mirror of
https://github.com/thousandeyes/thousandeyes-sdk-python.git
synced 2026-06-19 17:36:51 +00:00
Fix: Resolve workflow vulnerabilities (#154)
Some checks failed
Python CI / build (push) Has been cancelled
Some checks failed
Python CI / build (push) Has been cancelled
* resolve workflow vulnerabilities * Set persist-credentials: false on checkouts before untrusted steps. Prevents GITHUB_TOKEN from being written to git config before pip/pytest in CI and before build steps in release. add-tag checkout keeps default credentials for GitHub release creation. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Kevin Han
GitHub
parent
fa5af77369
commit
a2aaa9f059
54
.github/workflows/python.yaml
vendored
54
.github/workflows/python.yaml
vendored
@ -1,3 +1,7 @@
|
||||
# Runs on pushes to main and on pull requests whose head branch lives in this
|
||||
# repository (contributors with push access). Fork PRs are skipped: GitHub still
|
||||
# starts the workflow, but the job does not run, so untrusted code is not installed
|
||||
# or executed via pip/pytest.
|
||||
name: Python CI
|
||||
|
||||
on:
|
||||
@ -6,36 +10,66 @@ on:
|
||||
pull_request:
|
||||
branches: [ "main" ]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build:
|
||||
if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
persist-credentials: false
|
||||
- uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: '3.11'
|
||||
cache: 'pip'
|
||||
|
||||
- id: packages
|
||||
name: Discover packages
|
||||
run: |
|
||||
shopt -s nullglob
|
||||
packages=()
|
||||
for dir in ./thousandeyes-sdk-*/; do
|
||||
name="${dir#./}"
|
||||
name="${name%/}"
|
||||
if ! printf '%s' "$name" | grep -Eq '^thousandeyes-sdk-[a-z0-9-]+$'; then
|
||||
echo "Invalid package directory name: ${name}" >&2
|
||||
exit 1
|
||||
fi
|
||||
packages+=("$name")
|
||||
done
|
||||
if [ "${#packages[@]}" -eq 0 ]; then
|
||||
echo "No thousandeyes-sdk-* packages found" >&2
|
||||
exit 1
|
||||
fi
|
||||
FOLDERS_JSON=$(printf '%s\n' "${packages[@]}" | jq -R -s -c 'split("\n") | map(select(length > 0))')
|
||||
echo "packages=${FOLDERS_JSON}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Install core module
|
||||
run: pip install -e thousandeyes-sdk-core
|
||||
|
||||
- name: Install and test modules
|
||||
env:
|
||||
PACKAGES_JSON: ${{ steps.packages.outputs.packages }}
|
||||
run: |
|
||||
pip install pytest
|
||||
pip install coverage
|
||||
|
||||
# Initialize coverage data file
|
||||
|
||||
coverage erase
|
||||
|
||||
for module in $(find . -maxdepth 1 -type d -name "thousandeyes-sdk-*" | cut -c 3-); do
|
||||
pip install -e $module
|
||||
coverage run --source=$module -m pytest $module
|
||||
# Move the .coverage file to a unique name
|
||||
mv .coverage .coverage.$module
|
||||
|
||||
mapfile -t modules < <(jq -r '.[]' <<< "$PACKAGES_JSON")
|
||||
for module in "${modules[@]}"; do
|
||||
pip install -e "./${module}"
|
||||
coverage run --source="./${module}" -m pytest "./${module}"
|
||||
mv .coverage ".coverage.${module}"
|
||||
done
|
||||
|
||||
# Combine all .coverage files
|
||||
|
||||
coverage combine .coverage.*
|
||||
coverage report
|
||||
coverage xml
|
||||
|
||||
81
.github/workflows/release.yaml
vendored
81
.github/workflows/release.yaml
vendored
@ -1,3 +1,5 @@
|
||||
# Manual release only. GitHub allows workflow_dispatch only for users with write
|
||||
# access to this repository. PyPI publish is further gated by the "release" environment.
|
||||
name: Release
|
||||
on:
|
||||
workflow_dispatch:
|
||||
@ -7,59 +9,114 @@ on:
|
||||
required: true
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
validate-release:
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
release_version: ${{ steps.validate.outputs.release_version }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
persist-credentials: false
|
||||
- id: validate
|
||||
env:
|
||||
RELEASE_VERSION: ${{ inputs.releaseVersion }}
|
||||
run: |
|
||||
if ! printf '%s' "$RELEASE_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$'; then
|
||||
echo "Invalid releaseVersion: must match X.Y.Z or X.Y.ZrcN (e.g. 2.26.0 or 2.0.0rc1)" >&2
|
||||
exit 1
|
||||
fi
|
||||
if git rev-parse "refs/tags/${RELEASE_VERSION}" >/dev/null 2>&1; then
|
||||
echo "Tag ${RELEASE_VERSION} already exists" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "release_version=${RELEASE_VERSION}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
set-package-matrix:
|
||||
needs: validate-release
|
||||
# This action returns all sub-packages to be published.
|
||||
# It thens exports the variable to `matrix`, so that the deployment job is run individually for each sub-package
|
||||
# It then exports the variable to `matrix`, so that the deployment job is run individually for each sub-package
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
packages: ${{ steps.packages.outputs.packages }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
persist-credentials: false
|
||||
- id: packages
|
||||
run: |
|
||||
FOLDERS_JSON=$(find . -maxdepth 1 -type d -name "thousandeyes-sdk-*" | cut -c 3- | jq -R -s -c 'split("\n")[:-1]')
|
||||
echo "packages=$FOLDERS_JSON" >> "$GITHUB_OUTPUT"
|
||||
shopt -s nullglob
|
||||
packages=()
|
||||
for dir in ./thousandeyes-sdk-*/; do
|
||||
name="${dir#./}"
|
||||
name="${name%/}"
|
||||
if ! printf '%s' "$name" | grep -Eq '^thousandeyes-sdk-[a-z0-9-]+$'; then
|
||||
echo "Invalid package directory name: ${name}" >&2
|
||||
exit 1
|
||||
fi
|
||||
packages+=("$name")
|
||||
done
|
||||
if [ "${#packages[@]}" -eq 0 ]; then
|
||||
echo "No thousandeyes-sdk-* packages found" >&2
|
||||
exit 1
|
||||
fi
|
||||
FOLDERS_JSON=$(printf '%s\n' "${packages[@]}" | jq -R -s -c 'split("\n") | map(select(length > 0))')
|
||||
echo "packages=${FOLDERS_JSON}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
deployment:
|
||||
needs: set-package-matrix
|
||||
needs: [validate-release, set-package-matrix]
|
||||
strategy:
|
||||
matrix:
|
||||
package-name: ${{ fromJSON(needs.set-package-matrix.outputs.packages) }}
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write
|
||||
environment:
|
||||
environment:
|
||||
name: release
|
||||
url: https://pypi.org/p/${{ matrix.package-name }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
ref: main
|
||||
persist-credentials: false
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
cache: pip
|
||||
cache-dependency-path: '**/pyproject.toml'
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
pip install setuptools wheel build
|
||||
run: pip install setuptools wheel build
|
||||
- name: Build
|
||||
env:
|
||||
RELEASE_VERSION: ${{ needs.validate-release.outputs.release_version }}
|
||||
PACKAGE_NAME: ${{ matrix.package-name }}
|
||||
run: |
|
||||
echo ${{ inputs.releaseVersion }} >> ${{ matrix.package-name }}/.version
|
||||
cp LICENSE NOTICE ${{ matrix.package-name }}/
|
||||
python -m build ${{ matrix.package-name }} --outdir dist/
|
||||
printf '%s\n' "$RELEASE_VERSION" >> "${PACKAGE_NAME}/.version"
|
||||
cp LICENSE NOTICE "${PACKAGE_NAME}/"
|
||||
python -m build "${PACKAGE_NAME}" --outdir dist/
|
||||
- name: Publish
|
||||
uses: pypa/gh-action-pypi-publish@release/v1
|
||||
with:
|
||||
skip-existing: true
|
||||
|
||||
add-tag:
|
||||
runs-on: ubuntu-latest
|
||||
needs: deployment
|
||||
needs: [validate-release, deployment]
|
||||
permissions:
|
||||
contents: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Create GitHub Release
|
||||
uses: softprops/action-gh-release@v2
|
||||
with:
|
||||
tag_name: ${{ inputs.releaseVersion }}
|
||||
tag_name: ${{ needs.validate-release.outputs.release_version }}
|
||||
prerelease: false
|
||||
draft: false
|
||||
generate_release_notes: true
|
||||
|
||||
Loading…
Reference in New Issue
Block a user