http-api-tool 1.1.4__tar.gz → 1.1.5__tar.gz

{http_api_tool-1.1.4 → http_api_tool-1.1.5}/.github/workflows/build-test.yaml

@@ -655,7 +655,32 @@ jobs:
         env:
           STEPS_GO_HTTPBIN_OUTPUTS_SERVICE_URL: ${{ steps.go-httpbin.outputs.service-url }}
 
+      # setup-uv in the action must neither start an interpreter from the
+      # caller's workspace nor read its uv settings. Each planted
+      # interpreter records that it ran, and the uv.toml's
+      # required-version would fail the action.
+      - name: Plant interpreters and uv settings in the workspace
+        run: |
+          set -euo pipefail
+          marker="$RUNNER_TEMP/planted-ran"
+          stub() {
+            # $0 and $* expand when the stub runs, not here.
+            # shellcheck disable=SC2016
+            printf '#!/bin/sh\necho "%s: $0 $*" >> "%s"\nexit 1\n' \
+              "$1" "$marker" > "$2"
+            chmod +x "$2"
+          }
+          mkdir -p .venv/bin planted
+          printf 'home = /usr/bin\nversion_info = 3.12.0\n' > .venv/pyvenv.cfg
+          stub venv .venv/bin/python3
+          stub venv .venv/bin/python
+          stub python-version planted/python3
+          echo "$GITHUB_WORKSPACE/planted/python3" > .python-version
+          printf '%s\n' 'cache-dir = "/nonexistent/planted-cache"' \
+            'required-version = "==0.0.1"' > uv.toml
+
       - name: Test uvx deployment with host URL
+        id: uvx-get
         uses: $/
         with:
           deploy: 'uvx'
@@ -703,6 +728,87 @@ jobs:
           verify_ssl: 'false'
           debug: 'true'
 
+      - name: Check uvx results and that no planted interpreter ran
+        env:
+          HTTP_CODE: ${{ steps.uvx-get.outputs.response_http_code }}
+        run: |
+          set -euo pipefail
+          marker="$RUNNER_TEMP/planted-ran"
+          if [[ -e "$marker" ]]; then
+            echo "::error::A planted workspace interpreter ran:"
+            cat "$marker"
+            exit 1
+          fi
+          if [[ "$HTTP_CODE" != "200" ]]; then
+            echo "::error::Unexpected response_http_code: '$HTTP_CODE'"
+            exit 1
+          fi
+          rm -rf .venv planted .python-version uv.toml
+
+      # The same check with the action checked out inside the workspace
+      # ('uses: ./...'), as a caller that vendors it would. The planted
+      # files sit in the workspace root, the action directory's parent,
+      # where only the step's UV_* settings keep uv from using them.
+      - name: Checkout this action into the workspace
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: 'local-action'
+          persist-credentials: false
+
+      - name: Plant interpreters and uv settings above the action
+        run: |
+          set -euo pipefail
+          marker="$RUNNER_TEMP/planted-ran"
+          stub() {
+            # $0 and $* expand when the stub runs, not here.
+            # shellcheck disable=SC2016
+            printf '#!/bin/sh\necho "%s: $0 $*" >> "%s"\nexit 1\n' \
+              "$1" "$marker" > "$2"
+            chmod +x "$2"
+          }
+          mkdir -p .venv/bin planted
+          printf 'home = /usr/bin\nversion_info = 3.12.0\n' > .venv/pyvenv.cfg
+          stub venv .venv/bin/python3
+          stub venv .venv/bin/python
+          stub python-version planted/python3
+          echo "$GITHUB_WORKSPACE/planted/python3" > .python-version
+          printf '%s\n' 'cache-dir = "/nonexistent/planted-cache"' \
+            'required-version = "==0.0.1"' > uv.toml
+
+      - name: Test uvx deployment from the workspace copy
+        id: uvx-local
+        # The local path is the point of this step: '$/' would download
+        # the action outside the workspace, as the steps above do.
+        uses: ./local-action  # zizmor: ignore[self-repository]
+        with:
+          deploy: 'uvx'
+          url: '${{ steps.test-urls.outputs.host-url }}/get'
+          service_name: 'UVX Local Copy Test'
+          expected_http_code: 200
+          retries: 3
+          initial_sleep_time: 1
+          verify_ssl: 'false'
+          debug: 'true'
+
+      - name: Check the workspace copy and that nothing planted ran
+        env:
+          HTTP_CODE: ${{ steps.uvx-local.outputs.response_http_code }}
+        run: |
+          set -euo pipefail
+          marker="$RUNNER_TEMP/planted-ran"
+          if [[ -e "$marker" ]]; then
+            echo "::error::A planted workspace interpreter ran:"
+            cat "$marker"
+            exit 1
+          fi
+          if [[ "$HTTP_CODE" != "200" ]]; then
+            echo "::error::Unexpected response_http_code: '$HTTP_CODE'"
+            exit 1
+          fi
+          # local-action/ stays: the runner reads its action.yaml again
+          # for the post-job cleanup of a local action.
+          rm -rf .venv planted .python-version uv.toml
+
       - name: Verify both deployment modes work
         run: |
           echo "=== Deployment Mode Test Summary ==="

{http_api_tool-1.1.4 → http_api_tool-1.1.5}/.github/workflows/release-drafter.yaml

@@ -28,7 +28,7 @@ jobs:
       # organisation's .github repository and publish it as
       # $CONNECTION_ALLOW_LIST for the harden-runner step below.
       # yamllint disable-line rule:line-length
-      - uses: lfreleng-actions/harden-runner-block-action@d01dcdad980f826d4099289e2014126465580807  # v0.14.1
+      - uses: lfreleng-actions/harden-runner-block-action@2fed66c9c36c4687c31ca349b925b81ec629673f  # v0.15.0
         with:
           config: '@6d4a65c5601afd6c2fbe52bda4b0024b132f265d'  # v0.19.0
 

{http_api_tool-1.1.4 → http_api_tool-1.1.5}/.github/workflows/security-scans.yaml

@@ -34,24 +34,28 @@ jobs:
     permissions:
       contents: read  # Reusable scan job checks out the repo
     # yamllint disable-line rule:line-length
-    uses: lfit/releng-reusable-workflows/.github/workflows/reuse-sonatype-lifecycle.yaml@e3bb02dd0d2e5027cde63732fe00f591d6ecec03  # v0.11.0
+    uses: lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml@378fcc19ebdf37f17fde4888d4b71c83b21d6cf3  # v0.9.7
+    # Nexus IQ cannot read pyproject.toml or uv.lock, so have the lane
+    # resolve uv.lock and scan the downloaded artefacts. Python 3.11
+    # matches the python:3.11-slim image and the requires-python floor;
+    # pinning it stops a new Python release without wheels from breaking
+    # resolution.
+    with:
+      build_type: 'python'
+      python_version: '3.11'
     # Neither scan writes a cache; deny writes under branch_protection_rule
     cache-mode: read
     secrets:
-      NEXUS_IQ_PASSWORD: ${{ secrets.NEXUS_IQ_PASSWORD }}
+      nexus_iq_password: ${{ secrets.NEXUS_IQ_PASSWORD }}
 
   # Scan results are found at: https://sonarcloud.io/login
   sonarqube-cloud:
     name: "SonarQube Cloud"
     # yamllint disable-line rule:line-length
-    uses: lfit/releng-reusable-workflows/.github/workflows/reuse-sonarqube-cloud.yaml@e3bb02dd0d2e5027cde63732fe00f591d6ecec03  # v0.11.0
+    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@378fcc19ebdf37f17fde4888d4b71c83b21d6cf3  # v0.9.7
     # Neither scan writes a cache; deny writes under branch_protection_rule
     cache-mode: read
     permissions:
       contents: read  # Reusable scan job checks out the repo
-      security-events: write  # Upload results to the code-scanning dashboard
-      id-token: write  # Publish results and obtain a badge via OIDC
-      # Uncomment the permission below if installing in a private repository.
-      # actions: read
     secrets:
-      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      sonar_token: ${{ secrets.SONAR_TOKEN }}

{http_api_tool-1.1.4 → http_api_tool-1.1.5}/.pre-commit-config.yaml

@@ -73,7 +73,7 @@ repos:
         args: [--config-file=.yamllint]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: f368fb366ff7f2f808dd324b83a6d32267799e19  # frozen: v0.17.2
+    rev: 25bcf95026b96e2dd3c0aec3090c3d6ef6ca2e6c  # frozen: v0.17.3
     hooks:
       - id: ruff
         files: ^(src|tests|scripts)/.+\.py$
@@ -82,7 +82,7 @@ repos:
         files: ^(src|tests|scripts)/.+\.py$
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 2834ec6639549dd6796205c8f011dedcd587288b  # frozen: v2.4.0
+    rev: ad26ebfa797fcb9b8f83275937c1c1d6e126719c  # frozen: v2.4.1
     hooks:
       - id: mypy
         additional_dependencies: [types-pycurl]
@@ -112,7 +112,7 @@ repos:
         args: ["--fix"]
 
   - repo: https://github.com/fsfe/reuse-tool
-    rev: 9fabf9eb815a57aac116b435e8346c200cdb8604  # frozen: v6.2.0
+    rev: bffd9abdccdd86e7926c871a31564913547552c9  # frozen: v6.3.0
     hooks:
       - id: reuse
 
@@ -133,7 +133,7 @@ repos:
       - id: basedpyright
 
   - repo: https://github.com/lfreleng-actions/gha-workflow-linter
-    rev: 6431fe01a4f1b978de418160cc7caa6a24f6df76  # frozen: v1.10.0
+    rev: 00aec232d3fd85436fff24dfeaad23921c5db1cb  # frozen: v1.10.1
     hooks:
       - id: gha-workflow-linter
         args: [lint, .]
@@ -149,7 +149,7 @@ repos:
         always_run: true
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 4f85d46a92dc17713078e5de73f8a13190edf6fc  # frozen: 0.38.2
+    rev: 39478bf2c099a58683d3f1aedf675105318b078d  # frozen: 0.39.0
     hooks:
       - id: check-github-actions
       - id: check-github-workflows

{http_api_tool-1.1.4 → http_api_tool-1.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: http-api-tool
-Version: 1.1.4
+Version: 1.1.5
 Summary: A Python HTTP/HTTPS API testing tool for GitHub Actions and CLI usage
 Project-URL: Homepage, https://github.com/lfreleng-actions/http-api-tool-docker
 Project-URL: Repository, https://github.com/lfreleng-actions/http-api-tool-docker

{http_api_tool-1.1.4 → http_api_tool-1.1.5}/action.yaml

@@ -166,10 +166,20 @@ runs:
     # UVX deployment path (default)
     - name: Install uv for uvx deployment
       if: inputs.deploy == 'uvx'
+      # setup-uv runs the interpreter 'uv python find' returns for its
+      # working directory and reads uv settings (required-version,
+      # cache-dir) there; the default is the caller's workspace. Point it
+      # at this action's own files. The UV_* settings cover an action
+      # loaded from inside the workspace ('uses: ./').
       uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2  # v10.3.3
+      env:
+        UV_NO_CONFIG: "1"
+        UV_SYSTEM_PYTHON: "1"
+        UV_NO_PROJECT: "1"
       with:
         enable-cache: false
         ignore-empty-workdir: true
+        working-directory: ${{ github.action_path }}
 
     - name: Run http-api-tool via uvx
       if: inputs.deploy == 'uvx'

{http_api_tool-1.1.4 → http_api_tool-1.1.5}/src/http_api_tool/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.1.4'
-__version_tuple__ = version_tuple = (1, 1, 4)
+__version__ = version = '1.1.5'
+__version_tuple__ = version_tuple = (1, 1, 5)
 
 __commit_id__ = commit_id = None

http_api_tool-1.1.4/.github/workflows/codeql.yml

@@ -1,35 +0,0 @@
----
-# SPDX-License-Identifier: Apache-2.0
-# SPDX-FileCopyrightText: 2025 The Linux Foundation
-
-name: 'CodeQL'
-# Must be called codeql.yml NOT codeql.yaml or GitHub will ignore it
-
-on:
-  workflow_dispatch:
-  push:
-    branches: ['main', 'master']
-    paths:
-      - '!.github/**'
-      - '!.docs/**'
-  schedule:
-    - cron: '40 4 * * 0'
-
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: true
-
-jobs:
-  codeql:
-    name: 'CodeQL'
-    permissions:
-      contents: read  # checkout
-      security-events: write  # upload results to code scanning
-      packages: read  # fetch internal or private CodeQL packs
-      actions: read  # the upload reads run info on private repositories
-    # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/security-workflows/.github/workflows/codeql.yaml@378fcc19ebdf37f17fde4888d4b71c83b21d6cf3  # v0.9.7
-    with:
-      languages: 'python,actions'