From c3c2570d3cfebde8de2c14846e1b5b75453e76a9 Mon Sep 17 00:00:00 2001 From: "Mr. Walls" Date: Tue, 9 Jul 2024 19:33:34 -0700 Subject: [PATCH 1/4] Create scorecards.yml Upgrade to new version of scorecards-analysis.yml actions --- .deepsource.toml | 2 +- .github/workflows/{scorecards-analysis.yml => scorecards.yml} | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) rename .github/workflows/{scorecards-analysis.yml => scorecards.yml} (98%) diff --git a/.deepsource.toml b/.deepsource.toml index 5971e2d..e3762a4 100644 --- a/.deepsource.toml +++ b/.deepsource.toml @@ -23,7 +23,7 @@ exclude_patterns = [ "codecov_env", "*,cover", ".hypothesis/", - "docs/" + "docs/conf.py" ] [[analyzers]] diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards.yml similarity index 98% rename from .github/workflows/scorecards-analysis.yml rename to .github/workflows/scorecards.yml index 1d517f9..c46844f 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards.yml @@ -12,7 +12,7 @@ on: schedule: - cron: '18 9 * * 5' push: - branches: [ "master" ] + branches: [ "master", "score-card-revert-patch" ] # Declare default permissions as read only. permissions: read-all @@ -46,7 +46,6 @@ jobs: # - you are installing Scorecard on a *private* repository # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional. repo_token: ${{ secrets.SCORECARD_TOKEN }} - # Public repositories: # - Publish results to OpenSSF REST API for easy access by consumers # - Allows the repository to include the Scorecard badge. From 632a61ffe70ee8bc3898d1a82505fe876b65db51 Mon Sep 17 00:00:00 2001 From: reactive-firewall Date: Wed, 10 Jul 2024 15:35:47 -0700 Subject: [PATCH 2/4] Bumped Action versions and perms --- .github/workflows/codeql-analysis.yml | 8 ++++---- .github/workflows/scorecards.yml | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index f3c47ce..bf15923 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -38,11 +38,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v4 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v1 + uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -53,7 +53,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v1 + uses: github/codeql-action/autobuild@v3 # ℹī¸ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -67,4 +67,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 + uses: github/codeql-action/analyze@v3 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index c46844f..c2be7f4 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -12,7 +12,7 @@ on: schedule: - cron: '18 9 * * 5' push: - branches: [ "master", "score-card-revert-patch" ] + branches: [ master, score-card-revert-patch ] # Declare default permissions as read only. permissions: read-all @@ -27,8 +27,8 @@ jobs: # Needed to publish results and get a badge (see publish_results below). id-token: write # Uncomment the permissions below if installing in a private repository. - # contents: read - # actions: read + contents: read + actions: read steps: - name: "Checkout code" From dd6b74c1b17bdad5bcb1384b44cb5495a6bff32c Mon Sep 17 00:00:00 2001 From: "Mr. Walls" Date: Wed, 10 Jul 2024 16:08:21 -0700 Subject: [PATCH 3/4] Updated lables config for latest version. --- .github/labeler.yml | 69 +++++++++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 31 deletions(-) diff --git a/.github/labeler.yml b/.github/labeler.yml index 687aa86..d5200ca 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -1,46 +1,53 @@ -# Add 'Multicast' label to any root file changes -Multicast: - - setup.py - - multicast/*.py +# Add 'Python Repo' label to any root file changes +Python Repo: + - changed-files: + - any-glob-to-any-file: 'setup.py' + - any-glob-to-any-file: 'pythonrepo/*.py' # Add 'Lint' label to any lint file changes Linter: - - .stickler.yml - - .hound.yml - - .yamllint.conf - - .flake8.ini - - .deepsource.toml - - tests/check_* + - changed-files: + - any-glob-to-any-file: '.stickler.yml' + - any-glob-to-any-file: '.hound.yml' + - any-glob-to-any-file: '.yamllint.conf' + - any-glob-to-any-file: '.flake8.ini' + - any-glob-to-any-file: '.deepsource.toml' + - any-glob-to-any-file: 'tests/check_*' # Add 'Lang' label to any python file changes Python Lang: - - **/*.py - - *.py + - changed-files: + - any-glob-to-any-file: '**/*.py' + - any-glob-to-any-file: '*.py' Configs: - - *.yml - - ./**/*.yml - - *.ini - - *.toml - - *.cfg - - requirements.txt + - changed-files: + - any-glob-to-any-file: '*.yml' + - any-glob-to-any-file: './**/*.yml' + - any-glob-to-any-file: '*.ini' + - any-glob-to-any-file: '*.toml' + - any-glob-to-any-file: '*.cfg' + - any-glob-to-any-file: 'requirements.txt' # Add 'test' label Testing: - - tests/**/*.py - - tests/* - - .circleci/* + - changed-files: + - any-glob-to-any-file: 'tests/**/*.py' + - any-glob-to-any-file: 'tests/*' + - any-glob-to-any-file: '.circleci/*' CI: - - tests/*.py - - .stickler.yml - - .hound.yml - - .travis.yml - - .appveyor.yml - - .github/workflows/* - - .circleci/* + - changed-files: + - any-glob-to-any-file: 'tests/*.py' + - any-glob-to-any-file: '.stickler.yml' + - any-glob-to-any-file: '.hound.yml' + - any-glob-to-any-file: '.travis.yml' + - any-glob-to-any-file: '.appveyor.yml' + - any-glob-to-any-file: '.github/workflows/*' + - any-glob-to-any-file: '.circleci/*' Github: - - .github/**/* - - .github/* - - README.md + - changed-files: + - any-glob-to-any-file: '.github/**/*' + - any-glob-to-any-file: '.github/*' + - any-glob-to-any-file: 'README.md' From 60b285033994866624fb3490deac00491aeb0bed Mon Sep 17 00:00:00 2001 From: "Mr. Walls" Date: Wed, 10 Jul 2024 16:31:07 -0700 Subject: [PATCH 4/4] Revert to only check default branch to fix regression ( - Fixed #38 - ) --- .github/workflows/scorecards.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index c2be7f4..cdcf1d4 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -12,7 +12,7 @@ on: schedule: - cron: '18 9 * * 5' push: - branches: [ master, score-card-revert-patch ] + branches: [ master ] # Declare default permissions as read only. permissions: read-all