Skip to content

fix: improve supply chain protections#802

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Lash-L wants to merge 1 commit into
base:main
Choose a base branch
from
Open

fix: improve supply chain protections #802

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 21 additions & 7 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -16,19 +16,29 @@ jobs:
commitlint:
name: Lint Commit Messages
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: read
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- uses: wagoid/commitlint-github-action@v6.2.1
lint:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v6
- uses: actions/setup-python@v6
with:
persist-credentials: false
- name: Set up uv
uses: astral-sh/setup-uv@v8.0.0
with:
Comment on lines +35 to 37

CopilotAIMar 31, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For supply-chain hardening, astral-sh/setup-uv@v8.0.0 is still a mutable ref unless you pin the action to an exact commit SHA (tags can be moved/replaced). Consider switching to uses: astral-sh/setup-uv@<full-sha> (and optionally leaving the tag in a comment) to make the workflow reference itself immutable.

Copilot uses AI. Check for mistakes.
python-version: "3.11"
- uses: pre-commit/action@v3.0.1
activate-environment: true
- name: Run pre-commit
run: uv run --frozen pre-commit run --all-files

test:
strategy:
Expand All@@ -38,33 +48,33 @@ jobs:
- "3.11"
- "3.14"
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v6
- name: Set up uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@v8.0.0
with:
python-version: ${{ matrix.python-version }}
activate-environment: true
- run: uv pip install pip

CopilotAIMar 31, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uv pip install pip pulls an unpinned pip version at CI runtime, which makes the environment less reproducible and works against the new --frozen/lockfile approach. Consider removing this step, or pinning pip to a specific version that is accounted for in your tooling strategy (so CI doesn't drift or unexpectedly fail under the new exclude-newer policy).

Suggested change
- run: uv pip install pip

Copilot uses AI. Check for mistakes.
- name: Test with Pytest
run: uv run pytest --log-cli-level=DEBUG -vv -s --cov --cov-branch --cov-report=xml
run: uv run --frozen pytest --log-cli-level=DEBUG -vv -s --cov --cov-branch --cov-report=xml
shell: bash
- name: Upload results to Codecov
uses: codecov/codecov-action@v5
with:
token: ${{ secrets.CODECOV_TOKEN }}
slug: Python-roborock/python-roborock



build:
name: Build Package
runs-on: ubuntu-latest
if: github.ref != 'refs/heads/main'
steps:
- uses: actions/checkout@v6
- name: Set up uv
uses: astral-sh/setup-uv@v7
uses: astral-sh/setup-uv@v8.0.0
with:
python-version: "3.11"
activate-environment: true
Expand All@@ -76,6 +86,10 @@ jobs:
name: Test Semantic Release
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
permissions:
contents: write
issues: write
pull-requests: write
Comment on lines +90 to +92

CopilotAIMar 31, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR-only test-release job grants broad write permissions (contents, issues, pull-requests). Given the steps are configured for no-op/dry-run (no push/tag/release), these should likely be reduced to the minimum required (typically read-only) to limit blast radius if a workflow run is compromised.

Suggested change
contents: write
issues: write
pull-requests: write
contents: read
issues: read
pull-requests: read

Copilot uses AI. Check for mistakes.

@allenporterallenporterApr 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WDYT about this comment?

steps:
- uses: actions/checkout@v6
with:
Expand Down
3 changes: 3 additions & 0 deletions pyproject.toml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -67,6 +67,9 @@ include = ["roborock"]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.uv]
exclude-newer = "3 days"

[tool.semantic_release]
branch = "main"
version_toml = ["pyproject.toml:project.version"]
Expand Down
4 changes: 4 additions & 0 deletions uv.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading