Skip to content

Commit b292083

Browse files
BDonnotBDonnot
authored
Merge pull request #763 from Grid2op/lfe_fix
Improve compliance with LFE requirements
2 parents f83fc3a + b4229a3 commit b292083

61 files changed

Lines changed: 3085 additions & 337 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.circleci/config.yml‎

Lines changed: 257 additions & 66 deletions
Large diffs are not rendered by default.

‎.coveragerc‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
[report]
2+
exclude_lines =
3+
pragma: no cover
4+
def __repr__
5+
if self.debug:
6+
if settings.DEBUG
7+
raise AssertionError
8+
raise NotImplementedError
9+
if 0:
10+
if __name__ == .__main__.:
11+
import
12+
omit =
13+
# omit anything in a .local directory anywhere
14+
*/.local/*
15+
grid2op/data/*
16+
grid2op/data_test/*
17+
grid2op/data_grid2op/*
18+
# omit this single file
19+
grid2op/tests/*test*.py
20+
grid2op/tests/*BaseBackendTest.py
21+
grid2op/tests/*BaseRedispTest.py
22+
*__init__.py
23+
*config.py
24+
dtypes.py
25+
26+
[run]
27+
exclude_lines =
28+
pragma: no cover
29+
def __repr__
30+
if self.debug:
31+
if settings.DEBUG
32+
raise AssertionError
33+
raise NotImplementedError
34+
if 0:
35+
if __name__ == .__main__.:
36+
import
37+
omit =
38+
# omit anything in a .local directory anywhere
39+
*/.local/*
40+
# omit everything in /usr
41+
/usr/*
42+
grid2op/data/*
43+
grid2op/data_test/*
44+
grid2op/data_grid2op/*
45+
# omit this single file
46+
grid2op/tests/*test*.py
47+
grid2op/tests/*BaseBackendTest.py
48+
grid2op/tests/*BaseRedispTest.py
49+
*__init__.py
50+
51+
[coverage:report]
52+
ignore_errors = True

‎.github/workflows/main.yml‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,13 @@ on:
77
tags:
88
- 'v*.*.*'
99

10+
permissions: {} # deny all by default
11+
1012
jobs:
1113
manylinux_build:
1214
name: Build linux ${{ matrix.python.name }} wheel
15+
permissions:
16+
contents: read
1317
runs-on: ubuntu-latest
1418
container: quay.io/pypa/manylinux_2_28_x86_64
1519
env:
@@ -18,11 +22,11 @@ jobs:
1822
strategy:
1923
matrix:
2024
python:
21-
- {
22-
name: cp38,
23-
abi: cp38,
24-
version: '3.8',
25-
}
25+
# - {
26+
# name: cp38,
27+
# abi: cp38,
28+
# version: '3.8',
29+
# }
2630
- {
2731
name: cp39,
2832
abi: cp39,
@@ -122,6 +126,8 @@ jobs:
122126

123127
macos_windows_build:
124128
name: Build ${{ matrix.config.name }} ${{ matrix.python.name }} wheel
129+
permissions:
130+
contents: read
125131
runs-on: ${{ matrix.config.os }}
126132
strategy:
127133
matrix:
@@ -135,10 +141,10 @@ jobs:
135141
os: windows-2022,
136142
}
137143
python:
138-
- {
139-
name: cp38,
140-
version: '3.8',
141-
}
144+
# - {
145+
# name: cp38,
146+
# version: '3.8',
147+
# }
142148
- {
143149
name: cp39,
144150
version: '3.9',
@@ -215,6 +221,8 @@ jobs:
215221

216222
source_build:
217223
name: Build tar.gz grid2op file on ${{ matrix.config.name}}
224+
permissions:
225+
contents: read
218226
runs-on: ${{ matrix.config.os }}
219227
strategy:
220228
matrix:
@@ -271,6 +279,8 @@ jobs:
271279

272280
auto_class_in_file:
273281
name: Test ${{ matrix.config.name }} OS can handle automatic class generation for python ${{matrix.python.version}}
282+
permissions:
283+
contents: read
274284
runs-on: ${{ matrix.config.os }}
275285
strategy:
276286
matrix:

‎.github/workflows/release.yml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
name: Publish to PyPI
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*" # triggers on v1.12.3, v2.0.0, etc.
7+
8+
# Least privilege by default: every job gets read-only contents and nothing
9+
# else. The publish job re-declares the extra scopes it actually needs.
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
build:
15+
name: Build distribution
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
19+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # 6.2.0
20+
with:
21+
python-version: "3.12"
22+
- name: Install build
23+
run: pip install build
24+
- name: Build sdist and wheel
25+
run: python -m build
26+
- name: Upload build artifacts
27+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # 7.0.1
28+
with:
29+
name: dist
30+
path: dist/
31+
32+
sbom:
33+
name: Generate SBOM
34+
needs: build
35+
runs-on: ubuntu-latest
36+
steps:
37+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
38+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # 6.2.0
39+
with:
40+
python-version: "3.12"
41+
- name: Download build artifacts
42+
uses: actions/download-artifact@ad191675b41f6a5b46da9a048cb6893812da158b # 8.0.1
43+
with:
44+
name: dist
45+
path: dist/
46+
- name: Generate SBOM (Python dependencies)
47+
run: |
48+
# Install the freshly built wheel into an ISOLATED venv so the SBOM
49+
# captures only the package's own resolved dependencies, and not the
50+
# SBOM tool itself or anything else present on the runner.
51+
python -m venv .sbom-venv
52+
.sbom-venv/bin/pip install --upgrade pip
53+
.sbom-venv/bin/pip install dist/*.whl
54+
55+
# Install cyclonedx-bom in the runner's default environment and point
56+
# it at the isolated venv's interpreter. Because the tool lives in a
57+
# different environment than the one being scanned, it never appears
58+
# as a component in the generated bill of materials.
59+
pip install cyclonedx-bom
60+
61+
TAG="${GITHUB_REF_NAME}" # e.g. v1.12.3
62+
PKG="${GITHUB_REPOSITORY##*/}" # e.g. grid2op
63+
cyclonedx-py environment .sbom-venv/bin/python \
64+
--output-format json \
65+
--outfile "${PKG}-${TAG}-sbom.cdx.json"
66+
- name: Upload SBOM artifact
67+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # 7.0.1
68+
with:
69+
name: sbom
70+
path: "*-sbom.cdx.json"
71+
72+
publish:
73+
name: Publish to PyPI
74+
needs: [build, sbom]
75+
runs-on: ubuntu-latest
76+
environment: pypi # must match the environment name from the Trusted Publisher config
77+
permissions:
78+
contents: write # needed to attach assets to the GitHub Release
79+
id-token: write # needed for OIDC trusted publishing + Sigstore
80+
steps:
81+
- name: Download build artifacts
82+
uses: actions/download-artifact@ad191675b41f6a5b46da9a048cb6893812da158b # 8.0.1
83+
with:
84+
name: dist
85+
path: dist/
86+
- name: Download SBOM
87+
uses: actions/download-artifact@ad191675b41f6a5b46da9a048cb6893812da158b # 8.0.1
88+
with:
89+
name: sbom
90+
path: sbom/
91+
- name: Publish to PyPI (with Sigstore attestations)
92+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
93+
with:
94+
attestations: true # this is what triggers Sigstore signing
95+
- name: Attach SBOM to GitHub Release
96+
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
97+
with:
98+
files: sbom/*-sbom.cdx.json

‎.github/workflows/security.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Security checks
2+
3+
on: [push, pull_request]
4+
5+
jobs:
6+
detect-secrets:
7+
runs-on: ubuntu-latest
8+
permissions:
9+
contents: read
10+
steps:
11+
- uses: actions/checkout@v4
12+
- uses: actions/setup-python@v5
13+
with:
14+
python-version: '3.11'
15+
- run: pip install detect-secrets
16+
- run: detect-secrets scan --baseline .secrets.baseline

‎.gitignore‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,8 +123,13 @@ celerybeat-schedule
123123
# pipenv
124124
Pipfile.lock
125125

126-
# dotenv
126+
# dotenv, secrets etc.
127127
.env
128+
.env.*
129+
*.key
130+
*.pem
131+
*.p12
132+
*.pfx
128133

129134
# virtualenv
130135
venv/
@@ -437,6 +442,12 @@ saved_setup.cfg
437442
saved_setup.py
438443
requirements_pp2.txt
439444
requirements_pp3.txt
445+
Grid2Op-*.tar.gz
446+
*-py3-none-any.whl
447+
grid2op/data/**/__init__.py
448+
grid2op/tests/aux_test_baseAction_extended.py
449+
release_digests.json
450+
440451

441452
# profiling files
442453
**.prof

‎.mailmap‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Canonical name <canonical email> <commit email>
2+
Benjamin DONNOT <benjamin.donnot@rte-france.com>
3+
BDonnot <benjamin.donnot@gmail.com>
4+
Eva BOGUSLAWSKI <eva.boguslawski@gmail.com>
5+
Xavier WEISS <xavierw@kth.se>

‎.pre-commit-config.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
repos:
2+
- repo: https://github.com/Yelp/detect-secrets
3+
rev: 68e8b45440415753fff70a312ece8da92ba85b4a # v1.5.0 # latest stable on 2026-05-20
4+
hooks:
5+
- id: detect-secrets
6+
args: ['--baseline', '.secrets.baseline']
7+
exclude: package.lock.json
8+
stages: [pre-commit]
9+
10+
- repo: https://github.com/jumanjihouse/pre-commit-hooks
11+
rev: 3.0.0
12+
hooks:
13+
- id: check-mailmap
14+
stages: [pre-commit]
15+
16+
- repo: local
17+
hooks:
18+
- id: dco-signoff
19+
name: DCO Signed-off-by check
20+
language: python
21+
entry: python scripts/check_dco_msg.py
22+
stages: [commit-msg]

0 commit comments

Comments
 (0)