Skip to content

Commit 1d1f988

Browse files
author
Wil T
authored
Github Actions Rebuild (#1132)
* update ruff * add dependabot * add dependency review * harden security scorecard * run scorecard on major-release PRs * use defusedxml * add usedforsecurity flag to hashlib.md5 * correct comment for sqlalchemy * modularize python check action * update actions/upload-artifact
1 parent 5aaf245 commit 1d1f988

File tree

14 files changed

+288
-175
lines changed

14 files changed

+288
-175
lines changed

‎.github/dependabot.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
8+
- package-ecosystem: docker
9+
directory: /
10+
schedule:
11+
interval: weekly
12+
13+
- package-ecosystem: pip
14+
directory: /docs
15+
schedule:
16+
interval: weekly
17+
18+
- package-ecosystem: pip
19+
directory: /
20+
schedule:
21+
interval: weekly

‎.github/workflows/dependency-review.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: Dependency review
10+
11+
on: [pull_request]
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
dependency-review:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Harden Runner
21+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
22+
with:
23+
egress-policy: audit
24+
25+
- name: 'Checkout Repository'
26+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
27+
- name: 'Dependency Review'
28+
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

‎.github/workflows/pip-install.yml‎

Lines changed: 0 additions & 69 deletions
This file was deleted.

‎.github/workflows/python-checks.yml‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
name: Python checks
2+
3+
on:
4+
push:
5+
branches: [ "main", "major-release" ]
6+
pull_request:
7+
branches: [ "main", "major-release" ]
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
test:
15+
strategy:
16+
fail-fast: false
17+
matrix:
18+
python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
19+
os: ["ubuntu-latest", "windows-latest", "macos-latest"]
20+
limited-dependencies: ["", "TRUE"]
21+
22+
runs-on: ${{ matrix.os }}
23+
24+
steps:
25+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
26+
27+
- name: Set up Python ${{ matrix.python-version }}
28+
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
29+
with:
30+
python-version: ${{ matrix.python-version }}
31+
32+
- name: Install uv
33+
uses: install-pinned/uv@de03c60d508703a83d3f8f49afcf1249590ecda1 # 0.4.12
34+
35+
- name: Install dependencies
36+
env:
37+
PARSONS_LIMITED_DEPENDENCIES: ${{ matrix.limited-dependencies }}
38+
run: |
39+
uv pip install --system -e .[all]
40+
uv pip install --system -r requirements-dev.txt
41+
42+
- name: Test with pytest
43+
run: |
44+
pytest
45+
46+
ruff-format:
47+
runs-on: ubuntu-latest
48+
49+
steps:
50+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
51+
52+
- name: Set up Python 3.12
53+
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
54+
with:
55+
python-version: "3.12"
56+
57+
- name: Install uv
58+
uses: install-pinned/uv@de03c60d508703a83d3f8f49afcf1249590ecda1 # 0.4.12
59+
60+
- name: Install dependencies
61+
run: |
62+
uv pip install --system -r requirements-dev.txt
63+
64+
- name: Run ruff format
65+
run: |
66+
ruff format --diff --target-version=py38 .
67+
68+
ruff:
69+
runs-on: ubuntu-latest
70+
71+
steps:
72+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
73+
74+
- name: Set up Python 3.12
75+
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
76+
with:
77+
python-version: "3.12"
78+
79+
- name: Install uv
80+
uses: install-pinned/uv@de03c60d508703a83d3f8f49afcf1249590ecda1 # 0.4.12
81+
82+
- name: Install dependencies
83+
run: |
84+
uv pip install --system -r requirements-dev.txt
85+
86+
- name: Run ruff
87+
run: |
88+
ruff check --output-format=github .
89+
90+
bandit:
91+
runs-on: ubuntu-latest
92+
93+
steps:
94+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
95+
96+
- name: Set up Python 3.12
97+
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
98+
with:
99+
python-version: "3.12"
100+
101+
- name: Install uv
102+
uses: install-pinned/uv@de03c60d508703a83d3f8f49afcf1249590ecda1 # 0.4.12
103+
104+
- name: Install bandit
105+
run: |
106+
uv pip install --system -r requirements-dev.txt
107+
108+
- name: Run bandit scan
109+
run: |
110+
bandit -c pyproject.toml -r . -ll -ii
111+
112+
coverage:
113+
runs-on: ubuntu-latest
114+
115+
steps:
116+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
117+
118+
- name: Set up Python 3.12
119+
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
120+
with:
121+
python-version: "3.12"
122+
123+
- name: Install uv
124+
uses: install-pinned/uv@de03c60d508703a83d3f8f49afcf1249590ecda1 # 0.4.12
125+
126+
- name: Install dependencies
127+
run: |
128+
uv pip install --system -e .[all]
129+
uv pip install --system -r requirements-dev.txt
130+
131+
- name: Test with pytest
132+
run: |
133+
coverage run -m pytest
134+
135+
- name: Check coverage
136+
run: |
137+
coverage report -m --skip-covered --fail-under=75
138+
139+
pip-install:
140+
strategy:
141+
fail-fast: false
142+
matrix:
143+
python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
144+
os: ["ubuntu-latest", "windows-latest", "macos-latest"]
145+
limited-dependencies: ["", "TRUE"]
146+
147+
runs-on: ${{ matrix.os }}
148+
149+
steps:
150+
- name: Harden Runner
151+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
152+
with:
153+
egress-policy: audit
154+
155+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
156+
157+
- name: Set up Python ${{ matrix.python-version }}
158+
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
159+
with:
160+
python-version: ${{ matrix.python-version }}
161+
cache: pip
162+
163+
- name: Install dependencies
164+
env:
165+
PARSONS_LIMITED_DEPENDENCIES: ${{ matrix.limited-dependencies }}
166+
run: |
167+
pip install -r requirements-dev.txt
168+
pip install -e .[all]

‎.github/workflows/security_scorecard.yml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,15 @@
33
# policy, and support documentation.
44

55
name: Scorecard supply-chain security
6+
67
on:
78
# For Branch-Protection check. Only the default branch is supported. See
89
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
910
branch_protection_rule:
1011
# To guarantee Maintained check is occasionally updated. See
1112
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
1213
pull_request:
13-
branches: [ "main" ]
14+
branches: [ "main", "major-release" ]
1415
schedule:
1516
- cron: '45 16 * * 2'
1617

@@ -31,6 +32,11 @@ jobs:
3132
# actions: read
3233

3334
steps:
35+
- name: Harden Runner
36+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
37+
with:
38+
egress-policy: audit
39+
3440
- name: "Checkout code"
3541
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3642
with:
@@ -59,7 +65,7 @@ jobs:
5965
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6066
# format to the repository Actions tab.
6167
- name: "Upload artifact"
62-
uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
68+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
6369
with:
6470
name: SARIF file
6571
path: results.sarif
@@ -68,6 +74,6 @@ jobs:
6874
# Upload the results to GitHub's code scanning dashboard (optional).
6975
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7076
- name: "Upload to code-scanning"
71-
uses: github/codeql-action/upload-sarif@v3
77+
uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
7278
with:
73-
sarif_file: results.sarif
79+
sarif_file: results.sarif

0 commit comments

Comments
 (0)