') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); Remove contents: write permission from generate-constraints by potiuk · Pull Request #45558 · apache/airflow · GitHub
Skip to content

Remove contents: write permission from generate-constraints - #45558

Merged
potiuk merged 1 commit into
apache:mainfrom
potiuk:remove-contents-write-permission
Jan 10, 2025
Merged

Remove contents: write permission from generate-constraints#45558
potiuk merged 1 commit into
apache:mainfrom
potiuk:remove-contents-write-permission

Conversation

@potiuk

@potiukpotiuk commented Jan 10, 2025

Copy link
Copy Markdown
Member

The write permission cannot be set for PRs from forks in the call workflow - so we have to come back to implicit permissions and make explicit permissions passing a bit differently.

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in newsfragments.

@potiuk
Remove contents: write permission from generate-constraints
9f513d2
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
@potiuk
potiuk requested a review from ashb as a code ownerJanuary 10, 2025 14:56
@gopidesupavan

gopidesupavan commented Jan 10, 2025

Copy link
Copy Markdown
Member

Ah I see

@potiuk
potiuk merged commit ae32ebc into apache:mainJan 10, 2025
@potiuk
potiuk deleted the remove-contents-write-permission branch January 10, 2025 15:24
potiuk added a commit that referenced this pull request Jan 10, 2025
@potiuk@dependabot
[v2-10-test] Backport pull_request_target removal
338d156
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
potiuk added a commit that referenced this pull request Jan 10, 2025
@potiuk@dependabot
[v2-10-test] Backport pull_request_target removal
ffeab5b
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_request_target removal
0f12503
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_request_target removal
dccf214
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_request_target removal
e848557
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requtest_target removal
e54646b
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
3e6cfba
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
eec419d
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
3cb3074
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
4a364e1
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
f30b96e
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
af143de
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
75c39e7
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
6dbc0af
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
c6b7c5a
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
1eed775
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
613c3e6
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 11, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
58ccdd7
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 12, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
f803a6a
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 12, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal
b00fdff
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
potiuk added a commit that referenced this pull request Jan 12, 2025
@potiuk
[v2-10-test] Backport pull_requttest_target removal (#45527)
c2311e7
This is a bulk change that synchronizes dev/ci scripts for v2-10-test
branch with main #45266 - including follow-ups.
Rather than cherry-picking relevant PRs, this one gets the
latest version of the scripts from main and updates the branch with
some changes to adapt them to v2-10-test (such as bringing back
python 3.8 support, removing some providers checks after the
bulk move of providers and making sure all tests are passing.
This is far easier than cherry-picking the changes, because for
the v2-10-test we stopped cherry-picking CI changes which was
deemed unnecessary (we used to do it for all previous branches)
but this made it far more difficult (if not impossible) to
cherry-pick individual changes.
Fortunately, the CI scripts are maintained in the way that their
latest version **should** in principle work for a v2-* branch and
hopefully after just a few adjustments we should be able to
synchronize the changes from main by updating all relevant
CI/DEV scripts, dockerfile images, workflows, pre-commits etc.
Add actions in codeql workflows to scan github workflow actions (#45534)
* add actions in codeql workflows to scan github workflow actions
* add actions in codeql workflows to scan github workflow actions
CodeQL scanning can run always on all code (#45541)
The CodeQL scannig is fast and having custom configuration to
select which scanning to run should be run makes it unnecessarily
complex
We can just run all CodeQL scans always.
This has been suggested by actions codeql scan itself.
Add explicit permissions for all workflow-run workflows (#45548)
Those workflows inherit permissions from the calling workflows
but it's good to add explicit permissions to indicate what is
needed and in case we will also use the workflows for other purposes
in the future - default permissions for older repos might be
write so it's best to be explicit about the permissions.
Found by CodeQL scanning
Remove contents: write permission from generate-constraints (#45558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
(cherry picked from commit ae32ebc)
Bump trove-classifiers from 2025.1.7.14 to 2025.1.10.15 (#45561)
Bumps [trove-classifiers](https://github.com/pypa/trove-classifiers) from 2025.1.7.14 to 2025.1.10.15.
- [Release notes](https://github.com/pypa/trove-classifiers/releases)
- [Commits](pypa/trove-classifiers@2025.1.7.14...2025.1.10.15)
---
updated-dependencies:
- dependency-name: trove-classifiers
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit f3fd262)
Add optional --image-file-dir to store loaded files elsewhere (#45564)
While backorting the "pull_request_target" removal to v2-10-test
branches it turned out that there is not enough disk space
on Public runner to load all 5 images and keep the file dump at
the same time in the same filesystem. This PR allows to choose
where the load/save files will be stored and in the github
runner environment we store the files in "/mnt" wnich is a separate
folder with 40GB free.
(cherry picked from commit 6628049)
Fix --from-pr feature for image load and stabilize help
This is a follow-up after #45564 - it fixes the `--from-pr` and
`--from-run` to work (it was failing with file does not exist).
Also found out that gettempdir might return different directory
depending on which is your designated tmp directory (for example
in MacOS this is is a longer path in /var/.....) - so we have
to force the default during help generation to always return
"/tmp" so that the --help images do not change depending on which
system you are and what your tmp directory is.
karenbraganz pushed a commit to karenbraganz/airflow that referenced this pull request Jan 13, 2025
@potiuk@karenbraganz
Remove contents: write permission from generate-constraints (apache#4…
29b9af2
…5558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
HariGS-DB pushed a commit to HariGS-DB/airflow that referenced this pull request Jan 16, 2025
@potiuk@HariGS-DB
Remove contents: write permission from generate-constraints (apache#4…
315ae96
…5558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
dauinh pushed a commit to dauinh/airflow that referenced this pull request Jan 24, 2025
@potiuk@dauinh
Remove contents: write permission from generate-constraints (apache#4…
b767b7d
…5558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
got686-yandex pushed a commit to got686-yandex/airflow that referenced this pull request Jan 30, 2025
@potiuk@got686-yandex
Remove contents: write permission from generate-constraints (apache#4…
82c597c
…5558)
The write permission cannot be set for PRs from forks in the
call workflow - so we have to come back to implicit permissions
and make explicit permissions passing a bit differently.
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gopidesupavangopidesupavangopidesupavan approved these changes
@ashbashbAwaiting requested review from ashbashb is a code owner
@kaxilkaxilAwaiting requested review from kaxil

Assignees

No one assigned

Labels

area:dev-tools

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@potiuk@gopidesupavan