Add config file validation#1037
Conversation
aor7000
changed the title
adhilto
changed the title
adhilto
left a comment
adhilto
left a comment
There was a problem hiding this comment.
This fixes the validation of the numberofuuidcharacterstotruncate, but there is more validation that still needs to be done. Take another look at my comment on the original issue for more details: #638 (comment). The other examples I described in that issue still produce errors.
To recap, we need the following validation:
Look through the get_gws_args function inside of main.py to see where we define our arguments. For each argument we define there:
- If we specify a non-string type (e.g.,
int), the config file parser should make throw an error if the user provides an argument of the wrong type. - If we specify
choices, the config file parser should throw an error if the user puts in an invalid choice. - If we specify
nargs='+', the config file parser should throw an error if the user provides something other than a list
* [#266] Update the utils function and reports * Remove commented code * Update missed test
Co-authored-by: GitHub Action <action@github.com>
Pins the default GITHUB_TOKEN to contents: read on workflows that don't call a GitHub API beyond the initial checkout. Other workflows that need write scopes are left implicit for a maintainer to declare. Motivation: CVE-2025-30066 (March 2025 tj-actions/changed-files compromise) exfiltrated GITHUB_TOKEN from workflow logs. Per-workflow caps bound runtime authority irrespective of repo or org default, give drift protection, and are credited per-file by the OpenSSF Scorecard Token-Permissions check. YAML validated locally with yaml.safe_load. Signed-off-by: Arpit Jain <arpitjain099@gmail.com> Co-authored-by: dagarwal-ecs <devesh.agarwal@ecstech.com>
Three workflows were missing explicit permissions blocks, causing them to inherit the repository default token permissions — broader than needed. Each of these workflows only reads the repository, so contents: read is sufficient. Affected workflows: - pylint.yml - run_link_checker_for_md_edits.yml - run_opa_tests.yml This is flagged by OpenSSF Scorecard under Token-Permissions and extends the fix from #1048 which addressed run_link_checker_cron_job.yml.
…aGoggles into 638-validate-config
@aor7000 this comment still needs to be addressed, let me know if you have any questions. |
|
@cristina479 I moved this back to draft while we wait for you to update this PR with Alden's changes. |
7 participants
🗣 Description
💭 Motivation and context
Closes #638
🧪 Testing
✅ Pre-approval checklist
✅ Pre-merge Checklist
Squash and mergebutton.✅ Post-merge Checklist