Skip to content

feat: djc-safe-eval - Jinja's sandboxed python expression evaluation #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 11 commits into
base: main
Choose a base branch
from
Open

feat: djc-safe-eval - Jinja's sandboxed python expression evaluation #17

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
d5e4993
feat: djc-safe-eval - Jinja's sandboxed python expression evaluation
JuroOravec Nov 3, 2025
9c3f07f
docs: add comment on perfomance
JuroOravec Nov 3, 2025
7ea78f9
refactor: initialize git submodule before running tests
JuroOravec Nov 3, 2025
0503d24
refactor: fix missing deps and imports
JuroOravec Nov 3, 2025
32d7af9
Merge branch 'main' into jo-feat-safe-eval
JuroOravec Nov 3, 2025
76ad82e
refactor: do not run tests for crates in submodules
JuroOravec Nov 3, 2025
1c9f09d
refactor: fix to run tests only for our create in CI
JuroOravec Nov 3, 2025
41bfc1c
refactor: updated types to work with 3.8
JuroOravec Nov 3, 2025
0e14b4e
refactor: fix tests with t-strings for py3.14
JuroOravec Nov 3, 2025
d8c9b42
refactor: allow walrus assignment inside lambdas
JuroOravec Nov 4, 2025
efe8e8c
refactor: simplify compile/eval
JuroOravec Nov 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ jobs:

steps:
- uses: actions/checkout@v5
with:
# Initialize Ruff submodule
submodules: recursive

# First check Rust tests
- name: Install Rust toolchain
Expand All @@ -30,7 +33,20 @@ jobs:
uses: Swatinem/rust-cache@v2

- name: Run Rust tests
run: cargo test
shell: bash
run: |
# Build cargo test command with -p flags for each package
# We do so because the ruff submodule also contains crates and those will
# run if we don't limit the tests to only our packages.
# And `cargo test` command doesn't allow to exclude crates based on patterns.
#
# 1. Get all directories in our `crates/` folder
packages=$(find crates -maxdepth 1 -mindepth 1 -type d | \
Copy link
Contributor Author

@JuroOravec JuroOravec Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This relates to testing in CI.

So since the djc-safe-eval package contains ruff dependencies as git submodules, then simply calling cargo test will also run tests for those ruff packages. And there is one that fails. And because this is in CI, it blocked the pipeline.

So I wanted to exclude the Ruff packages from running their tests when in CI.

But the problem is that cargo test doesn't allow to exclude packages by pattern. Then I could've used ^ruff and call it a day.

Second option was to list all local packages, so only our packages run. But that's not a good design - I'm 100% that I'd forget to add a new Rust package to this file if I created one.

So the compromise here is to have a bit of script that lists all OUR packages (those in crates/), and then format the cargo test command to use only those packages:
cargo test -p <package> -p <package>

sed 's/crates\///' | \
tr '\n' ' ')
echo "Running tests for packages: $packages"
# 2. Format as `cargo test -p <package> -p <package> ...`
cargo test $(echo "$packages" | sed 's/\([^ ]*\)/-p \1/g')

# After Rust tests pass, run Python tests next
- name: Set up Python ${{ matrix.python-version }}
Expand Down
4 changes: 4 additions & 0 deletions .gitmodules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
[submodule "crates/djc-safe-eval/submodules/ruff"]
path = crates/djc-safe-eval/submodules/ruff
url = https://github.com/astral-sh/ruff.git
# tag = 0.14.0
Copy link
Contributor Author

@JuroOravec JuroOravec Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was the first time that I was using git modules. I'm surprised that it's actually managed quite implicitly?

To change a commit/tag/branch of the "submodule", you have to:

  1. Navigate to that directory, e.g. crates/djc-safe-eval/submodules/ruff
  2. Use regular git commands to change the current head, e.g. git checkout 0.15.0
  3. And then navigate back and commit the change: 
    cd ../../..
git add .gitmodules crates/djc-safe-eval/submodules/ruff
git commit -m "Update Ruff submodule to 0.15.0"

What I find strange about this is that you have to use git to find out what commit/tag/branch the submodule is on.

That's why I adding this tag = 0.14.0 comment, to keep these git submodules "pinned".

I documented the entire process in djc-safe-eval's README.

Loading
Loading