Skip to content

Commit b81c383

Browse files
dikshant-coderabbitdikshant-coderabbit
committed
add more changes
1 parent 1a6a0cd commit b81c383

11 files changed

Lines changed: 425 additions & 91 deletions

‎.github/dependabot.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
version: 2
2+
3+
updates:
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
groups:
10+
actions-minor:
11+
update-types:
12+
- "minor"
13+
- "patch"
14+
15+
- package-ecosystem: "pip"
16+
directory: "/"
17+
schedule:
18+
interval: "weekly"
19+
day: "monday"
20+
groups:
21+
python-minor:
22+
update-types:
23+
- "minor"
24+
- "patch"

‎.github/workflows/codeql.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [master, main]
6+
pull_request:
7+
branches: [master, main]
8+
schedule:
9+
- cron: "0 6 * * 1" # Every Monday at 06:00 UTC
10+
11+
permissions:
12+
security-events: write
13+
contents: read
14+
15+
concurrency:
16+
group: codeql-${{ github.event.pull_request.number || github.ref }}
17+
cancel-in-progress: true
18+
19+
jobs:
20+
analyze:
21+
name: Analyze Python
22+
runs-on: ubuntu-latest
23+
24+
steps:
25+
- name: Checkout code
26+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
27+
28+
- name: Initialize CodeQL
29+
uses: github/codeql-action/init@f5c2471be782132e47a6e6f9c725e56730d6e9a3 # v3
30+
with:
31+
languages: python
32+
queries: security-and-quality
33+
34+
- name: Autobuild
35+
uses: github/codeql-action/autobuild@f5c2471be782132e47a6e6f9c725e56730d6e9a3 # v3
36+
37+
- name: Perform CodeQL Analysis
38+
uses: github/codeql-action/analyze@f5c2471be782132e47a6e6f9c725e56730d6e9a3 # v3
39+
with:
40+
category: "/language:python"

‎.github/workflows/container-scan.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Container Scan
2+
3+
on:
4+
push:
5+
branches: [master, main]
6+
pull_request:
7+
branches: [master, main]
8+
schedule:
9+
- cron: "0 6 * * 3" # Every Wednesday at 06:00 UTC
10+
11+
permissions:
12+
security-events: write
13+
contents: read
14+
15+
concurrency:
16+
group: container-scan-${{ github.event.pull_request.number || github.ref }}
17+
cancel-in-progress: true
18+
19+
jobs:
20+
trivy:
21+
name: Trivy Image Scan
22+
runs-on: ubuntu-latest
23+
24+
steps:
25+
- name: Checkout code
26+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
27+
28+
- name: Build Docker image
29+
run: |
30+
docker build -t create-pull-request-python:scan .
31+
32+
- name: Run Trivy vulnerability scanner
33+
uses: aquasecurity/trivy-action@c1824fd6edce30d7ab345a9989de00bbd46ef284 # 0.34.0
34+
with:
35+
image-ref: "create-pull-request-python:scan"
36+
format: "sarif"
37+
output: "trivy-results.sarif"
38+
severity: "CRITICAL,HIGH"
39+
40+
- name: Upload Trivy scan results to GitHub Security
41+
uses: github/codeql-action/upload-sarif@f5c2471be782132e47a6e6f9c725e56730d6e9a3 # v3
42+
if: always()
43+
with:
44+
sarif_file: "trivy-results.sarif"

‎.github/workflows/integration-test.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,18 @@ permissions:
1111
contents: write
1212
pull-requests: write
1313

14+
concurrency:
15+
group: integration-${{ github.event.pull_request.number || github.ref }}
16+
cancel-in-progress: true
17+
1418
jobs:
1519
test-action:
1620
name: Test Action End-to-End
1721
runs-on: ubuntu-latest
1822

1923
steps:
2024
- name: Checkout code
21-
uses: actions/checkout@v4
25+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2226

2327
- name: Make test changes
2428
run: |
@@ -79,7 +83,7 @@ jobs:
7983

8084
steps:
8185
- name: Checkout code
82-
uses: actions/checkout@v4
86+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
8387

8488
- name: Run action without changes
8589
id: cpr
@@ -102,7 +106,7 @@ jobs:
102106

103107
steps:
104108
- name: Checkout code
105-
uses: actions/checkout@v4
109+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
106110

107111
- name: Build Docker image
108112
run: docker build -t cpr-test .

‎.github/workflows/release.yml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,12 @@ name: Release
33
on:
44
push:
55
tags:
6-
- 'v*'
6+
- "v*"
77

88
permissions:
99
contents: write
1010
packages: write
11+
id-token: write # Required for provenance attestations
1112

1213
jobs:
1314
build-and-release:
@@ -16,13 +17,13 @@ jobs:
1617

1718
steps:
1819
- name: Checkout code
19-
uses: actions/checkout@v4
20+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2021

2122
- name: Set up Docker Buildx
22-
uses: docker/setup-buildx-action@v3
23+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
2324

2425
- name: Log in to GitHub Container Registry
25-
uses: docker/login-action@v3
26+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
2627
with:
2728
registry: ghcr.io
2829
username: ${{ github.actor }}
@@ -33,25 +34,27 @@ jobs:
3334
run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
3435

3536
- name: Build and push Docker image
36-
uses: docker/build-push-action@v5
37+
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
3738
with:
3839
context: .
3940
push: true
41+
provenance: true
42+
sbom: true
4043
tags: |
4144
ghcr.io/${{ github.repository }}:${{ steps.version.outputs.VERSION }}
4245
ghcr.io/${{ github.repository }}:latest
4346
cache-from: type=gha
4447
cache-to: type=gha,mode=max
4548

4649
- name: Create GitHub Release
47-
uses: actions/create-release@v1
50+
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
4851
env:
4952
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5053
with:
5154
tag_name: ${{ github.ref }}
5255
release_name: Release ${{ steps.version.outputs.VERSION }}
5356
body: |
54-
## Create Pull Request Action - Python Port
57+
## Create Pull Request Action (Python)
5558
5659
Release ${{ steps.version.outputs.VERSION }}
5760
@@ -89,7 +92,7 @@ jobs:
8992

9093
steps:
9194
- name: Checkout code
92-
uses: actions/checkout@v4
95+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
9396

9497
- name: Extract major version
9598
id: major

‎.github/workflows/test.yml‎

Lines changed: 29 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,27 @@ on:
66
pull_request:
77
branches: [master, main]
88

9+
permissions:
10+
contents: read
11+
12+
concurrency:
13+
group: pr-${{ github.event.pull_request.number || github.ref }}
14+
cancel-in-progress: true
15+
916
jobs:
1017
unit-tests:
1118
name: Unit Tests
1219
runs-on: ubuntu-latest
1320
strategy:
1421
matrix:
15-
python-version: ['3.9', '3.10', '3.11']
22+
python-version: ["3.9", "3.10", "3.11"]
1623

1724
steps:
1825
- name: Checkout code
19-
uses: actions/checkout@v4
26+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2027

2128
- name: Set up Python ${{ matrix.python-version }}
22-
uses: actions/setup-python@v5
29+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
2330
with:
2431
python-version: ${{ matrix.python-version }}
2532

@@ -34,7 +41,7 @@ jobs:
3441
PYTHONPATH=src pytest tests/unit/ -v --cov=src/create_pull_request --cov-report=xml --cov-report=term
3542
3643
- name: Upload coverage to Codecov
37-
uses: codecov/codecov-action@v4
44+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
3845
if: matrix.python-version == '3.11'
3946
with:
4047
file: ./coverage.xml
@@ -47,12 +54,12 @@ jobs:
4754

4855
steps:
4956
- name: Checkout code
50-
uses: actions/checkout@v4
57+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
5158

5259
- name: Set up Python
53-
uses: actions/setup-python@v5
60+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
5461
with:
55-
python-version: '3.11'
62+
python-version: "3.11"
5663

5764
- name: Install dependencies
5865
run: |
@@ -75,18 +82,19 @@ jobs:
7582

7683
steps:
7784
- name: Checkout code
78-
uses: actions/checkout@v4
85+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
7986

8087
- name: Set up Docker Buildx
81-
uses: docker/setup-buildx-action@v3
88+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
8289

8390
- name: Build Docker image
8491
run: |
8592
docker build -t create-pull-request-python:test .
8693
87-
- name: Test Docker image
94+
- name: Verify Python module resolves
8895
run: |
89-
docker run --rm create-pull-request-python:test --help || true
96+
docker run --rm --entrypoint python create-pull-request-python:test \
97+
-c "from create_pull_request.main import run; print('Module import OK')"
9098
9199
- name: Check image size
92100
run: |
@@ -98,25 +106,30 @@ jobs:
98106

99107
steps:
100108
- name: Checkout code
101-
uses: actions/checkout@v4
109+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
102110

103111
- name: Set up Python
104-
uses: actions/setup-python@v5
112+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
105113
with:
106-
python-version: '3.11'
114+
python-version: "3.11"
107115

108116
- name: Install dependencies
109117
run: |
110118
python -m pip install --upgrade pip
119+
pip install -r requirements.txt
111120
pip install ruff mypy
112121
113-
- name: Run ruff
122+
- name: Run ruff lint
114123
run: |
115124
ruff check src/
116125
126+
- name: Run ruff format check
127+
run: |
128+
ruff format --check src/
129+
117130
- name: Run mypy
118131
run: |
119-
mypy src/create_pull_request --ignore-missing-imports || true
132+
mypy src/create_pull_request --ignore-missing-imports
120133
121134
all-checks:
122135
name: All Checks Passed

‎.pre-commit-config.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
repos:
2+
- repo: https://github.com/astral-sh/ruff-pre-commit
3+
rev: v0.8.6
4+
hooks:
5+
- id: ruff
6+
args: [--fix]
7+
- id: ruff-format
8+
9+
- repo: https://github.com/pre-commit/mirrors-mypy
10+
rev: v1.14.1
11+
hooks:
12+
- id: mypy
13+
args: [--ignore-missing-imports]
14+
additional_dependencies:
15+
- PyGithub==2.1.1
16+
- typing-extensions==4.9.0
17+
18+
- repo: https://github.com/adrienverge/yamllint
19+
rev: v1.35.1
20+
hooks:
21+
- id: yamllint
22+
args: [-d, relaxed]

0 commit comments

Comments
 (0)