update template to v8.3.0, allow urn URIs

Author: muddymudskipper

.copier-answers.yml

@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v7.3.0
+_commit: v8.3.0
 _src_path: gh:eccenca/cmem-plugin-template
 author_mail: cmempy-developer@eccenca.com
 author_name: eccenca GmbH

.github/workflows/check.yml

@@ -20,16 +20,23 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+
+      - name: Cache Trivy DB
+        id: cache-trivydb
+        uses: actions/cache@v4
+        with:
+          path: .trivycache
+          key: ${{ runner.os }}-trivydb
 
       - name: Install Task
         uses: arduino/setup-task@v2
 
       - name: Set up python
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: '3.11'
+          python-version: '3.13'
 
       - name: Install and configure poetry
         uses: snok/install-poetry@v1
@@ -61,9 +68,13 @@ jobs:
         run: |
           task check:deptry
 
-      - name: safety
+      - name: trivy
+        env:
+          TRIVY_NO_PROGRESS: "true"
+          TRIVY_CACHE_DIR: ".trivycache/"
+          TRIVY_DISABLE_VEX_NOTICE: "true"
         run: |
-          task check:safety
+          task check:trivy
 
       - name: Publish Test Report in Action
         uses: mikepenz/action-junit-report@v4

.github/workflows/publish.yml

@@ -17,16 +17,16 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Task
         uses: arduino/setup-task@v2
 
       - name: Set up python
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: '3.11'
+          python-version: '3.13'
 
       - name: Install and configure poetry
         uses: snok/install-poetry@v1

.gitlab-ci.yml

@@ -1,6 +1,6 @@
 ---
 default:
-  image: docker-registry.eccenca.com/eccenca-python:v3.11.9-2
+  image: docker-registry.eccenca.com/eccenca-python:v3.13.8
   # all jobs can be interrupted in case a new commit is pushed
   interruptible: true
   before_script:
@@ -53,27 +53,32 @@ pytest:
       junit:
         - dist/junit-pytest.xml
     paths:
-      - dist/badge-coverage.svg
-      - dist/badge-tests.svg
-      - dist/coverage
-      - dist/coverage.xml
+      - dist/*
 
 deptry:
   stage: test
   script:
     - task check:deptry
 
-safety:
+trivy:
   stage: test
+  variables:
+    TRIVY_NO_PROGRESS: "true"
+    TRIVY_CACHE_DIR: ".trivycache/"
+    TRIVY_DISABLE_VEX_NOTICE: "true"
   script:
-    - task check:safety
+    - task check:trivy
+  cache:
+    paths:
+      - .trivycache/
 
 build:
   stage: build
   needs:
     - mypy
     - pytest
-    - safety
+    - trivy
+    - deptry
   script:
     - task build
   artifacts:

.idea/cmem-plugin-pyshacl.iml

@@ -1,4 +1,7 @@
 ---
+default_language_version:
+  python: python3.13
+
 repos:
   - repo: local
     hooks:
@@ -36,3 +39,9 @@ repos:
         stages: [post-checkout, post-merge]
         always_run: true
 
+      - id: trivy
+        name: check:trivy
+        description: run trivy to scan for vulnerabilities
+        entry: task check:trivy
+        language: python
+        pass_filenames: false

.pre-commit-config.yaml

@@ -1 +1 @@
-3.11
+3.13

.python-version

@@ -0,0 +1,4 @@
+# .trivyignore
+
+# ignore 51358 safety - dev dependency only
+CVE-2022-39280

.trivyignore

@@ -20,9 +20,11 @@ includes:
   custom:
     taskfile: ./TaskfileCustom.yaml
     optional: true
+    flatten: true
   plugin:
     taskfile: .tasks-plugin.yml
     optional: true
+    flatten: true
 
 tasks:
 
@@ -49,7 +51,7 @@ tasks:
       Check poetry versioning plugin. Currently not under Windows
     run: once
     preconditions:
-      - sh: '[ -d .git ]'
+      - sh: git -C . rev-parse
         msg: >
           Your newly created project directory needs to be initialized
           as a git repository.
@@ -110,7 +112,7 @@ tasks:
       - task: check:ruff
       - task: check:mypy
       - task: check:deptry
-      - task: check:safety
+      - task: check:trivy
 
   check:pytest:
     desc: Run unit and integration tests
@@ -152,12 +154,16 @@ tasks:
     vars:
       JUNIT_FILE: ./{{.DIST_DIR}}/junit-mypy.xml
 
-  check:safety:
-    desc: Complain about vulnerabilities in dependencies
+  check:trivy:
+    desc: Scan for vulnerabilities using Trivy
     <<: *preparation
     cmds:
-      # ignore 51358 safety - dev dependency only
-      - poetry run safety check -i 51358
+      - >
+        poetry run trivy fs
+        --include-dev-deps
+        --scanners vuln
+        --exit-code 1
+        .
 
   check:deptry:
     desc: Complain about unused or missing dependencies

Taskfile.yaml

@@ -1,5 +1,6 @@
 """CMEM plugin for SHACl validation using pySHACL"""
 
+import re
 from collections import OrderedDict
 from datetime import UTC, datetime
 from tempfile import NamedTemporaryFile
@@ -352,6 +353,14 @@ def __init__(  # noqa: PLR0913
         self.remove_shape_catalog_graph_type = remove_shape_catalog_graph_type
         self.max_validation_depth = max_validation_depth
 
+    @staticmethod
+    def is_valid_uri(uri: str | None) -> bool:
+        """Validate URI"""
+        if not isinstance(uri, str):
+            return False
+        urn_pattern = r"^urn:[a-zA-Z][a-zA-Z0-9-]{0,31}:.+$"
+        return validators.url(uri) is True or bool(re.match(urn_pattern, uri, re.IGNORECASE))
+
     def add_prov(self, validation_graph: Graph, utctime: str) -> Graph:
         """Add provenance data"""
         self.log.info("Adding PROV information validation graph")
@@ -551,14 +560,14 @@ def check_parameters(  # noqa: C901 PLR0912
             raise ValueError(
                 "Generate validation graph or Output values parameter needs to be set to true"
             )
-        if not validators.url(self.data_graph_uri):
+        if not self.is_valid_uri(self.data_graph_uri):
             raise ValueError("Data graph URI parameter is invalid")
-        if not validators.url(self.shacl_graph_uri):
+        if not self.is_valid_uri(self.shacl_graph_uri):
             raise ValueError("SHACL graph URI parameter is invalid")
         graphs_dict = {graph["iri"]: graph["assignedClasses"] for graph in get_graphs_list()}
 
         if self.ontology_graph_uri:
-            if not validators.url(self.ontology_graph_uri):
+            if not self.is_valid_uri(self.ontology_graph_uri):
                 raise ValueError("Ontology graph URI parameter is invalid")
             if self.ontology_graph_uri not in graphs_dict:
                 raise ValueError(f"Ontology graph <{self.ontology_graph_uri}> not found")
@@ -576,7 +585,7 @@ def check_parameters(  # noqa: C901 PLR0912
         if "https://vocab.eccenca.com/shui/ShapeCatalog" not in graphs_dict[self.shacl_graph_uri]:
             raise ValueError(f"Invalid graph type for SHACL graph <{self.shacl_graph_uri}>")
         if self.generate_graph:
-            if not validators.url(self.validation_graph_uri):
+            if not self.is_valid_uri(self.validation_graph_uri):
                 raise ValueError("Validation graph URI parameter is invalid")
             if self.validation_graph_uri in graphs_dict:
                 self.log.warning(f"Graph <{self.validation_graph_uri}> already exists")