diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 11162f1..32ee2f9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,9 +17,9 @@ jobs: audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install uv - uses: astral-sh/setup-uv@v8.3.2 + uses: astral-sh/setup-uv@v9.0.0 - name: Export locked runtime dependencies run: uv export --frozen --no-dev --all-extras --no-emit-project --no-hashes --format requirements-txt -o audit-requirements.txt # The export is already a fully resolved tree, so --no-deps audits the pins @@ -30,11 +30,11 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Install uv - uses: astral-sh/setup-uv@v8.3.2 + uses: astral-sh/setup-uv@v9.0.0 - name: Lint run: uv run ruff check . - name: Format check @@ -52,14 +52,18 @@ jobs: needs: test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 - name: Download coverage report - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: coverage-report - name: SonarCloud Scan - uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8 + if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]' + uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + - name: Skip SonarCloud scan for Dependabot + if: github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' + run: echo "SonarCloud credentials are unavailable to Dependabot pull requests." diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 9fdf4ed..343f7eb 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -20,9 +20,9 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v7.0.1 - name: Install uv - uses: astral-sh/setup-uv@v8.3.2 + uses: astral-sh/setup-uv@v9.0.0 - name: Build the docs site run: uv run --group docs mkdocs build --strict - name: Upload the site artifact diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 1d563f3..d463576 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -30,11 +30,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out base ref (trusted policy copy) - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.base.sha }} - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Validate PR title diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 6e05736..c066b66 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -49,15 +49,15 @@ jobs: id-token: write # OIDC trusted publishing to PyPI (no stored token) steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" - name: Install uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8 + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v8 - name: Build sdist + wheel run: uv build --out-dir dist - name: Publish to PyPI (OIDC trusted publishing) - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1 with: packages-dir: dist - name: Attach the distributions to the GitHub Release @@ -74,7 +74,7 @@ jobs: contents: read packages: write # push the image to GHCR under this repository's owner steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Log in to GitHub Container Registry run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin - name: Build and push the container image diff --git a/.github/workflows/sync-main-to-dev.yml b/.github/workflows/sync-main-to-dev.yml index 673b39f..e0ce605 100644 --- a/.github/workflows/sync-main-to-dev.yml +++ b/.github/workflows/sync-main-to-dev.yml @@ -35,7 +35,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Open or update the back-merge PR diff --git a/pyproject.toml b/pyproject.toml index 7f61473..fd335bb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -28,7 +28,7 @@ dependencies = [ "django-ratelimit>=4.1", "django-csp>=4.0", "PyYAML>=6", - "aces-sdl==0.20.0", + "aces-sdl==0.23.1", ] [project.urls] diff --git a/uv.lock b/uv.lock index 47c41d2..a9159c8 100644 --- a/uv.lock +++ b/uv.lock @@ -10,7 +10,7 @@ resolution-markers = [ [[package]] name = "aces-sdl" -version = "0.20.0" +version = "0.23.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "asyncssh" }, @@ -28,9 +28,9 @@ dependencies = [ { name = "typer" }, { name = "uvicorn", extra = ["standard"] }, ] -sdist = { url = "https://files.pythonhosted.org/packages/aa/99/b7a686060d9e4b5d3df8592f1cd34c0f71aeb805685c69172ffc2d4dd0a1/aces_sdl-0.20.0.tar.gz", hash = "sha256:f816b824c76e6388b5a15971237b499bc8c04576ba62b10f7dfa597f8895dbcf", size = 1561396, upload-time = "2026-07-13T02:50:47.396Z" } +sdist = { url = "https://files.pythonhosted.org/packages/b3/71/c3923fc8713fbab0baf779c902ac82a6030793e98e1219eec0f35e0a321e/aces_sdl-0.23.1.tar.gz", hash = "sha256:0a53f680c5b2420554cc3f6053ba64d0f4ef919a73337ab060f5dc283295bc0d", size = 1674846, upload-time = "2026-07-17T04:06:34.594Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/f4/a5/d1f9bc0227648627b6f9b715dbbd0e9df08e9120ac05e41913adef13b8b3/aces_sdl-0.20.0-py3-none-any.whl", hash = "sha256:2fd9956166326910a3ad439073589fb68c59eb9465d77e06a6890482428e9426", size = 1359387, upload-time = "2026-07-13T02:50:45.393Z" }, + { url = "https://files.pythonhosted.org/packages/c2/b4/77b40bb8214385c243d187d04614175b0f1a162ec7183a5143c016c06be6/aces_sdl-0.23.1-py3-none-any.whl", hash = "sha256:86f5e99d2dff009fe7165bbe8853f6fdf5a41074e7813f2e38e092910c1147a1", size = 1466167, upload-time = "2026-07-17T04:06:32.749Z" }, ] [[package]] @@ -70,7 +70,7 @@ docs = [ [package.metadata] requires-dist = [ - { name = "aces-sdl", specifier = "==0.20.0" }, + { name = "aces-sdl", specifier = "==0.23.1" }, { name = "dj-database-url", specifier = ">=2.2" }, { name = "django", specifier = ">=5.1,<6" }, { name = "django-axes", specifier = ">=7.0" },