Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
from setuptools_scm import get_version

version = get_version(root='../', relative_to=__file__)
version = get_version(root='../../', relative_to=__file__)
print(version.split('+')[0])
92 changes: 92 additions & 0 deletions .github/workflows/private-repo-test.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
name: Private Repo Testing

on:
pull_request:
branches:
- main

concurrency:
group: 'private-test-${{ github.event.pull_request.number }}'
cancel-in-progress: true

jobs:
trigger-private-test:
runs-on: ubuntu-latest
if: github.event.pull_request.head.repo.full_name == github.repository

steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Install uv
uses: astral-sh/setup-uv@v6
- name: Set up Node.js for UI build
uses: actions/setup-node@v4
with:
node-version: '20'
- name: Install pnpm
uses: pnpm/action-setup@v4
with:
version: latest
- name: Install UI dependencies
run: pnpm install
- name: Build UI
run: pnpm --prefix web/client run build
- name: Install Python dependencies
run: |
python -m venv .venv
source .venv/bin/activate
pip install build twine setuptools_scm
- name: Generate development version
id: version
run: |
source .venv/bin/activate
# Generate a development version using existing script
DEV_VERSION=$(python .github/scripts/get_scm_version.py)
echo "version=$DEV_VERSION" >> $GITHUB_OUTPUT
echo "Generated development version: $DEV_VERSION"
- name: Build package
run: |
source .venv/bin/activate
python -m build
- name: Configure PyPI for private repository
run: |
cat > ~/.pypirc << EOF
[distutils]
index-servers = tobiko-private
[tobiko-private]
repository = ${{ secrets.TOBIKO_PRIVATE_PYPI_URL }}
username = _json_key_base64
password = ${{ secrets.TOBIKO_PRIVATE_PYPI_KEY }}
EOF
- name: Publish to private PyPI
run: |
source .venv/bin/activate
python -m twine upload -r tobiko-private dist/*
- name: Get commit information
id: commit
run: |
echo "author=$(git log -1 --format='%an')" >> $GITHUB_OUTPUT
echo "hash=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
echo "message=$(git log -1 --format='%s')" >> $GITHUB_OUTPUT
- name: Trigger private repository workflow
uses: convictional/[email protected]
with:
owner: ${{ secrets.PRIVATE_REPO_OWNER }}
repo: ${{ secrets.PRIVATE_REPO_NAME }}
github_token: ${{ secrets.PRIVATE_REPO_TOKEN }}
workflow_file_name: ${{ secrets.PRIVATE_WORKFLOW_FILE }}
client_payload: |
{
"package_version": "${{ steps.version.outputs.version }}",
"python_version": "3.12",
"author": "${{ steps.commit.outputs.author }}",
"hash": "${{ steps.commit.outputs.hash }}",
"message": "${{ steps.commit.outputs.message }}",
"pr_number": "${{ github.event.pull_request.number }}"
}
Comment on lines +14 to +92

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 6 months ago

To address the issue, we will add a permissions block at the root of the workflow file to define the least privileges required for the task. Based on the workflow's operations:

  1. The workflow uses actions/checkout, which requires contents: read to access repository files.
  2. The workflow publishes a package using twine, and triggers a private repository workflow, which might involve using secrets but does not require additional write permissions to repository contents.

Thus, adding permissions: contents: read at the root level is appropriate to ensure minimal permissions while allowing the workflow to function correctly.


Suggested changeset 1
.github/workflows/private-repo-test.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/private-repo-test.yaml b/.github/workflows/private-repo-test.yaml
--- a/.github/workflows/private-repo-test.yaml
+++ b/.github/workflows/private-repo-test.yaml
@@ -1,3 +1,5 @@
+permissions:
+  contents: read
 name: Private Repo Testing
 
 on:
EOF
@@ -1,3 +1,5 @@
permissions:
contents: read
name: Private Repo Testing

on:
Copilot is powered by AI and may make mistakes. Always verify output.
16 changes: 8 additions & 8 deletions sqlmesh/core/engine_adapter/base.py
Original file line number Diff line number Diff line change
Expand Up @@ -1762,21 +1762,19 @@ def remove_managed_columns(
# Historical Records that Do Not Change
.with_(
"static",
existing_rows_query.where(valid_to_col.is_(exp.Null()).not_())
if truncate
else existing_rows_query.where(
existing_rows_query.where(
exp.and_(
valid_to_col.is_(exp.Null().not_()),
valid_to_col < cleanup_ts,
),
),
)
if truncate
else existing_rows_query.where(valid_to_col.is_(exp.Null()).not_()),
)
# Latest Records that can be updated
.with_(
"latest",
existing_rows_query.where(valid_to_col.is_(exp.Null()))
if truncate
else exp.select(
exp.select(
*(
to_time_column(
exp.null(), time_data_type, self.dialect, nullable=True
Expand All @@ -1796,7 +1794,9 @@ def remove_managed_columns(
valid_to_col >= cleanup_ts,
),
)
),
)
if truncate
else existing_rows_query.where(valid_to_col.is_(exp.Null())),
)
# Deleted records which can be used to determine `valid_from` for undeleted source records
.with_(
Expand Down
Loading