Skip to content

Commit 14b54d8

Browse files
FastLeeasnare
FastLee
and
asnare
authored
Fix/supply chain lockdown (#4739)
Based on https://gist.github.com/asnare/bd504345c1f70f9cfeecb038e6f9b9fe#3-lock-down-everything-else We locked down the UCX deployment and replaced hatch for uv. --------- Co-authored-by: Andrew Snare <andrew.snare@databricks.com>
1 parent 07cc1b4 commit 14b54d8

18 files changed

Lines changed: 1628 additions & 225 deletions

‎.build-constraints.txt‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
hatchling==1.29.0 \
2+
--hash=sha256:50af9343281f34785fab12da82e445ed987a6efb34fd8c2fc0f6e6630dbcc1b0 \
3+
--hash=sha256:793c31816d952cee405b83488ce001c719f325d9cda69f1fc4cd750527640ea6
4+
packaging==26.0 \
5+
--hash=sha256:00243ae351a257117b6a241061796684b084ed1c516a08c48a3f7e147a9d80b4 \
6+
--hash=sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529
7+
# via hatchling
8+
pathspec==1.0.4 \
9+
--hash=sha256:0210e2ae8a21a9137c0d470578cb0e595af87edaa6ebf12ff176f14a02e0e645 \
10+
--hash=sha256:fb6ae2fd4e7c921a165808a552060e722767cfa526f99ca5156ed2ce45a5c723
11+
# via hatchling
12+
pluggy==1.6.0 \
13+
--hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
14+
--hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
15+
# via hatchling
16+
tomli==2.4.1 ; python_full_version < '3.11' \
17+
--hash=sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853 \
18+
--hash=sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe \
19+
--hash=sha256:136443dbd7e1dee43c68ac2694fde36b2849865fa258d39bf822c10e8068eac5 \
20+
--hash=sha256:1d8591993e228b0c930c4bb0db464bdad97b3289fb981255d6c9a41aedc84b2d \
21+
--hash=sha256:2190f2e9dd7508d2a90ded5ed369255980a1bcdd58e52f7fe24b8162bf9fedbd \
22+
--hash=sha256:2c1c351919aca02858f740c6d33adea0c5deea37f9ecca1cc1ef9e884a619d26 \
23+
--hash=sha256:36d2bd2ad5fb9eaddba5226aa02c8ec3fa4f192631e347b3ed28186d43be6b54 \
24+
--hash=sha256:3d48a93ee1c9b79c04bb38772ee1b64dcf18ff43085896ea460ca8dec96f35f6 \
25+
--hash=sha256:47149d5bd38761ac8be13a84864bf0b7b70bc051806bc3669ab1cbc56216b23c \
26+
--hash=sha256:4ab97e64ccda8756376892c53a72bd1f964e519c77236368527f758fbc36a53a \
27+
--hash=sha256:4b605484e43cdc43f0954ddae319fb75f04cc10dd80d830540060ee7cd0243cd \
28+
--hash=sha256:504aa796fe0569bb43171066009ead363de03675276d2d121ac1a4572397870f \
29+
--hash=sha256:51529d40e3ca50046d7606fa99ce3956a617f9b36380da3b7f0dd3dd28e68cb5 \
30+
--hash=sha256:52c8ef851d9a240f11a88c003eacb03c31fc1c9c4ec64a99a0f922b93874fda9 \
31+
--hash=sha256:559db847dc486944896521f68d8190be1c9e719fced785720d2216fe7022b662 \
32+
--hash=sha256:5a881ab208c0baf688221f8cecc5401bd291d67e38a1ac884d6736cbcd8247e9 \
33+
--hash=sha256:5cb41aa38891e073ee49d55fbc7839cfdb2bc0e600add13874d048c94aadddd1 \
34+
--hash=sha256:5e262d41726bc187e69af7825504c933b6794dc3fbd5945e41a79bb14c31f585 \
35+
--hash=sha256:5ee18d9ebdb417e384b58fe414e8d6af9f4e7a0ae761519fb50f721de398dd4e \
36+
--hash=sha256:7008df2e7655c495dd12d2a4ad038ff878d4ca4b81fccaf82b714e07eae4402c \
37+
--hash=sha256:734e20b57ba95624ecf1841e72b53f6e186355e216e5412de414e3c51e5e3c41 \
38+
--hash=sha256:7c7e1a961a0b2f2472c1ac5b69affa0ae1132c39adcb67aba98568702b9cc23f \
39+
--hash=sha256:7f86fd587c4ed9dd76f318225e7d9b29cfc5a9d43de44e5754db8d1128487085 \
40+
--hash=sha256:7f94b27a62cfad8496c8d2513e1a222dd446f095fca8987fceef261225538a15 \
41+
--hash=sha256:88dceee75c2c63af144e456745e10101eb67361050196b0b6af5d717254dddf7 \
42+
--hash=sha256:8a650c2dbafa08d42e51ba0b62740dae4ecb9338eefa093aa5c78ceb546fcd5c \
43+
--hash=sha256:8d65a2fbf9d2f8352685bc1364177ee3923d6baf5e7f43ea4959d7d8bc326a36 \
44+
--hash=sha256:96481a5786729fd470164b47cdb3e0e58062a496f455ee41b4403be77cb5a076 \
45+
--hash=sha256:a120733b01c45e9a0c34aeef92bf0cf1d56cfe81ed9d47d562f9ed591a9828ac \
46+
--hash=sha256:b1d22e6e9387bf4739fbe23bfa80e93f6b0373a7f1b96c6227c32bef95a4d7a8 \
47+
--hash=sha256:b8c198f8c1805dc42708689ed6864951fd2494f924149d3e4bce7710f8eb5232 \
48+
--hash=sha256:c2541745709bad0264b7d4705ad453b76ccd191e64aa6f0fc66b69a293a45ece \
49+
--hash=sha256:c742f741d58a28940ce01d58f0ab2ea3ced8b12402f162f4d534dfe18ba1cd6a \
50+
--hash=sha256:c7f2c7f2b9ca6bdeef8f0fa897f8e05085923eb091721675170254cbc5b02897 \
51+
--hash=sha256:d312ef37c91508b0ab2cee7da26ec0b3ed2f03ce12bd87a588d771ae15dcf82d \
52+
--hash=sha256:d4d8fe59808a54658fcc0160ecfb1b30f9089906c50b23bcb4c69eddc19ec2b4 \
53+
--hash=sha256:da25dc3563bff5965356133435b757a795a17b17d01dbc0f42fb32447ddfd917 \
54+
--hash=sha256:eab21f45c7f66c13f2a9e0e1535309cee140182a9cdae1e041d02e47291e8396 \
55+
--hash=sha256:eb0dc4e38e6a1fd579e5d50369aa2e10acfc9cace504579b2faabb478e76941a \
56+
--hash=sha256:ec9bfaf3ad2df51ace80688143a6a4ebc09a248f6ff781a9945e51937008fcbc \
57+
--hash=sha256:ede3e6487c5ef5d28634ba3f31f989030ad6af71edfb0055cbbd14189ff240ba \
58+
--hash=sha256:f3c6818a1a86dd6dca7ddcaaf76947d5ba31aecc28cb1b67009a5877c9a64f3f \
59+
--hash=sha256:f758f1b9299d059cc3f6546ae2af89670cb1c4d48ea29c3cacc4fe7de3058257 \
60+
--hash=sha256:f8f0fc26ec2cc2b965b7a3b87cd19c5c6b8c5e5f436b984e85f486d652285c30 \
61+
--hash=sha256:fd0409a3653af6c147209d267a0e4243f0ae46b011aa978b1080359fddc9b6cf \
62+
--hash=sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9 \
63+
--hash=sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049
64+
# via hatchling
65+
trove-classifiers==2026.1.14.14 \
66+
--hash=sha256:00492545a1402b09d4858605ba190ea33243d361e2b01c9c296ce06b5c3325f3 \
67+
--hash=sha256:1f9553927f18d0513d8e5ff80ab8980b8202ce37ecae0e3274ed2ef11880e74d
68+
# via hatchling

‎.codegen.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@
33
"src/databricks/labs/ucx/__about__.py": "__version__ = \"$VERSION\""
44
},
55
"toolchain": {
6-
"required": ["python3", "hatch"],
7-
"pre_setup": ["hatch env create"],
6+
"required": ["make", "uv"],
7+
"pre_setup": ["make dev"],
88
"prepend_path": ".venv/bin",
99
"acceptance_path": "tests/integration",
1010
"test": [
11-
"pytest -n 4 --cov src --cov-report=xml --timeout 30 tests/unit --durations 20"
11+
"make test"
1212
]
1313
}
1414
}

‎.github/actions/jfrog-auth/action.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: 'Authenticate for JFrog'
2+
description: 'Authenticate with JFrog using OIDC based on the GitHub repository.'
3+
outputs:
4+
jfrog-access-token:
5+
description: "Access token for JFrog"
6+
value: "${{ steps.jfrog-auth.outputs.jfrog-access-token }}"
7+
runs:
8+
using: "composite"
9+
steps:
10+
- id: jfrog-auth
11+
name: Authenticate against JFrog
12+
shell: bash
13+
run: |
14+
"${GITHUB_ACTION_PATH}/jfrog-auth" "${ACTIONS_ID_TOKEN_REQUEST_URL}" "${ACTIONS_ID_TOKEN_REQUEST_TOKEN}"
15+
- id: detect-cmds
16+
name: Detecting python package/project managers.
17+
shell: bash
18+
run: |
19+
for cmd in pip3 uv
20+
do
21+
command -v "${cmd}" > /dev/null && found=true || found=false
22+
printf '::debug::%s\n' "Found ${cmd}: ${found}"
23+
printf '%s=%s\n' "command_${cmd}" "${found}" >> "${GITHUB_OUTPUT}"
24+
done
25+
- name: Configure pip for JFrog
26+
if: "${{ steps.detect-cmds.outputs.command_pip3 == 'true' }}"
27+
shell: bash
28+
env:
29+
JFROG_ACCESS_TOKEN: "${{ steps.jfrog-auth.outputs.jfrog-access-token }}"
30+
run: |
31+
umask 077
32+
cat > "$RUNNER_TEMP/.pip.conf" <<EOF
33+
[global]
34+
index-url = https://gha-service-account:${JFROG_ACCESS_TOKEN}@databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple
35+
EOF
36+
printf '%s=%s\n' 'PIP_CONFIG_FILE' "${RUNNER_TEMP}/.pip.conf" >> "${GITHUB_ENV}"
37+
- name: Configure uv for JFrog
38+
if: "${{ steps.detect-cmds.outputs.command_uv == 'true' }}"
39+
shell: bash
40+
env:
41+
JFROG_ACCESS_TOKEN: "${{ steps.jfrog-auth.outputs.jfrog-access-token }}"
42+
UV_INDEX_URL: 'https://databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple'
43+
run: |
44+
uv auth login "${UV_INDEX_URL}" --username gha-service-account --password "${JFROG_ACCESS_TOKEN}"
45+
printf "%s=%s\n" 'UV_INDEX_URL' "${UV_INDEX_URL}" >> "${GITHUB_ENV}"
46+
printf "%s=%s\n" 'UV_FROZEN' '1' >> "${GITHUB_ENV}"

‎.github/actions/jfrog-auth/jfrog-auth‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/bin/sh
2+
#
3+
# Obtain a JFrog access token, assuming GitHub OIDC.
4+
#
5+
set -eu
6+
7+
_request_url="$1"
8+
_request_token="$2"
9+
10+
#
11+
# Step 1: Obtain the OIDC identifier token from GitHub.
12+
#
13+
printf '::debug::%s\n' "Fetching OIDC identifier token from GitHub..."
14+
_id_token="$(curl -sLS \
15+
-H 'User-Agent: actions/oidc-client' \
16+
-H "Authorization: Bearer ${_request_token}" \
17+
"${_request_url}&audience=jfrog-github" |
18+
jq -r .value)"
19+
printf '::add-mask::%s\n' "${_id_token}"
20+
21+
#
22+
# Step 2: Exchange it for the JFrog access token.
23+
#
24+
printf '::debug::%s\n' "Exchanging OIDC identifier token for JFrog access token..."
25+
_access_token=$(curl -sLS \
26+
--json "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${_id_token}\", \"provider_name\": \"github-actions\"}" \
27+
"https://databricks.jfrog.io/access/api/v1/oidc/token" |
28+
jq -r .access_token)
29+
printf '::add-mask::%s\n' "${_access_token}"
30+
31+
if [ -z "${_access_token}" ] || [ "${_access_token}" = 'null' ]
32+
then
33+
printf '::error::%s\n' "Could not fetch JFrog access token."
34+
exit 1
35+
fi
36+
37+
printf '%s=%s\n' 'jfrog-access-token' "${_access_token}" >> "${GITHUB_OUTPUT}"

‎.github/dependabot.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
version: 2
22
updates:
3-
- package-ecosystem: "pip"
4-
directory: "/"
5-
schedule:
6-
interval: "daily"
7-
- package-ecosystem: "github-actions"
3+
- package-ecosystem: "uv"
84
directory: "/"
5+
cooldown:
6+
default-days: 7
7+
exclude:
8+
- "databricks*"
99
schedule:
1010
interval: "daily"

‎.github/workflows/acceptance.yml‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,7 @@ on:
1010
- main
1111

1212
permissions:
13-
id-token: write
1413
contents: read
15-
issues: write
16-
pull-requests: write
1714

1815
concurrency:
1916
group: ${{ github.workflow }}-${{ github.ref }}
@@ -23,22 +20,29 @@ jobs:
2320
integration:
2421
if: github.event_name == 'pull_request' && github.event.pull_request.draft == false
2522
environment: account-admin
26-
runs-on: larger
23+
runs-on:
24+
group: larger-runners
25+
labels: larger
26+
permissions:
27+
# Access to the integration testing infrastructure and JFrog package resolution.
28+
id-token: write
29+
# Write test results to the PR.
30+
issues: write
31+
pull-requests: write
2732
steps:
2833
- name: Checkout Code
2934
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3035
with:
3136
fetch-depth: 0
3237

33-
- name: Install Python
34-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
38+
- name: Setup uv
39+
uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
3540
with:
36-
cache: 'pip'
37-
cache-dependency-path: '**/pyproject.toml'
38-
python-version: '3.10'
41+
version: "0.11.2"
42+
checksum: "7ac2ca0449c8d68dae9b99e635cd3bc9b22a4cb1de64b7c43716398447d42981"
3943

40-
- name: Install hatch
41-
run: pip install hatch==1.9.4 'click<8.3.0' # https://github.com/pallets/click/issues/3065
44+
- name: Setup for JFrog
45+
uses: ./.github/actions/jfrog-auth
4246

4347
- name: Fetch relevant branches
4448
run: |

‎.github/workflows/docs-release.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
- 'v*'
77
workflow_dispatch: # Enables manual triggering of the workflow
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
build:
1114
name: Build Docusaurus

‎.github/workflows/nightly.yml‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,33 +6,36 @@ on:
66
- cron: '0 5 * * *'
77

88
permissions:
9-
id-token: write
10-
issues: write
119
contents: read
12-
pull-requests: read
1310

1411
concurrency:
1512
group: single-acceptance-job-per-repo
1613

1714
jobs:
1815
integration:
1916
environment: account-admin
20-
runs-on: larger
17+
runs-on:
18+
group: larger-runners
19+
labels: larger
20+
permissions:
21+
# Access to the integration testing infrastructure and JFrog package resolution.
22+
id-token: write
23+
# Create issues for nightly test failures.
24+
issues: write
2125
steps:
2226
- name: Checkout Code
2327
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2428
with:
2529
fetch-depth: 0
2630

27-
- name: Install Python
28-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
31+
- name: Setup uv
32+
uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
2933
with:
30-
cache: 'pip'
31-
cache-dependency-path: '**/pyproject.toml'
32-
python-version: '3.10'
34+
version: "0.11.2"
35+
checksum: "7ac2ca0449c8d68dae9b99e635cd3bc9b22a4cb1de64b7c43716398447d42981"
3336

34-
- name: Install hatch
35-
run: pip install hatch==1.9.4 'click<8.3.0' # https://github.com/pallets/click/issues/3065
37+
- name: Setup for JFrog
38+
uses: ./.github/actions/jfrog-auth
3639

3740
- name: Run nightly tests
3841
uses: databrickslabs/sandbox/acceptance@3313d06ce86227537b3f37f5974f7eecb2a8e59a # acceptance/v0.4.4

‎.github/workflows/no-cheat.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,14 @@ on:
1010
branches:
1111
- main
1212

13+
permissions:
14+
contents: read
15+
1316
jobs:
1417
no-pylint-disable:
15-
runs-on: ubuntu-latest
18+
runs-on:
19+
group: databrickslabs-protected-runner-group
20+
labels: linux-ubuntu-latest
1621
if: github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'synchronize')
1722
steps:
1823
- name: Checkout

‎.github/workflows/push.yml‎

Lines changed: 29 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,17 @@ on:
1414
branches:
1515
- main
1616

17-
env:
18-
HATCH_VERSION: 1.9.4
17+
permissions:
18+
contents: read
1919

2020
jobs:
2121
ci:
22-
runs-on: ubuntu-latest
22+
runs-on:
23+
group: databrickslabs-protected-runner-group
24+
labels: linux-ubuntu-latest
25+
permissions:
26+
# Authenticate with JFrog for package resolution.
27+
id-token: write
2328
strategy:
2429
fail-fast: false
2530
matrix:
@@ -30,41 +35,46 @@ jobs:
3035
with:
3136
fetch-depth: 0
3237

33-
- name: Install Python
34-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
38+
- name: Setup uv
39+
uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
3540
with:
36-
cache: 'pip'
37-
cache-dependency-path: '**/pyproject.toml'
38-
python-version: ${{ matrix.pyVersion }}
41+
version: "0.11.2"
42+
checksum: "7ac2ca0449c8d68dae9b99e635cd3bc9b22a4cb1de64b7c43716398447d42981"
3943

40-
- name: Install hatch
41-
run: pip install hatch==$HATCH_VERSION 'click<8.3.0' # https://github.com/pallets/click/issues/3065
44+
- name: Setup for JFrog
45+
uses: ./.github/actions/jfrog-auth
4246

4347
- name: Run unit tests
44-
run: hatch run test
48+
run: make test
49+
env:
50+
UV_PYTHON: ${{ matrix.pyVersion }}
4551

4652
- name: Publish test coverage
4753
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
4854
with:
4955
token: ${{ secrets.CODECOV_TOKEN }}
5056

5157
fmt:
52-
runs-on: ubuntu-latest
58+
runs-on:
59+
group: databrickslabs-protected-runner-group
60+
labels: linux-ubuntu-latest
61+
permissions:
62+
# Authenticate with JFrog for package resolution.
63+
id-token: write
5364
steps:
5465
- name: Checkout
5566
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
5667
with:
5768
fetch-depth: 0
5869

59-
- name: Install Python
60-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
70+
- name: Setup uv
71+
uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
6172
with:
62-
cache: 'pip'
63-
cache-dependency-path: '**/pyproject.toml'
64-
python-version: 3.10.x
73+
version: "0.11.2"
74+
checksum: "7ac2ca0449c8d68dae9b99e635cd3bc9b22a4cb1de64b7c43716398447d42981"
6575

66-
- name: Install hatch
67-
run: pip install hatch==$HATCH_VERSION 'click<8.3.0' # https://github.com/pallets/click/issues/3065
76+
- name: Setup for JFrog
77+
uses: ./.github/actions/jfrog-auth
6878

6979
- name: Reformat code
7080
run: make fmt

0 commit comments

Comments
 (0)