Merge branch 'main' into ios-releases

Author: JacobCoffee

.github/dependabot.yml

@@ -3,31 +3,23 @@ updates:
 - package-ecosystem: pip
   directory: "/"
   schedule:
-    interval: daily
+    interval: weekly
+  cooldown:
+    default-days: 7
   open-pull-requests-limit: 10
-  ignore:
-  - dependency-name: docutils
-    versions:
-    - "0.16"
-    - "0.17"
-  - dependency-name: responses
-    versions:
-    - 0.12.1
-    - 0.13.0
-    - 0.13.1
-    - 0.13.2
-  - dependency-name: "boto3"
-  - dependency-name: "boto3-stubs"
-  - dependency-name: "botocore"
-  - dependency-name: "botocore-stubs"
-  - dependency-name: lxml
-    versions:
-    - 4.6.2
 - package-ecosystem: github-actions
   directory: "/"
   groups:
     github-actions:
       patterns:
         - "*"  # Group all Actions updates into a single larger pull request
   schedule:
-    interval: daily
+    interval: weekly
+  cooldown:
+    default-days: 7
+- package-ecosystem: docker
+  directory: "/"
+  schedule:
+    interval: weekly
+  cooldown:
+    default-days: 7

.github/workflows/ci.yml

@@ -20,14 +20,16 @@ jobs:
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version-file: '.python-version'
 
       - name: Cache pip
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('pyproject.toml') }}
@@ -56,7 +58,9 @@ jobs:
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Install platform dependencies
         run: |
@@ -72,12 +76,12 @@ jobs:
           wget https://github.com/jgm/pandoc/releases/download/2.17.1.1/pandoc-2.17.1.1-1-amd64.deb
           sudo dpkg -i pandoc-2.17.1.1-1-amd64.deb
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version-file: '.python-version'
 
       - name: Cache pip
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('pyproject.toml') }}

.github/workflows/lint.yml

@@ -13,12 +13,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
 
-      - uses: j178/prek-action@v2
+      - uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4

.github/workflows/purge-cache.yml

@@ -19,10 +19,11 @@ jobs:
   purge:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         if: github.event_name == 'push'
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Resolve keys
         id: keys
@@ -36,8 +37,10 @@ jobs:
           fi
 
       - name: Purge ${{ steps.keys.outputs.keys || 'pydotorg-app' }}
+        env:
+          PURGE_KEYS: ${{ steps.keys.outputs.keys || 'pydotorg-app' }}
         run: |
-          for KEY in ${{ steps.keys.outputs.keys || 'pydotorg-app' }}; do
+          for KEY in ${PURGE_KEYS}; do
             curl -fsS -X POST \
               "https://api.fastly.com/service/${{ secrets.FASTLY_SERVICE_ID }}/purge/$KEY" \
               -H "Fastly-Key: ${{ secrets.FASTLY_API_KEY }}"

.github/workflows/static.yml

@@ -10,13 +10,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
             python-version-file: '.python-version'
       - name: Cache Python dependencies
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         env:
           cache-name: pythondotorg-cache-pip
         with:

.github/workflows/zizmor.yml

@@ -0,0 +1,25 @@
+
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

Dockerfile

@@ -1,4 +1,6 @@
-FROM python:3.12.6-bookworm
+FROM ghcr.io/astral-sh/uv:0.11.20@sha256:eaa5f1a3305307aaf9e67fe2bbba1d85ebbb2d8a63bce23af21797bfafbe0f8b AS uv
+
+FROM python:3.14.6-bookworm
 ENV PYTHONUNBUFFERED=1
 ENV PYTHONDONTWRITEBYTECODE=1
 
@@ -32,16 +34,19 @@ RUN case $(uname -m) in \
 RUN mkdir /code
 WORKDIR /code
 
-RUN pip --no-cache-dir --disable-pip-version-check install --upgrade pip setuptools wheel
+COPY --from=uv /uv /uvx /usr/local/bin/
 
-COPY pyproject.toml /code/
+COPY pyproject.toml uv.lock /code/
 
-RUN --mount=type=cache,target=/root/.cache/pip \
+RUN --mount=type=cache,target=/root/.cache \
     set -x \
-    && pip --disable-pip-version-check \
-        install --group dev \
-        .
+    && uv sync \
+         --frozen \
+         --no-editable \
+         --no-install-project
 
 COPY . /code/
 
-RUN pip --disable-pip-version-check install --no-deps -e '.'
+RUN uv sync \
+      --frozen \
+      --no-editable

Dockerfile.cabotage

@@ -1,4 +1,6 @@
-FROM python:3.12.6-bookworm
+FROM ghcr.io/astral-sh/uv:0.11.20@sha256:eaa5f1a3305307aaf9e67fe2bbba1d85ebbb2d8a63bce23af21797bfafbe0f8b AS uv
+
+FROM python:3.14.6-bookworm
 COPY --from=ewdurbin/nginx-static:1.25.x /usr/bin/nginx /usr/bin/nginx
 ENV PYTHONUNBUFFERED=1
 ENV PYTHONDONTWRITEBYTECODE=1
@@ -33,17 +35,28 @@ RUN case $(uname -m) in \
 RUN mkdir /code
 WORKDIR /code
 
-RUN pip --no-cache-dir --disable-pip-version-check install --upgrade pip setuptools wheel
+ENV VIRTUAL_ENV=/code/.venv
+ENV PATH="$VIRTUAL_ENV/bin:$PATH"
+
+COPY --from=uv /uv /uvx /usr/local/bin/
 
-COPY pyproject.toml /code/
+COPY pyproject.toml uv.lock /code/
 
-RUN --mount=type=cache,target=/root/.cache/pip \
+RUN --mount=type=cache,target=/root/.cache \
     set -x \
-    && pip --disable-pip-version-check \
-        install \
-        '.[prod]'
+    && uv sync \
+         --frozen \
+         --no-editable \
+         --no-dev \
+         --extra prod \
+         --no-install-project
 
 COPY . /code/
 
-RUN pip --disable-pip-version-check install --no-deps '.'
-RUN DJANGO_SETTINGS_MODULE=pydotorg.settings.static python manage.py collectstatic --noinput
+RUN uv sync \
+      --frozen \
+      --no-editable \
+      --no-dev \
+      --extra prod
+
+RUN DJANGO_SETTINGS_MODULE=pydotorg.settings.static uv run python manage.py collectstatic --noinput

Makefile

@@ -16,8 +16,8 @@ help: ## Display this help text
 	mkdir -p .state && touch .state/db-migrated
 
 .state/db-initialized: .state/docker-build-web .state/db-migrated
-	docker compose run --rm web ./manage.py createcachetable
-	docker compose run --rm web ./manage.py loaddata fixtures/*.json
+	docker compose run --rm web uv run ./manage.py createcachetable
+	docker compose run --rm web uv run ./manage.py loaddata fixtures/*.json
 	mkdir -p .state && touch .state/db-initialized
 
 # =============================================================================
@@ -30,16 +30,16 @@ serve: .state/db-initialized ## Start the application
 	docker compose up --remove-orphans
 
 migrations: .state/db-initialized ## Generate migrations from models
-	docker compose run --rm web ./manage.py makemigrations
+	docker compose run --rm web uv run ./manage.py makemigrations
 
 migrate: .state/docker-build-web ## Run Django migrate
-	docker compose run --rm web ./manage.py migrate
+	docker compose run --rm web uv run ./manage.py migrate
 
 manage: .state/db-initialized ## Run arbitrary manage.py commands
-	docker compose run --rm web ./manage.py $(filter-out $@,$(MAKECMDGOALS))
+	docker compose run --rm web uv run ./manage.py $(filter-out $@,$(MAKECMDGOALS))
 
 shell: .state/db-initialized ## Open Django interactive shell
-	docker compose run --rm web ./manage.py shell
+	docker compose run --rm web uv run ./manage.py shell
 
 docker_shell: .state/db-initialized ## Open bash in web container
 	docker compose run --rm web /bin/bash
@@ -61,7 +61,7 @@ fmt: ## Run ruff formatter
 	@if command -v ruff >/dev/null 2>&1; then ruff format .; else docker compose run --rm web ruff format .; fi
 
 test: .state/db-initialized ## Run test suite
-	docker compose run --rm web ./manage.py test
+	docker compose run --rm web uv run python ./manage.py test
 
 ci: lint fmt test ## Run lint, fmt, then tests
 

apps/cms/tests.py

@@ -81,6 +81,15 @@ class Test404(TestCase):
     def test_legacy_path(self):
         self.assertEqual(legacy_path("/any/thing"), "http://legacy.python.org/any/thing")
 
+    def test_legacy_path_without_leading_slash(self):
+        self.assertEqual(legacy_path("any/thing"), "http://legacy.python.org/any/thing")
+
+    def test_legacy_path_with_encoded_slash(self):
+        self.assertEqual(legacy_path("/%2Fevil.test/x"), "http://legacy.python.org/%2Fevil.test/x")
+
+    def test_legacy_path_with_decoded_encoded_slash(self):
+        self.assertEqual(legacy_path("//evil.test/x"), "http://legacy.python.org//evil.test/x")
+
     def test_custom_404(self):
         """Ensure custom 404 is set to 5 minutes"""
         response = self.client.get("/foo-bar/baz/9876")