devpi-process 1.3.2__tar.gz → 1.3.3__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- devpi_process-1.3.3/.github/SECURITY.md +49 -0
- devpi_process-1.3.3/.github/THREAT_MODEL.md +93 -0
- devpi_process-1.3.3/.github/dependabot.yaml +30 -0
- devpi_process-1.3.3/.github/workflows/check.yaml +46 -0
- devpi_process-1.3.3/.github/workflows/codeql.yaml +22 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/.github/workflows/news.yaml +4 -6
- {devpi_process-1.3.2 → devpi_process-1.3.3}/.github/workflows/prepare-release.yaml +1 -1
- devpi_process-1.3.3/.github/workflows/release.yaml +57 -0
- devpi_process-1.3.3/.github/workflows/scorecard.yaml +26 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/.github/workflows/upgrade-release-tools.yaml +1 -1
- {devpi_process-1.3.2 → devpi_process-1.3.3}/.pre-commit-config.yaml +2 -2
- {devpi_process-1.3.2 → devpi_process-1.3.3}/CHANGELOG.md +4 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/PKG-INFO +3 -1
- {devpi_process-1.3.2 → devpi_process-1.3.3}/README.md +2 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/pylock.toml +206 -184
- {devpi_process-1.3.2 → devpi_process-1.3.3}/pyproject.toml +5 -5
- {devpi_process-1.3.2 → devpi_process-1.3.3}/src/devpi_process/_version.py +2 -2
- devpi_process-1.3.2/.github/SECURITY.md +0 -13
- devpi_process-1.3.2/.github/dependabot.yaml +0 -27
- devpi_process-1.3.2/.github/workflows/check.yaml +0 -72
- devpi_process-1.3.2/.github/workflows/codeql.yaml +0 -41
- devpi_process-1.3.2/.github/workflows/release.yaml +0 -157
- {devpi_process-1.3.2 → devpi_process-1.3.3}/.github/FUNDING.yaml +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/.github/release.yaml +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/.gitignore +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/.markdownlint.yaml +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/CODE_OF_CONDUCT.md +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/CONTRIBUTING.md +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/LICENSE.txt +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/changelog.d/.gitkeep +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/src/devpi_process/__init__.py +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/src/devpi_process/py.typed +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/tests/demo_pkg_inline/build.py +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/tests/demo_pkg_inline/pyproject.toml +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/tests/test_devpi_process.py +0 -0
- {devpi_process-1.3.2 → devpi_process-1.3.3}/tox.toml +0 -0
|
@@ -0,0 +1,49 @@
|
|
|
1
|
+
# Security policy
|
|
2
|
+
|
|
3
|
+
devpi-process is a Python library that starts a throwaway devpi server, creates indexes on it, and uploads packages, for
|
|
4
|
+
use in tests. This policy says how to report a security problem and how we decide whether a report is one.
|
|
5
|
+
|
|
6
|
+
## Reporting a vulnerability
|
|
7
|
+
|
|
8
|
+
**Do not open a public issue for a security problem.** Use
|
|
9
|
+
[GitHub's private vulnerability reporting](https://github.com/tox-dev/devpi-process/security/advisories/new). If you do
|
|
10
|
+
not have a GitHub account, or you are a Tidelift subscriber, report through the
|
|
11
|
+
[Tidelift security contact](https://tidelift.com/security) instead; Tidelift coordinates the fix and the disclosure with
|
|
12
|
+
us. If neither works for you, email [gaborjbernat@gmail.com](mailto:gaborjbernat@gmail.com).
|
|
13
|
+
|
|
14
|
+
Include what the attacker controls and what they gain, the steps or a proof of concept, and the versions and platform
|
|
15
|
+
you tested. Write the report yourself; unreviewed tool or model output takes longer to triage.
|
|
16
|
+
|
|
17
|
+
## What to expect
|
|
18
|
+
|
|
19
|
+
Volunteers maintain devpi-process, with no on-call rotation. We aim to acknowledge a report within **5 working days**
|
|
20
|
+
and assess it within **15 working days**. Fixes are developed in a private fork attached to the draft advisory, ship in
|
|
21
|
+
a new release, and the advisory, with a CVE requested through GitHub, goes out with that release. The default embargo is
|
|
22
|
+
**90 days** from the report; we agree any change with the reporter. We credit reporters in the advisory under the name
|
|
23
|
+
they choose, or not at all. There is no bug bounty.
|
|
24
|
+
|
|
25
|
+
## Supported versions
|
|
26
|
+
|
|
27
|
+
Only the latest release receives fixes. Confirm the problem reproduces on it before reporting.
|
|
28
|
+
|
|
29
|
+
## Vulnerability or bug
|
|
30
|
+
|
|
31
|
+
A report is a vulnerability when an attacker who controls only an input that the [threat model](THREAT_MODEL.md) lists
|
|
32
|
+
as untrusted breaks a guarantee devpi-process makes. A report that first needs control of something the threat model
|
|
33
|
+
trusts, such as the test code that drives it or the devpi tools it runs, is a bug: we fix it in the open and publish no
|
|
34
|
+
advisory. Classify by who supplies the dangerous input, not by how bad the outcome sounds.
|
|
35
|
+
|
|
36
|
+
**In scope**
|
|
37
|
+
|
|
38
|
+
- devpi-process starting the server on an interface other than localhost when the caller passes no `start_args`.
|
|
39
|
+
- devpi-process running a program other than the `devpi-init`, `devpi-server` and `devpi` in the interpreter's scripts
|
|
40
|
+
directory, or passing caller data to them as anything but separate arguments.
|
|
41
|
+
- Server data written outside the directory the caller passed.
|
|
42
|
+
|
|
43
|
+
**Out of scope**
|
|
44
|
+
|
|
45
|
+
- Using devpi-process as a production package index: it is a test helper.
|
|
46
|
+
- Other local users reaching the server's port or reading its command line on a shared machine (see accepted risks).
|
|
47
|
+
- Vulnerabilities in devpi itself; report them to [devpi](https://github.com/devpi/devpi).
|
|
48
|
+
|
|
49
|
+
If you cannot tell which side a finding falls on, report it privately and we will decide.
|
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
# Threat model
|
|
2
|
+
|
|
3
|
+
This model says what devpi-process trusts, where untrusted input enters, and which guarantees hold at each boundary, so
|
|
4
|
+
a report can be classified as a vulnerability or a bug. [SECURITY.md](SECURITY.md) covers reporting; if the two
|
|
5
|
+
disagree, SECURITY.md wins and we fix this file.
|
|
6
|
+
|
|
7
|
+
## How devpi-process works
|
|
8
|
+
|
|
9
|
+
`IndexServer(path)` runs `devpi-init` to initialize a server directory with a random root password, starts
|
|
10
|
+
`devpi-server` on a free port at its default host, `localhost`, and drives the `devpi` client to log in as root, create
|
|
11
|
+
indexes and upload distributions. The three programs come from the interpreter's scripts directory and run with argument
|
|
12
|
+
lists, never a shell. Upstream PyPI is off unless `with_root_pypi` is set. When the context manager exits, the server
|
|
13
|
+
process stops.
|
|
14
|
+
|
|
15
|
+
```mermaid
|
|
16
|
+
flowchart LR
|
|
17
|
+
test["Test code<br/>(trusted)"] --> dp["devpi-process"]
|
|
18
|
+
dp -->|"devpi-init, devpi-server,<br/>devpi (argument lists)"| srv["devpi server on localhost"]
|
|
19
|
+
srv <--> dir[("Server directory")]
|
|
20
|
+
local["Other local users"] -.->|"can reach the port"| srv
|
|
21
|
+
classDef trusted fill:#cfe4ff,stroke:#1f6feb,color:#0b1f3a;
|
|
22
|
+
classDef boundary fill:#ffe3a3,stroke:#d29200,color:#3a2c00;
|
|
23
|
+
class test,dp trusted;
|
|
24
|
+
class srv,dir,local boundary;
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
## Compared with similar tools
|
|
28
|
+
|
|
29
|
+
We drew the boundary where comparable projects in other ecosystems draw theirs. The shared rule, stated by the
|
|
30
|
+
[Node.js threat model](https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model), is that a report
|
|
31
|
+
which first needs a trusted element compromised is out of scope; the first triage question, as
|
|
32
|
+
[DOMPurify](https://github.com/cure53/DOMPurify/blob/main/SECURITY.md#what-we-consider-a-vulnerability) puts it, is what
|
|
33
|
+
the attacker controls.
|
|
34
|
+
|
|
35
|
+
| Project | Language | Where it draws the line |
|
|
36
|
+
| --------------------------------------------------------------------------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------- |
|
|
37
|
+
| [Verdaccio](https://github.com/verdaccio/verdaccio/security/policy) | JavaScript | Private registry; reports go through Snyk. |
|
|
38
|
+
| [distribution (registry)](https://github.com/distribution/distribution/security/policy) | Go | The OCI registry used as a test fixture; private reports to its CNCF list. |
|
|
39
|
+
| [Vitest](https://github.com/vitest-dev/vitest/security/policy) | JavaScript | Trusts the developer, the config file, plugins and every project file; only reports that need no trusted element compromised count. |
|
|
40
|
+
|
|
41
|
+
## Trusted
|
|
42
|
+
|
|
43
|
+
An attacker who controls any of these already has what devpi-process could give them:
|
|
44
|
+
|
|
45
|
+
- The test code and every path, index name, argument and file it passes, `start_args` included.
|
|
46
|
+
- The devpi tools in the interpreter's scripts directory, and the packages uploaded.
|
|
47
|
+
|
|
48
|
+
## Untrusted inputs
|
|
49
|
+
|
|
50
|
+
| Input | Comes from | What devpi-process guarantees |
|
|
51
|
+
| --------------- | ------------------------------------- | ----------------------------------------------------------------------------------------------------- |
|
|
52
|
+
| Network clients | Anything that can connect to the port | The server listens on `localhost` unless `start_args` change it; uploads need the generated password. |
|
|
53
|
+
|
|
54
|
+
## Threats and controls
|
|
55
|
+
|
|
56
|
+
| STRIDE | Threat | Control |
|
|
57
|
+
| ---------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------------------- |
|
|
58
|
+
| Spoofing | Another process logs in as root. | A random root password is generated for each server. |
|
|
59
|
+
| Information disclosure | Another local user reads the root password. | Accepted risk: it is passed to `devpi-init` and `devpi login` on the command line. |
|
|
60
|
+
| Tampering | Caller data injects shell syntax into a devpi command. | Programs run with argument lists, never a shell. |
|
|
61
|
+
|
|
62
|
+
## Release chain
|
|
63
|
+
|
|
64
|
+
Releases run on the shared [tox-dev/github-workflows](https://github.com/tox-dev/github-workflows) pipeline. A release
|
|
65
|
+
App, not a person, pushes the release commit and tag; the build installs its tools from a hash-checked `pylock.toml`
|
|
66
|
+
resolved with a seven-day upload cooldown by default; PyPI receives the files through
|
|
67
|
+
[trusted publishing](https://docs.pypi.org/trusted-publishers/) with attestations, and the GitHub Release is immutable.
|
|
68
|
+
Every workflow pins third-party actions to a commit SHA.
|
|
69
|
+
|
|
70
|
+
## Vulnerability or bug
|
|
71
|
+
|
|
72
|
+
| Report | Verdict | Why |
|
|
73
|
+
| --------------------------------------------------------------- | ------------- | ------------------------------------------- |
|
|
74
|
+
| The server listens on `0.0.0.0` by default | Vulnerability | Exposes a test index to the network. |
|
|
75
|
+
| An index name with `;` runs a shell command | Vulnerability | Arguments must stay data. |
|
|
76
|
+
| Another user on a shared CI host sees the root password in `ps` | Accepted risk | Documented below; use a single-user runner. |
|
|
77
|
+
|
|
78
|
+
## Severity
|
|
79
|
+
|
|
80
|
+
- **High:** a caller value runs as a shell command, or the server listens beyond localhost without `start_args` asking
|
|
81
|
+
for it.
|
|
82
|
+
- **Medium:** server data written outside the caller's directory, or a program other than the devpi tools runs.
|
|
83
|
+
- **Low:** the server fails to stop, or leaves files behind, after the context manager exits.
|
|
84
|
+
|
|
85
|
+
## Accepted risks
|
|
86
|
+
|
|
87
|
+
- The root password is 8 letters from Python's `random`, and it is visible in the process list while `devpi-init` and
|
|
88
|
+
`devpi login` run. devpi-process is for tests on single-user machines and CI runners.
|
|
89
|
+
|
|
90
|
+
## Keeping this current
|
|
91
|
+
|
|
92
|
+
Revisit this model when devpi-process gains a new input source, network access, a new way to run code, or a new place it
|
|
93
|
+
writes to, and whenever an advisory is published.
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
version: 2
|
|
2
|
+
multi-ecosystem-groups:
|
|
3
|
+
dependencies:
|
|
4
|
+
schedule:
|
|
5
|
+
interval: weekly
|
|
6
|
+
day: tuesday
|
|
7
|
+
labels:
|
|
8
|
+
- dependencies
|
|
9
|
+
- skip news
|
|
10
|
+
updates:
|
|
11
|
+
- package-ecosystem: github-actions
|
|
12
|
+
directory: /
|
|
13
|
+
patterns:
|
|
14
|
+
- '*'
|
|
15
|
+
multi-ecosystem-group: dependencies
|
|
16
|
+
labels:
|
|
17
|
+
- dependencies
|
|
18
|
+
- skip news
|
|
19
|
+
cooldown:
|
|
20
|
+
default-days: 7
|
|
21
|
+
- package-ecosystem: pre-commit
|
|
22
|
+
directory: /
|
|
23
|
+
patterns:
|
|
24
|
+
- '*'
|
|
25
|
+
multi-ecosystem-group: dependencies
|
|
26
|
+
labels:
|
|
27
|
+
- dependencies
|
|
28
|
+
- skip news
|
|
29
|
+
cooldown:
|
|
30
|
+
default-days: 7
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
name: 🧪 check
|
|
2
|
+
on:
|
|
3
|
+
workflow_dispatch:
|
|
4
|
+
push:
|
|
5
|
+
branches: ["main"]
|
|
6
|
+
tags-ignore: ["**"]
|
|
7
|
+
pull_request:
|
|
8
|
+
types: [opened, synchronize, reopened]
|
|
9
|
+
schedule:
|
|
10
|
+
- cron: "0 8 * * *"
|
|
11
|
+
concurrency:
|
|
12
|
+
group: check-${{ github.ref }}
|
|
13
|
+
cancel-in-progress: true
|
|
14
|
+
permissions:
|
|
15
|
+
contents: read
|
|
16
|
+
jobs:
|
|
17
|
+
test:
|
|
18
|
+
name: 🧪 Test
|
|
19
|
+
uses: tox-dev/github-workflows/.github/workflows/check.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
20
|
+
permissions:
|
|
21
|
+
contents: read
|
|
22
|
+
with:
|
|
23
|
+
pytest-addopts: "-vv --durations=5"
|
|
24
|
+
include: |
|
|
25
|
+
[
|
|
26
|
+
{"env": "3.15"},
|
|
27
|
+
{"env": "3.15t", "python": "3.15t"},
|
|
28
|
+
{"env": "3.14", "python": "3.14"},
|
|
29
|
+
{"env": "3.13", "python": "3.13"},
|
|
30
|
+
{"env": "3.12", "python": "3.12"},
|
|
31
|
+
{"env": "3.11", "python": "3.11"},
|
|
32
|
+
{"env": "type"},
|
|
33
|
+
{"env": "dev"},
|
|
34
|
+
{"env": "pkg_meta"}
|
|
35
|
+
]
|
|
36
|
+
gate:
|
|
37
|
+
name: 🚦 Required checks pass
|
|
38
|
+
if: ${{ !cancelled() }} # codespell:ignore cancelled
|
|
39
|
+
needs: [test]
|
|
40
|
+
runs-on: ubuntu-26.04
|
|
41
|
+
permissions: {}
|
|
42
|
+
steps:
|
|
43
|
+
- name: 🚦 Require all needed jobs to pass
|
|
44
|
+
uses: tox-dev/github-workflows/required-checks@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
45
|
+
with:
|
|
46
|
+
needs: ${{ toJSON(needs) }}
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
name: 🛡️ CodeQL
|
|
2
|
+
on:
|
|
3
|
+
workflow_dispatch:
|
|
4
|
+
push:
|
|
5
|
+
branches: ["main"]
|
|
6
|
+
pull_request:
|
|
7
|
+
schedule:
|
|
8
|
+
- cron: "0 9 * * 2"
|
|
9
|
+
concurrency:
|
|
10
|
+
group: ${{ github.workflow }}-${{ github.ref }}
|
|
11
|
+
cancel-in-progress: true
|
|
12
|
+
permissions: {}
|
|
13
|
+
jobs:
|
|
14
|
+
analyze:
|
|
15
|
+
name: 🛡️ Analyze
|
|
16
|
+
uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
17
|
+
permissions:
|
|
18
|
+
contents: read
|
|
19
|
+
security-events: write
|
|
20
|
+
with:
|
|
21
|
+
languages: '["actions","python"]'
|
|
22
|
+
paths-ignore: '["tests"]'
|
|
@@ -2,11 +2,9 @@ name: 📝 Changelog
|
|
|
2
2
|
on:
|
|
3
3
|
pull_request:
|
|
4
4
|
types: [opened, reopened, synchronize, labeled, unlabeled]
|
|
5
|
-
concurrency:
|
|
6
|
-
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
7
|
-
cancel-in-progress: true
|
|
8
5
|
permissions:
|
|
9
6
|
contents: read
|
|
7
|
+
pull-requests: read
|
|
10
8
|
jobs:
|
|
11
9
|
changelog:
|
|
12
10
|
name: 📝 News fragment
|
|
@@ -18,15 +16,15 @@ jobs:
|
|
|
18
16
|
fetch-depth: 0
|
|
19
17
|
persist-credentials: false
|
|
20
18
|
- name: 🐍 Install uv
|
|
21
|
-
uses: astral-sh/setup-uv@
|
|
19
|
+
uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
|
|
22
20
|
with:
|
|
23
21
|
version: latest-known
|
|
24
22
|
python-version: "3.15"
|
|
25
23
|
enable-cache: false
|
|
26
24
|
- name: 📦 Install locked release tools
|
|
27
|
-
uses: tox-dev/github-workflows/install-locked-tools@
|
|
25
|
+
uses: tox-dev/github-workflows/install-locked-tools@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
28
26
|
with:
|
|
29
27
|
groups: release-news
|
|
30
28
|
venv: ${{ runner.temp }}/release-tools
|
|
31
29
|
- name: 🔍 Validate news fragments
|
|
32
|
-
uses: tox-dev/github-workflows/validate-news@
|
|
30
|
+
uses: tox-dev/github-workflows/validate-news@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
@@ -18,7 +18,7 @@ permissions:
|
|
|
18
18
|
jobs:
|
|
19
19
|
prepare:
|
|
20
20
|
name: 🏷️ Prepare Towncrier release
|
|
21
|
-
uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@
|
|
21
|
+
uses: tox-dev/github-workflows/.github/workflows/prepare-towncrier-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
22
22
|
with:
|
|
23
23
|
bump: ${{ inputs.bump }}
|
|
24
24
|
secrets:
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
name: 🚀 Release to PyPI
|
|
2
|
+
on:
|
|
3
|
+
push:
|
|
4
|
+
tags: ["*"]
|
|
5
|
+
permissions:
|
|
6
|
+
contents: read
|
|
7
|
+
concurrency:
|
|
8
|
+
group: release-${{ github.ref }}
|
|
9
|
+
cancel-in-progress: false
|
|
10
|
+
jobs:
|
|
11
|
+
build:
|
|
12
|
+
name: 🏗️ Build
|
|
13
|
+
uses: tox-dev/github-workflows/.github/workflows/validate-python-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
14
|
+
permissions:
|
|
15
|
+
contents: read
|
|
16
|
+
notes:
|
|
17
|
+
name: 📝 Render GitHub Release notes
|
|
18
|
+
uses: tox-dev/github-workflows/.github/workflows/release-notes.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
19
|
+
permissions:
|
|
20
|
+
contents: read
|
|
21
|
+
with:
|
|
22
|
+
tag: ${{ github.ref_name }}
|
|
23
|
+
changelog: CHANGELOG.md
|
|
24
|
+
artifact-url: https://pypi.org/project/devpi-process/${{ github.ref_name }}/
|
|
25
|
+
release:
|
|
26
|
+
name: 🚀 Publish to PyPI
|
|
27
|
+
needs:
|
|
28
|
+
- build
|
|
29
|
+
- notes
|
|
30
|
+
runs-on: ubuntu-26.04
|
|
31
|
+
environment:
|
|
32
|
+
name: release
|
|
33
|
+
url: https://pypi.org/project/devpi-process/${{ github.ref_name }}
|
|
34
|
+
permissions:
|
|
35
|
+
id-token: write # PyPI verifies this workflow through OIDC.
|
|
36
|
+
steps:
|
|
37
|
+
- name: 📩 Download distributions
|
|
38
|
+
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
|
39
|
+
with:
|
|
40
|
+
artifact-ids: ${{ needs.build.outputs.distributions-artifact-id }}
|
|
41
|
+
path: dist/
|
|
42
|
+
- name: 🚀 Publish to PyPI
|
|
43
|
+
uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
|
|
44
|
+
with:
|
|
45
|
+
packages-dir: dist
|
|
46
|
+
github-release:
|
|
47
|
+
name: 🚀 Publish GitHub Release
|
|
48
|
+
needs: [build, release, notes]
|
|
49
|
+
uses: tox-dev/github-workflows/.github/workflows/github-release.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
50
|
+
permissions:
|
|
51
|
+
contents: write # GitHub Release creation and edits require this permission.
|
|
52
|
+
with:
|
|
53
|
+
project: devpi-process
|
|
54
|
+
version: ${{ github.ref_name }}
|
|
55
|
+
tag: ${{ github.ref_name }}
|
|
56
|
+
artifact-pattern: python-package-distributions
|
|
57
|
+
notes-artifact-id: ${{ needs.notes.outputs.artifact-id }}
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
name: 🛡️ scorecard
|
|
2
|
+
on:
|
|
3
|
+
branch_protection_rule:
|
|
4
|
+
schedule:
|
|
5
|
+
- cron: "30 7 * * 2"
|
|
6
|
+
push:
|
|
7
|
+
branches: ["main"]
|
|
8
|
+
workflow_dispatch:
|
|
9
|
+
concurrency:
|
|
10
|
+
group: ${{ github.workflow }}-${{ github.ref }}
|
|
11
|
+
cancel-in-progress: true
|
|
12
|
+
permissions: {}
|
|
13
|
+
jobs:
|
|
14
|
+
analysis:
|
|
15
|
+
name: 🛡️ Scorecard analysis
|
|
16
|
+
if: github.repository == 'tox-dev/devpi-process'
|
|
17
|
+
permissions:
|
|
18
|
+
actions: read # read workflow runs for the Packaging check
|
|
19
|
+
checks: read # read check runs for the CI-Tests and SAST checks
|
|
20
|
+
contents: read # check out and scan the repository
|
|
21
|
+
id-token: write # authenticate the results published to the scorecard API
|
|
22
|
+
issues: read # read issue activity for the Maintained check
|
|
23
|
+
pull-requests: read # read reviews for the Code-Review check
|
|
24
|
+
security-events: write # upload the SARIF results to code scanning
|
|
25
|
+
statuses: read # read commit statuses for the CI-Tests check
|
|
26
|
+
uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
@@ -10,7 +10,7 @@ concurrency:
|
|
|
10
10
|
jobs:
|
|
11
11
|
upgrade:
|
|
12
12
|
name: 🔀 Upgrade release tools
|
|
13
|
-
uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@
|
|
13
|
+
uses: tox-dev/github-workflows/.github/workflows/upgrade-release-tools.yaml@bceb5c005e19823dc8835f536f53f172ae223927 # 6.5.0
|
|
14
14
|
permissions:
|
|
15
15
|
contents: read
|
|
16
16
|
secrets:
|
|
@@ -9,7 +9,7 @@ repos:
|
|
|
9
9
|
- id: end-of-file-fixer
|
|
10
10
|
- id: trailing-whitespace
|
|
11
11
|
- repo: https://github.com/python-jsonschema/check-jsonschema
|
|
12
|
-
rev:
|
|
12
|
+
rev: a76b92851fc9eede9f9bc4073eb55202f34eb0df # frozen: 0.39.0
|
|
13
13
|
hooks:
|
|
14
14
|
- id: check-github-workflows
|
|
15
15
|
args: ["--verbose"]
|
|
@@ -26,7 +26,7 @@ repos:
|
|
|
26
26
|
hooks:
|
|
27
27
|
- id: pyproject-fmt
|
|
28
28
|
- repo: https://github.com/astral-sh/ruff-pre-commit
|
|
29
|
-
rev:
|
|
29
|
+
rev: 25bcf95026b96e2dd3c0aec3090c3d6ef6ca2e6c # frozen: v0.17.3
|
|
30
30
|
hooks:
|
|
31
31
|
- id: ruff-format
|
|
32
32
|
- id: ruff-check
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.5
|
|
2
2
|
Name: devpi-process
|
|
3
|
-
Version: 1.3.
|
|
3
|
+
Version: 1.3.3
|
|
4
4
|
Import-Name: devpi_process
|
|
5
5
|
Summary: devpi process provides a programmatic API to create and use a devpi server process
|
|
6
6
|
Project-URL: Changelog, https://github.com/tox-dev/devpi-process/blob/main/CHANGELOG.md
|
|
@@ -41,6 +41,8 @@ See the [changelog](https://github.com/tox-dev/devpi-process/blob/main/CHANGELOG
|
|
|
41
41
|
[](https://pepy.tech/project/devpi-process)
|
|
42
42
|
[](https://opensource.org/licenses/MIT)
|
|
43
43
|
[](https://github.com/tox-dev/devpi-process/actions/workflows/check.yaml)
|
|
44
|
+
[](https://scorecard.dev/viewer/?uri=github.com/tox-dev/devpi-process)
|
|
45
|
+
[](https://www.bestpractices.dev/projects/16263)
|
|
44
46
|
|
|
45
47
|
Allows you to create [devpi](https://devpi.net/docs/devpi/devpi/stable/+d/index.html) server process with indexes, and
|
|
46
48
|
upload artifacts to that programmatically.
|
|
@@ -8,6 +8,8 @@ See the [changelog](CHANGELOG.md) for released changes and [contributing guide](
|
|
|
8
8
|
[](https://pepy.tech/project/devpi-process)
|
|
9
9
|
[](https://opensource.org/licenses/MIT)
|
|
10
10
|
[](https://github.com/tox-dev/devpi-process/actions/workflows/check.yaml)
|
|
11
|
+
[](https://scorecard.dev/viewer/?uri=github.com/tox-dev/devpi-process)
|
|
12
|
+
[](https://www.bestpractices.dev/projects/16263)
|
|
11
13
|
|
|
12
14
|
Allows you to create [devpi](https://devpi.net/docs/devpi/devpi/stable/+d/index.html) server process with indexes, and
|
|
13
15
|
upload artifacts to that programmatically.
|