chore(deps): bump the python-minor-patch group with 3 updates #716
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish PR Preview | |
| on: | |
| pull_request: | |
| types: [labeled] | |
| workflow_dispatch: | |
| inputs: | |
| pr_number: | |
| description: Pull request number to publish | |
| required: true | |
| type: string | |
| publish_test_pypi: | |
| description: Publish the Python package to TestPyPI | |
| required: true | |
| default: true | |
| type: boolean | |
| publish_docker: | |
| description: Publish socketdev/cli:pr-<number> to Docker Hub | |
| required: true | |
| default: false | |
| type: boolean | |
| sdk_preview_version: | |
| description: Optional exact TestPyPI socketdev prerelease for the Docker image | |
| required: false | |
| type: string | |
| concurrency: | |
| group: publish-pr-preview-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: false | |
| jobs: | |
| context: | |
| if: >- | |
| github.event_name == 'workflow_dispatch' || | |
| (github.event.label.name == 'publish-preview' || | |
| github.event.label.name == 'publish-docker-preview') && | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| pr_number: ${{ steps.context.outputs.pr_number }} | |
| head_sha: ${{ steps.context.outputs.head_sha }} | |
| steps: | |
| - name: Validate pull request context | |
| id: context | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| EVENT_PR_NUMBER: ${{ github.event.pull_request.number }} | |
| INPUT_PR_NUMBER: ${{ inputs.pr_number }} | |
| WORKFLOW_REF: ${{ github.ref }} | |
| with: | |
| script: | | |
| const rawPrNumber = context.eventName === 'workflow_dispatch' | |
| ? process.env.INPUT_PR_NUMBER | |
| : process.env.EVENT_PR_NUMBER; | |
| if (!/^[1-9][0-9]*$/.test(rawPrNumber || '')) { | |
| core.setFailed('Pull request number must contain ASCII digits only.'); | |
| return; | |
| } | |
| if (context.eventName === 'workflow_dispatch') { | |
| const defaultRef = `refs/heads/${process.env.DEFAULT_BRANCH}`; | |
| if (process.env.WORKFLOW_REF !== defaultRef) { | |
| core.setFailed(`Run manual previews from ${defaultRef}.`); | |
| return; | |
| } | |
| } | |
| const prNumber = Number(rawPrNumber); | |
| if (!Number.isSafeInteger(prNumber)) { | |
| core.setFailed('Pull request number is outside the supported range.'); | |
| return; | |
| } | |
| const {data: pullRequest} = await github.rest.pulls.get({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: prNumber, | |
| }); | |
| if (pullRequest.state !== 'open') { | |
| core.setFailed(`Pull request #${prNumber} is not open.`); | |
| return; | |
| } | |
| if (pullRequest.head.repo?.full_name !== `${context.repo.owner}/${context.repo.repo}`) { | |
| core.setFailed('Preview publication is limited to branches in this repository.'); | |
| return; | |
| } | |
| core.setOutput('pr_number', String(prNumber)); | |
| core.setOutput('head_sha', pullRequest.head.sha); | |
| build: | |
| needs: context | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| outputs: | |
| preview_version: ${{ steps.version.outputs.preview_version }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ needs.context.outputs.head_sha }} | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install build tooling | |
| uses: ./.github/actions/setup-hatch | |
| - name: Install distribution validator | |
| run: python -m pip install "twine>=4.0.0" | |
| - name: Inject deterministic preview version | |
| env: | |
| PREVIEW_ID: ${{ github.run_id }} | |
| RUN_ATTEMPT: ${{ github.run_attempt }} | |
| run: | | |
| PREVIEW_ID=$((PREVIEW_ID * 100 + RUN_ATTEMPT)) | |
| python .hooks/sync_version.py --dev --preview-id "$PREVIEW_ID" --skip-lock | |
| - name: Read preview version | |
| id: version | |
| run: echo "preview_version=$(hatch version)" >> "$GITHUB_OUTPUT" | |
| - name: Build and validate distributions | |
| run: | | |
| hatch build | |
| python -m twine check dist/* | |
| - name: Install and inspect wheel locally | |
| run: | | |
| python -m venv "$RUNNER_TEMP/preview-check" | |
| "$RUNNER_TEMP/preview-check/bin/pip" install --no-deps dist/*.whl | |
| "$RUNNER_TEMP/preview-check/bin/python" - <<'PY' | |
| import compileall | |
| import importlib.metadata | |
| import pathlib | |
| import sysconfig | |
| distribution = importlib.metadata.distribution("socketsecurity") | |
| entry_points = {entry_point.name for entry_point in distribution.entry_points} | |
| assert "socketcli" in entry_points | |
| package = pathlib.Path(sysconfig.get_paths()["purelib"]) / "socketsecurity" | |
| assert compileall.compile_dir(package, quiet=1) | |
| print("preview wheel smoke OK", distribution.version) | |
| PY | |
| - name: Upload preview distributions | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: socketsecurity-preview-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: dist/* | |
| if-no-files-found: error | |
| retention-days: 14 | |
| publish-package: | |
| needs: [context, build] | |
| if: >- | |
| github.event.label.name == 'publish-preview' || | |
| (github.event_name == 'workflow_dispatch' && inputs.publish_test_pypi) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| pull-requests: write | |
| steps: | |
| - name: Download preview distributions | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: socketsecurity-preview-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: dist | |
| - name: Publish to TestPyPI | |
| uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 | |
| with: | |
| repository-url: https://test.pypi.org/legacy/ | |
| verbose: true | |
| - name: Comment on pull request | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| PREVIEW_VERSION: ${{ needs.build.outputs.preview_version }} | |
| PR_NUMBER: ${{ needs.context.outputs.pr_number }} | |
| with: | |
| script: | | |
| const marker = '<!-- socketsecurity-pr-preview -->'; | |
| const prNumber = Number(process.env.PR_NUMBER); | |
| const version = process.env.PREVIEW_VERSION; | |
| const body = `${marker} | |
| 🚀 CLI preview published: \`socketsecurity==${version}\` | |
| \`\`\`bash | |
| pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==${version} | |
| \`\`\` | |
| TestPyPI's package index can take several minutes to expose a newly uploaded version.`; | |
| const {data: comments} = await github.rest.issues.listComments({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: prNumber, | |
| }); | |
| const existing = comments.find(comment => | |
| comment.user.type === 'Bot' && comment.body.includes(marker) | |
| ); | |
| if (existing) { | |
| await github.rest.issues.updateComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| comment_id: existing.id, | |
| body, | |
| }); | |
| } else { | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: prNumber, | |
| body, | |
| }); | |
| } | |
| publish-docker: | |
| needs: [context, build] | |
| if: >- | |
| github.event.label.name == 'publish-docker-preview' || | |
| (github.event_name == 'workflow_dispatch' && inputs.publish_docker) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # Keep the Dockerfile and credential-handling action on trusted code. | |
| # The pull request enters this job only through the built wheel. | |
| ref: ${{ github.event.repository.default_branch }} | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: Download preview distributions | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: socketsecurity-preview-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: dist | |
| - name: Set up Docker publishing | |
| uses: ./.github/actions/setup-docker | |
| with: | |
| enable-qemu: "false" | |
| dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Build and push Docker preview | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| file: Dockerfile.preview | |
| push: true | |
| pull: true | |
| platforms: linux/amd64 | |
| tags: socketdev/cli:pr-${{ needs.context.outputs.pr_number }} | |
| build-args: | | |
| SDK_PREVIEW_VERSION=${{ inputs.sdk_preview_version }} | |
| - name: Comment on pull request | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| env: | |
| PR_NUMBER: ${{ needs.context.outputs.pr_number }} | |
| with: | |
| script: | | |
| const marker = '<!-- socketsecurity-docker-preview -->'; | |
| const prNumber = Number(process.env.PR_NUMBER); | |
| const body = `${marker} | |
| 🐳 Docker preview published: \`socketdev/cli:pr-${prNumber}\` | |
| This mutable tag is only created when a Docker preview is explicitly requested.`; | |
| const {data: comments} = await github.rest.issues.listComments({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: prNumber, | |
| }); | |
| const existing = comments.find(comment => | |
| comment.user.type === 'Bot' && comment.body.includes(marker) | |
| ); | |
| if (existing) { | |
| await github.rest.issues.updateComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| comment_id: existing.id, | |
| body, | |
| }); | |
| } else { | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: prNumber, | |
| body, | |
| }); | |
| } |