github.com/python-semantic-release/python-semantic-release
135-
uses: python-semantic-release/python-semantic-release@v10.0.2
158+
uses: python-semantic-release/python-semantic-release@1a324000f2251a9e722e77b128bf72712653813f # v10.0.2
136159
with:
137-
github_token: ${{ secrets.GITHUB_TOKEN }}
160+
git_committer_name: ${{ steps.release-bot-token.outputs.app-slug }}[bot]
161+
git_committer_email: ${{ steps.release-bot-user-id.outputs.user-id }}+${{ steps.release-bot-token.outputs.app-slug }}[bot]@users.noreply.github.com
162+
github_token: ${{ steps.release-bot-token.outputs.token }}
138163
force: ${{ github.event.inputs.release_force }}
139164
prerelease: ${{ github.event.inputs.prerelease }}
140165
prerelease_token: ${{ github.event.inputs.prerelease_token }}
141166

142167
- name: Publish package distributions to PyPI
143168
if: steps.release.outputs.released == 'true'
144169
# see https://github.com/pypa/gh-action-pypi-publish
145-
uses: pypa/gh-action-pypi-publish@release/v1
170+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
146171
with:
147172
attestations: true
148173

149174
- name: Publish package distributions to GitHub Releases
150175
if: steps.release.outputs.released == 'true'
151176
# see https://python-semantic-release.readthedocs.io/en/latest/automatic-releases/github-actions.html#python-semantic-release-publish-action
152-
uses: python-semantic-release/publish-action@v10
177+
uses: python-semantic-release/publish-action@310a9983a0ae878b29f3aac778d7c77c1db27378 # v10
153178
with:
154-
github_token: ${{ secrets.GITHUB_TOKEN }}
179+
github_token: ${{ steps.release-bot-token.outputs.token }}
155180
tag: ${{ steps.release.outputs.tag }}

‎.github/workflows/zizmor.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Analyzes all GitHub Actions workflows for security issues using zizmor.
2+
# docs: https://docs.zizmor.sh/
3+
name: Workflow Security Analysis (zizmor)
4+
5+
on:
6+
pull_request:
7+
paths:
8+
- ".github/workflows/**"
9+
push:
10+
paths:
11+
- ".github/workflows/**"
12+
schedule:
13+
# Every Saturday at 00:00 UTC
14+
- cron: "0 0 * * 6"
15+
16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: true
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
zizmor:
25+
name: zizmor
26+
runs-on: ubuntu-latest
27+
timeout-minutes: 10
28+
steps:
29+
- name: Checkout
30+
# see https://github.com/actions/checkout
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
32+
with:
33+
persist-credentials: false
34+
- name: Run zizmor
35+
# see https://github.com/zizmorcore/zizmor-action
36+
uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
37+
with:
38+
# advanced-security: false => emit findings as workflow-command annotations (::error file=…) rather than
39+
# uploading a SARIF report to GitHub's Security tab.
40+
# Uploading SARIF requires `security-events: write` and GitHub Advanced Security (GHAS),
41+
# both of which are unnecessary here and would violate the least-privilege policy.
42+
# The two modes are mutually exclusive: advanced-security must be false for
43+
# annotations to take effect.
44+
advanced-security: false
45+
annotations: true

‎.pre-commit-config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,7 @@ repos:
4242
entry: poetry run -- tox r -e bandit
4343
pass_filenames: false
4444
language: system
45+
- repo: https://github.com/zizmorcore/zizmor-pre-commit
46+
rev: v1.24.1
47+
hooks:
48+
- id: zizmor

0 commit comments

Comments
 (0)