Skip to content

Fix code scanning alert - Harden with Pinned-Dependencies for test #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
37 of 38 tasks
reactive-firewall opened this issue Jul 11, 2024 · 2 comments
Open
37 of 38 tasks

Fix code scanning alert - Harden with Pinned-Dependencies for test #40

reactive-firewall opened this issue Jul 11, 2024 · 2 comments
Assignees
@reactive-firewall
Labels
CI Continuous Integration Tooling Configs Improvements or additions to configuration enhancement Linter Any linter tool or setting file enhancements Python Lang Changes to Python source code Python Repo Anything Project Related Testing Something can be verified
Milestone
Deepsource approval

Comments

@reactive-firewall
Copy link
Owner

reactive-firewall commented Jul 11, 2024 •
edited
Loading

should use a tests-requirements.txt file for pinning test dependencies and ensure versions/hashs are noted when possible.

Tracking issue for:
@reactive-firewall reactive-firewall added enhancement Python Lang Changes to Python source code Linter Any linter tool or setting file enhancements Configs Improvements or additions to configuration Testing Something can be verified CI Continuous Integration Tooling Python Repo Anything Project Related labels Jul 11, 2024
@reactive-firewall reactive-firewall self-assigned this Jul 11, 2024
@reactive-firewall reactive-firewall mentioned this issue Jul 12, 2024
Closed
reactive-firewall added a commit that referenced this issue Jul 12, 2024
@reactive-firewall
Bump version of GH checkout action ( - WIP #40 / WIP #44 - )
27fda62
reactive-firewall added a commit that referenced this issue Jul 12, 2024
@reactive-firewall
Bump version of GH setup-pytho action ( - WIP #40 - )
f05f805
reactive-firewall added a commit that referenced this issue Jul 13, 2024
@reactive-firewall
Merge branch 'security-fix-5' into 'security-fix-4'
7ae0ada 
* security-fix-5:
  Bump version  of GH setup-pytho action ( - WIP #40  - )
  Bump version  of GH checkout action ( - WIP #40 / WIP #44 - )

Updates checkout to version v4+
Updates setup-python to 5+
@reactive-firewall reactive-firewall mentioned this issue Jul 13, 2024
Merged
reactive-firewall added a commit that referenced this issue Jul 13, 2024
@reactive-firewall
Harden default permissions of GH actions ( - Fixes #39 and #40 - )
86d4374 
* Harden default permissions of GH actions ( - Fixes #39 - )
* Bump version  of GH checkout action ( - WIP #40 / WIP #44 - )
* Bump version  of GH setup-pytho action ( - Fixes #44  - )
* Simplify eager triggers of GH actions ( - Resolves #42 - )
reactive-firewall added a commit that referenced this issue Aug 21, 2024
@reactive-firewall
Squashed commit of the following:
8eee18d 
commit e115972
Author: Mr. Walls <[email protected]>
Date:   Tue Aug 20 16:14:39 2024 -0700

    Fixup for PR #60 to no-longer run python3.11 coverage twice in github CI (- Fixes #61 -)

commit 2abeec2
Author: Mr. Walls <[email protected]>
Date:   Tue Aug 20 15:41:11 2024 -0700

    House Keeping for PR #34

    Includes:
    - Fixes for https://github.com/reactive-firewall/python-repo/pull/34/files#r1722492778
    - Fixes for https://github.com/reactive-firewall/python-repo/pull/34/files#r1722494177
    - Fixes for https://github.com/reactive-firewall/python-repo/pull/34/files#r1722506148

commit ded92be
Author: Mr. Walls <[email protected]>
Date:   Mon Aug 19 15:05:38 2024 -0700

    Fixup for CI regarding duplicate python3.11 test results. (- Fixes #38 -)

commit 56874d1
Author: Mr. Walls <[email protected]>
Date:   Mon Aug 19 14:56:27 2024 -0700

    Fixup for CI to use latest archive upload and codecov actions.

commit 9e8b6bf
Merge: 4c7f247 b34116b
Author: Mr. Walls <[email protected]>
Date:   Mon Aug 19 14:31:36 2024 -0700

    Sync branch with 'master'

    * master:
      Minor fixup to ignore PTC-W0020 to maintain clearity in source.
      Fix up deepsource complaints (#57)

commit b34116b
Author: reactive-firewall <[email protected]>
Date:   Mon Aug 19 14:24:33 2024 -0700

    Minor fixup to ignore PTC-W0020 to maintain clearity in source.

commit 4416fbb
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 22:58:55 2024 -0700

    Fix up deepsource complaints (#57)

    Include Various Hotfixes:
    * Refactor pointless global doctoring to muzzle linter PYL-W0105 (- Fixes #54 -)
    * Resolves PYL-W0107 (- Fixes #55 -)
    * Fix Anti-pattern PYL-R0123 (- Fixes #53 -)
    * Resolve conflicting style-linting (- WIP #56 -)
    * Resolves PYL-W1503 (- Fixes #56 -)

commit 4c7f247
Merge: 1f0c4d8 07ab567
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 22:46:19 2024 -0700

    Merge branch 'master' into fix-up-deepsource

commit 07ab567
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 22:17:09 2024 -0700

    Resolves PYL-W1503 (- Fixes #56 -)

commit d6be075
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 22:07:52 2024 -0700

    Resolve conflicting style-linting (- WIP #56 -)

commit ac95909
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 21:44:41 2024 -0700

    Fix Anti-pattern PYL-R0123 (- Fixes #53 -)

commit fdcd9d9
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 21:38:17 2024 -0700

    Resolves PYL-W0107 (- Fixes #55 -)

commit 3ebab3c
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 21:30:08 2024 -0700

    Refactor pointless global doctoring to muzzle linter PYL-W0105 (- Fixes #54 -)

commit 1f0c4d8
Merge: f0a2ad4 ee529c3 5884c16 ef508d4 c7c8a17
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 22:22:46 2024 -0700

    Include 'Hotfix-114-B', 'Hotfix-114-C', 'Hotfix-114-D' and 'Hotfix-114-E' into fix-up-deepsource

    * Hotfix-114-B:
      Refactor pointless global doctoring to muzzle linter PYL-W0105 (- Fixes #54 -)

    * Hotfix-114-C:
      Resolves PYL-W0107 (- Fixes #55 -)

    * Hotfix-114-D:
      Fix Anti-pattern PYL-R0123 (- Fixes #53 -)

    * Hotfix-114-E:
      Resolves PYL-W1503 (- Fixes #56 -)
      Resolve conflicting style-linting (- WIP #56 -)

commit c7c8a17
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 22:17:09 2024 -0700

    Resolves PYL-W1503 (- Fixes #56 -)

commit 082f624
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 22:07:52 2024 -0700

    Resolve conflicting style-linting (- WIP #56 -)

commit ef508d4
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 21:44:41 2024 -0700

    Fix Anti-pattern PYL-R0123 (- Fixes #53 -)

commit 5884c16
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 21:38:17 2024 -0700

    Resolves PYL-W0107 (- Fixes #55 -)

commit ee529c3
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 21:30:08 2024 -0700

    Refactor pointless global doctoring to muzzle linter PYL-W0105 (- Fixes #54 -)

commit 470ee5f
Merge: 03ba956 f0a2ad4
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 19:58:29 2024 -0700

    Merge pull request #52 from reactive-firewall/fix-up-deepsource

    Minor Update to resolve linter issues:

    - PYL-W0622 ( see  #50 )
    - FLK-D204
    - FLK-D209
    - `codecov.yml` refactor for current syntax
    All changes are trivial and stylistic.

commit f0a2ad4
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 19:43:36 2024 -0700

    Fixup .codecov.yml

commit 8c7a1a2
Merge: aa386db 5387136
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 19:12:27 2024 -0700

    Include 'Hotfix-114-A'

    * Hotfix-114-A:
      Fixup typo (- Fixes #50 -)

commit aa386db
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 19:10:02 2024 -0700

    Refactored docstring for style to scilence linter FLK-D209.

commit b0fc5e0
Author: Mr. Walls <[email protected]>
Date:   Sun Jul 14 19:06:25 2024 -0700

    Added styleistic newline for FLK-D204 linter

commit 5387136
Author: Mr. Walls <[email protected]>
Date:   Sat Jul 13 12:00:01 2024 -0700

    Fixup typo (- Fixes #50 -)

commit 03ba956
Merge: 5f11d12 259ffb6 f23e54a 3566cda
Author: Mr. Walls <[email protected]>
Date:   Fri Jul 12 21:15:04 2024 -0700

    Merge branches 'skip-silly-PYL-W0621', 'skip-early-del-PTC-W0043', 'skip-ambiguous-module-PYL-C0414' and 'fix-up-overload-PYL-W0622'

    * skip-silly-PYL-W0621:
      refactor to avoid PYL-W0621 ( - Fixes #49 - )

    * skip-early-del-PTC-W0043:
      Marked early del to ignore false-positives of PYL-W0043 ( - Fixes #47 - )

    * skip-ambiguous-module-PYL-C0414:
      Marked early del to ignore false-positives of PYL-C0414 ( - Fixes #48 - )

    * fix-up-overload-PYL-W0622:
      comment to skip false PYL-W0622 ( - Fixes #50 - )

commit 3566cda
Author: Mr. Walls <[email protected]>
Date:   Fri Jul 12 21:11:10 2024 -0700

    comment to skip false PYL-W0622 ( - Fixes #50 - )

commit 5f11d12
Author: Mr. Walls <[email protected]>
Date:   Fri Jul 12 21:05:44 2024 -0700

    refactor to avoid PYL-W0621 ( - Fixes #49 - )

commit 259ffb6
Author: Mr. Walls <[email protected]>
Date:   Fri Jul 12 20:23:05 2024 -0700

    Marked early del to ignore false-positives of PYL-W0043 ( - Fixes #47 - )

commit f23e54a
Author: Mr. Walls <[email protected]>
Date:   Fri Jul 12 20:38:46 2024 -0700

    Marked early del to ignore false-positives of PYL-C0414 ( - Fixes #48 - )

commit 86d4374
Author: Mr. Walls <[email protected]>
Date:   Fri Jul 12 18:58:01 2024 -0700

    Harden default permissions of GH actions ( - Fixes #39  and #40 - )

    * Harden default permissions of GH actions ( - Fixes #39 - )
    * Bump version  of GH checkout action ( - WIP #40 / WIP #44 - )
    * Bump version  of GH setup-pytho action ( - Fixes #44  - )
    * Simplify eager triggers of GH actions ( - Resolves #42 - )

commit 4dca608
Merge: 2b8730a c2194fe cdba8ce
Author: Mr. Walls <[email protected]>
Date:   Thu Jul 11 00:16:04 2024 -0700

    Merge branches 'security-fix-1' and 'security-fix-2'

    * security-fix-1:
      Fix CWE-73 found in PR #37

    * security-fix-2:
      Harden default permissions of GH actions ( - Fixes #39 - )

commit cdba8ce
Author: Mr. Walls <[email protected]>
Date:   Thu Jul 11 00:13:22 2024 -0700

    Harden default permissions of GH actions ( - Fixes #39 - )

commit c2194fe
Author: Mr. Walls <[email protected]>
Date:   Wed Jul 10 23:55:09 2024 -0700

    Fix CWE-73 found in PR #37

commit 2b8730a
Merge: 1d53595 29d4740
Author: Mr. Walls <[email protected]>
Date:   Wed Jul 10 18:39:35 2024 -0700

    Merge branch 'score-card-revert-patch' and 'labeler-patch' into temp-merge

    * temp-merge
      Bumped Action versions and perms

    * labeler-patch:
      Cleanup Labeler config.
      Updated lables config for latest version.

    * score-card-revert-patch
      Revert to only check default branch to fix regression ( - Fixed #38 - )
      Create scorecards.yml

commit 29d4740
Author: Mr. Walls <[email protected]>
Date:   Wed Jul 10 18:32:35 2024 -0700

    Cleanup Labeler config.

commit 46a060a
Merge: 60b2850 1d53595
Author: Mr. Walls <[email protected]>
Date:   Wed Jul 10 18:16:36 2024 -0700

    Merge branches 'score-card-revert-patch' and 'temp-merge' and 'labeler-patch'

    * score-card-revert-patch:
      Revert to only check default branch to fix regression ( - Fixed #38 - )

    * temp-merge
      PR #37

    * temp-merge:

commit 60b2850
Author: Mr. Walls <[email protected]>
Date:   Wed Jul 10 16:31:07 2024 -0700

    Revert to only check default branch to fix regression ( - Fixed #38 - )

commit dd6b74c
Author: Mr. Walls <[email protected]>
Date:   Wed Jul 10 16:08:21 2024 -0700

    Updated lables config for latest version.

commit 632a61f
Author: reactive-firewall <[email protected]>
Date:   Wed Jul 10 15:35:47 2024 -0700

    Bumped Action versions and perms

commit c3c2570
Author: Mr. Walls <[email protected]>
Date:   Tue Jul 9 19:33:34 2024 -0700

    Create scorecards.yml

    Upgrade to new version of scorecards-analysis.yml actions

commit 1d53595
Merge: 90f7b47 0bed4f7
Author: Mr. Walls <[email protected]>
Date:   Tue Jul 9 20:38:38 2024 -0700

    Merge pull request #35 from reactive-firewall/reactive-firewall-patch-1

    Patch Score-card actions

commit 0bed4f7
Merge: 542a658 b9cdf0c
Author: Mr. Walls <[email protected]>
Date:   Tue Jul 9 19:57:43 2024 -0700

    Merge pull request #36 from reactive-firewall/labeler-patch

    Update Labeler.yml to new version

commit b9cdf0c
Author: Mr. Walls <[email protected]>
Date:   Tue Jul 9 19:55:15 2024 -0700

    Update Labeler.yml to new version

    Updated out-of-date labeler action too.

commit 542a658
Author: Mr. Walls <[email protected]>
Date:   Tue Jul 9 19:36:25 2024 -0700

    Delete .github/workflows/scorecards.yml

    Remove new filename

commit 0a165a7
Author: Mr. Walls <[email protected]>
Date:   Tue Jul 9 19:35:58 2024 -0700

    Update scorecards-analysis.yml

    Move to old filename

commit 229a693
Author: Mr. Walls <[email protected]>
Date:   Tue Jul 9 19:33:34 2024 -0700

    Create scorecards.yml

    Upgrade to new version of scorecards-analysis.yml actions

commit 90f7b47
Author: Mr. Walls <[email protected]>
Date:   Tue Jul 9 19:02:13 2024 -0700

    Fixed a few anti-patterns.

commit 39a5fa2
Author: Mr. Walls <[email protected]>
Date:   Tue Jul 9 17:50:09 2024 -0700

    Migration to new CircleCI docker images

    see https://circleci.com/developer/images/image/cimg/python for more.

commit ab5b574
Author: Mr. Walls <[email protected]>
Date:   Mon Jul 8 22:17:11 2024 -0700

    Regression fix for Circle-CI missing python3.11+

commit e25b751
Author: Mr. Walls <[email protected]>
Date:   Mon Jul 8 22:07:45 2024 -0700

    Regression fix (whitespace)

commit 7a0e54c
Author: Mr. Walls <[email protected]>
Date:   Mon Jul 8 22:04:08 2024 -0700

    Debugging GH actions.

commit e71709f
Author: Mr. Walls <[email protected]>
Date:   Mon Jul 8 21:43:21 2024 -0700

    Regression fix for repo url.

commit 3dbd9f8
Author: Mr. Walls <[email protected]>
Date:   Mon Jul 8 21:32:52 2024 -0700

    Regression fix for GH Actions and user-install action

commit 993e752
Author: Mr. Walls <[email protected]>
Date:   Mon Jul 8 19:43:13 2024 -0700

    Updated for 2024

     + New github templates for issues and PRs etc.
     + Updated cc year
     + added template GH action examples (see first GH action tests)
     + updated circle-ci to use newer python versions

commit c13a528
Author: reactive-firewall <[email protected]>
Date:   Sun Sep 25 11:19:34 2022 -0700

    Removed trailing whitespace. ( Fix for #29 )

commit b66f119
Merge: 3158d43 61b9815
Author: Mr. Walls <[email protected]>
Date:   Sun Sep 25 11:04:55 2022 -0700

    Merge pull request #32 from reactive-firewall/master

    Prep for Security Feature branch

commit 61b9815
Author: reactive-firewall <[email protected]>
Date:   Sun Sep 25 10:55:21 2022 -0700

    tweak to apese deepsource padantics. Less than ideal.

commit ee2cf63
Author: reactive-firewall <[email protected]>
Date:   Sun Sep 25 10:26:57 2022 -0700

    Fixed a typo.

commit 6d10c4c
Author: reactive-firewall <[email protected]>
Date:   Sun Sep 25 10:24:45 2022 -0700

    Fixed a typo.

commit c5ff889
Author: reactive-firewall <[email protected]>
Date:   Sun Sep 25 10:22:59 2022 -0700

    tweak to apese deepsource padantics. Less than ideal.

commit defb45e
Author: reactive-firewall <[email protected]>
Date:   Sun Sep 25 10:11:01 2022 -0700

    tweak to apese deepsource padantics.

commit 1b4734b
Author: reactive-firewall <[email protected]>
Date:   Sun Sep 25 10:04:54 2022 -0700

    Swap whitespace for docs to apese deepsource padantics.

commit 0751ed9
Author: reactive-firewall <[email protected]>
Date:   Fri Sep 23 19:01:20 2022 -0700

    Less is More...

commit 8cb602f
Author: reactive-firewall <[email protected]>
Date:   Fri Sep 23 18:41:41 2022 -0700

    Slight improvement to code style.

commit 9af5c27
Author: reactive-firewall <[email protected]>
Date:   Fri Sep 23 18:36:04 2022 -0700

    Regression fix for code style.

commit 4a3bc67
Author: reactive-firewall <[email protected]>
Date:   Fri Sep 23 18:26:57 2022 -0700

    Regression fix for some anti-patterns

commit ff308fc
Author: reactive-firewall <[email protected]>
Date:   Fri Sep 23 17:44:30 2022 -0700

    Version 1.1.4 supplemental update

commit 83cfc31
Author: reactive-firewall <[email protected]>
Date:   Mon Aug 29 19:53:44 2022 -0700

    workaround different flake support for del() vs del x

commit 035231f
Author: reactive-firewall <[email protected]>
Date:   Mon Aug 29 19:42:41 2022 -0700

    xcode workspace renomalized with xml lint

commit 3158d43
Author: Mr. Walls <[email protected]>
Date:   Fri Jan 14 03:08:44 2022 -0800

    Create scorecards-analysis.yml

commit 5e694d0
Author: reactive-firewall <[email protected]>
Date:   Mon Mar 23 21:46:28 2020 -0700

    Style fixes and CI retest

commit 3430afe
Author: reactive-firewall <[email protected]>
Date:   Mon Mar 23 20:10:02 2020 -0700

    Adding deepsource.io to CI pipeline

commit 6401e1c
Author: reactive-firewall <[email protected]>
Date:   Sat Jan 18 17:51:52 2020 -0800

    Another attempt at Build Config updates
@reactive-firewall reactive-firewall added this to the Deepsource approval milestone Sep 6, 2024
reactive-firewall added a commit that referenced this issue Sep 7, 2024
@reactive-firewall
[TESTS] Initial hardening with pinned dependencies (- WIP #40 -)
0cdfcd5 
Notible change: introduced a new config for test environment's dependancies with `test-requirements.txt`
reactive-firewall added a commit that referenced this issue Sep 7, 2024
@reactive-firewall
[TESTS] Initial hardening with pinned dependencies (- WIP #40 -)
dc37967 
Notible change: introduced a new config for test environment's dependancies with `test-requirements.txt`
reactive-firewall added a commit that referenced this issue Sep 7, 2024
@reactive-firewall
[REGRESSION] revert pytyest-enabler back to v1.0.1 in CI to continue …
2c020f6 
…support of pre-v3.8 python (- WIP #40 -)
@reactive-firewall reactive-firewall mentioned this issue Sep 7, 2024
Merged
1 task
@reactive-firewall
Copy link
Owner Author

https://github.com/reactive-firewall/python-repo/security/code-scanning/51
This will require additional changes to fix 🙅🏻

@reactive-firewall
Copy link
Owner Author

so will:
https://github.com/reactive-firewall/python-repo/security/code-scanning/59
https://github.com/reactive-firewall/python-repo/security/code-scanning/60

reactive-firewall added a commit that referenced this issue Sep 7, 2024
@reactive-firewall
[TESTS] Testing prototype tool to fetch and verify the cc-test-report…
715705c 
…er (- WIP #40 -)

Testing only AMD64 for linux and darwin latest. Once working we can look at figuring out arm64.
reactive-firewall added a commit that referenced this issue Sep 7, 2024
@reactive-firewall
[REGRESSION] chmod 755 new tool 🙉 (- WIP #40 -)
86f5dcd
reactive-firewall added a commit that referenced this issue Sep 8, 2024
@reactive-firewall
[TESTS] Initial hardening with pinned dependencies (- WIP #40 -)
6c9054b 
* [TESTS] Initial hardening with pinned dependencies (- WIP #40 -)
Notible change: introduced a new config for test environment's dependancies with `test-requirements.txt`

Squashes the following changes:
* [REGRESSION] Revert test-requirement of pytest-cov back down to v4+ to continue to support Python 3.7 in CI
* [REGRESSION] revert pytyest-enabler back to v1.0.1 in CI to continue support of pre-v3.8 python (- WIP #40 -)
* [TESTS] Testing prototype tool to fetch and verify the cc-test-reporter (- WIP #40 -)
    - Testing only AMD64 for linux and darwin latest. Once working we can look at figuring out arm64.
* [REGRESSION] chmod 755 new tool 🙉 (- WIP #40 -)
* [STYLE] numerous style fixes to satisfy shellcheck and improve consistancy (- WIP #74 -)
* [REGRESSION] fix syntax by reverting - back to a working CI (- WIP #74 -)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@reactive-firewall reactive-firewall

Labels
CI Continuous Integration Tooling Configs Improvements or additions to configuration enhancement Linter Any linter tool or setting file enhancements Python Lang Changes to Python source code Python Repo Anything Project Related Testing Something can be verified
Projects
None yet
Milestone
Deepsource approval
Development

No branches or pull requests
1 participant
@reactive-firewall