mirror of
https://github.com/github/spec-kit.git
synced 2026-08-15 14:02:04 +02:00
2df78f33fb
* fix: provision Python test deps for bug-test workflow * test: anchor bug-test workflow domain assertions Address CodeQL py/incomplete-url-substring-sanitization alerts (14-17) by anchoring the PyPI domain assertions to their structural context: the `network.allowed` YAML list items in the source and the quoted JSON entries in the compiled lock. This defeats the incomplete-URL-substring pattern and strengthens the test to confirm the domains are real allowlist entries rather than incidental substrings. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b54442f-ccc5-4be1-a05c-b360889670e5 * fix: provision test deps without creating a project lock Replace `uv sync --extra test` with `uv pip install --system -e ".[test]"` in the bug-test provisioning step. `uv sync` writes a root `uv.lock` (and `.venv`) into the working tree. This repository intentionally has no `uv.lock`/`[tool.uv]` (uv.lock is gitignored), so the sync produced an untracked lockfile before the agent checks out the fix ref in Step 2. `uv pip install` installs the test extra into the runner's Python without generating a project lock, keeping the working tree clean before the fix checkout. The editable install means the agent's `python3 -m pytest` runs against the checked-out fix code. Recompiled the lock and updated the assertions accordingly. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b54442f-ccc5-4be1-a05c-b360889670e5 * chore(workflows): sync gh-aw action-pin metadata to latest across all workflows Dependabot bumps the third-party action `uses:` pins (and header comments) directly, but does not update gh-aw's own metadata: the per-file `gh-aw-manifest` JSON blob and the shared `.github/aw/actions-lock.json` pin cache. As a result the executing pins were already uniform and current (checkout v7.0.1, setup-node v7.0.0) while the manifest/cache metadata still recorded checkout v6.0.3 / setup-node v6.4.0. This is a latent downgrade hazard: a plain `gh aw compile` reads the stale cache and can silently revert the `uses:` lines back to the older pins, undoing Dependabot's bumps and breaking lockstep. Sync all four pin surfaces (uses / header comment / manifest / cache) to the current pins so every workflow agrees and a future recompile is a no-op: - actions-lock.json: checkout v6.0.3 -> v7.0.1, setup-node v6.4.0 -> v7.0.0, and add the setup-python v7.0.0 + setup-uv v9.0.0 entries now used by bug-test. - gh-aw-manifest blobs in the 5 non-bug-test lock files: checkout + setup-node bumped to match their own uses lines (bug-test was already current). No workflow body changes; only pin metadata. `uses:` pins are unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b54442f-ccc5-4be1-a05c-b360889670e5 Assisted-by: GitHub Copilot (model: Claude Opus 4.8, supervised) --------- Co-authored-by: root <kinsonnee@gmail.com> Co-authored-by: Manfred Riem <15701806+mnriem@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7b54442f-ccc5-4be1-a05c-b360889670e5
45 lines
1.3 KiB
JSON
45 lines
1.3 KiB
JSON
{
|
|
"entries": {
|
|
"actions/checkout@v7.0.1": {
|
|
"repo": "actions/checkout",
|
|
"version": "v7.0.1",
|
|
"sha": "3d3c42e5aac5ba805825da76410c181273ba90b1"
|
|
},
|
|
"actions/download-artifact@v8.0.1": {
|
|
"repo": "actions/download-artifact",
|
|
"version": "v8.0.1",
|
|
"sha": "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
|
|
},
|
|
"actions/github-script@v9.0.0": {
|
|
"repo": "actions/github-script",
|
|
"version": "v9.0.0",
|
|
"sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
|
|
},
|
|
"actions/setup-node@v7.0.0": {
|
|
"repo": "actions/setup-node",
|
|
"version": "v7.0.0",
|
|
"sha": "820762786026740c76f36085b0efc47a31fe5020"
|
|
},
|
|
"actions/setup-python@v7.0.0": {
|
|
"repo": "actions/setup-python",
|
|
"version": "v7.0.0",
|
|
"sha": "5fda3b95a4ea91299a34e894583c3862153e4b97"
|
|
},
|
|
"astral-sh/setup-uv@v9.0.0": {
|
|
"repo": "astral-sh/setup-uv",
|
|
"version": "v9.0.0",
|
|
"sha": "c771a70e6277c0a99b617c7a806ffedaca235ff9"
|
|
},
|
|
"actions/upload-artifact@v7.0.1": {
|
|
"repo": "actions/upload-artifact",
|
|
"version": "v7.0.1",
|
|
"sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
|
|
},
|
|
"github/gh-aw-actions/setup@v0.79.8": {
|
|
"repo": "github/gh-aw-actions/setup",
|
|
"version": "v0.79.8",
|
|
"sha": "c0338fef4749d08c21f8f975fb0e37efa17dda47"
|
|
}
|
|
}
|
|
}
|