cloudcheck 9.3.0__tar.gz → 10.0.1__tar.gz

cloudcheck-10.0.1/.github/workflows/cla.yml

@@ -0,0 +1,97 @@
+name: "CLA Assistant"
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+permissions:
+  pull-requests: write
+  statuses: write
+
+jobs:
+  CLAAssistant:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate token from GitHub App
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: blacklanternsecurity
+
+      - name: Check all committers against org and allowlist
+        id: cla-check
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request_target" ]; then
+            PR_NUM="${{ github.event.pull_request.number }}"
+          else
+            PR_NUM="${{ github.event.issue.number }}"
+          fi
+
+          COMMITTERS=$(gh api "repos/${{ github.repository }}/pulls/$PR_NUM/commits" --paginate --jq '.[].author.login' | sort -u)
+          ALL_EXEMPT=true
+
+          for LOGIN in $COMMITTERS; do
+            # treat commits with no associated GitHub login as non-exempt
+            if [ -z "$LOGIN" ] || [ "$LOGIN" = "null" ]; then
+              echo "Unknown committer (no GitHub login) — not exempt"
+              ALL_EXEMPT=false
+              break
+            fi
+
+            EXEMPT=false
+
+            # check if account type is Bot (GitHub App accounts)
+            AUTHOR_TYPE=$(gh api "users/${LOGIN}" --jq '.type' 2>/dev/null || echo "Unknown")
+            if [ "$AUTHOR_TYPE" = "Bot" ]; then
+              echo "$LOGIN is a Bot account — exempt"
+              EXEMPT=true
+            fi
+
+            # check org membership
+            if [ "$EXEMPT" = "false" ]; then
+              if gh api "orgs/blacklanternsecurity/members/$LOGIN" > /dev/null 2>&1; then
+                echo "$LOGIN is an org member — exempt"
+                EXEMPT=true
+              fi
+            fi
+
+            if [ "$EXEMPT" = "false" ]; then
+              echo "$LOGIN is not exempt — CLA required"
+              ALL_EXEMPT=false
+              break
+            fi
+          done
+
+          echo "all_exempt=$ALL_EXEMPT" >> "$GITHUB_OUTPUT"
+
+      - name: Skip CLA when all committers are exempt
+        if: steps.cla-check.outputs.all_exempt == 'true' && github.event_name == 'pull_request_target'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api --method POST "repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }}" \
+            -f state=success \
+            -f context="CLAAssistant" \
+            -f description="CLA check skipped — all committers are org members or bots"
+
+      - name: "CLA Assistant"
+        if: |
+          (steps.cla-check.outputs.all_exempt != 'true') &&
+          ((github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target')
+        uses: contributor-assistant/github-action@v2.6.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PERSONAL_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
+        with:
+          path-to-signatures: "signatures/version1/cla.json"
+          path-to-document: "https://github.com/blacklanternsecurity/CLA/blob/main/ICLA.md"
+          branch: "main"
+          allowlist: "dependabot[bot],github-actions[bot],renovate[bot]"
+          remote-organization-name: "blacklanternsecurity"
+          remote-repository-name: "CLA"
+          lock-pullrequest-aftermerge: "false"

{cloudcheck-9.3.0 → cloudcheck-10.0.1}/.github/workflows/daily-update.yml

@@ -24,10 +24,6 @@ jobs:
       with:
         ref: stable
 
-    - name: Create temporary update branch
-      run: |
-        git checkout -b update/daily-$(date -u +%Y-%m-%d)
-
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
@@ -56,16 +52,11 @@ jobs:
           echo "has_changes=true" >> $GITHUB_OUTPUT
         fi
 
-    - name: Commit and merge changes
+    - name: Commit and push to stable
       if: steps.changes.outputs.has_changes == 'true'
       run: |
-        BRANCH="update/daily-$(date -u +%Y-%m-%d)"
         git config user.name "github-actions[bot]"
         git config user.email "github-actions[bot]@users.noreply.github.com"
-        git add cloud_providers_v2.json README.md
+        git add cloud_providers_v3.json README.md
         git commit -m "chore: daily signature update $(date -u +%Y-%m-%d)"
-        git push origin "$BRANCH"
-        git checkout stable
-        git merge "$BRANCH" --no-edit -m "chore: merge daily signature update"
-        git push origin stable
-        git push origin --delete "$BRANCH"
+        git push origin HEAD:stable

{cloudcheck-9.3.0 → cloudcheck-10.0.1}/.github/workflows/python-tests.yml

@@ -60,8 +60,7 @@ jobs:
       - name: Build PyPi package
         run: uv run maturin build --release --out dist
       - name: Publish PyPi package
-        # TODO: Remove || true
-        run: uv run maturin publish --username __token__ --password ${{ secrets.PYPI_TOKEN }} || true
+        run: uv run maturin publish --skip-existing --username __token__ --password ${{ secrets.PYPI_TOKEN }}
   linux:
     runs-on: ${{ matrix.platform.runner }}
     needs: publish
@@ -92,7 +91,7 @@ jobs:
         with:
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
-          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+          sccache: false
           manylinux: auto
           before-script-linux: |
             if command -v apt-get >/dev/null 2>&1; then
@@ -138,7 +137,7 @@ jobs:
         with:
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
-          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+          sccache: false
           manylinux: musllinux_1_2
           before-script-linux: |
             if command -v apk >/dev/null 2>&1; then
@@ -185,7 +184,7 @@ jobs:
         with:
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
-          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+          sccache: false
       - name: Upload wheels
         uses: actions/upload-artifact@v6
         with:
@@ -213,7 +212,7 @@ jobs:
         with:
           target: ${{ matrix.platform.target }}
           args: --release --out dist --find-interpreter
-          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+          sccache: false
       - name: Upload wheels
         uses: actions/upload-artifact@v6
         with:

{cloudcheck-9.3.0 → cloudcheck-10.0.1}/.github/workflows/rust-tests.yml

@@ -51,4 +51,10 @@ jobs:
         uses: actions-rust-lang/setup-rust-toolchain@v1
       
       - name: Publish to crates.io
-        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        run: |
+          VERSION=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[0].version')
+          if cargo search cloudcheck --limit 1 | head -1 | grep -q "$VERSION"; then
+            echo "Version $VERSION already exists on crates.io, skipping publish"
+          else
+            cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          fi