From cef26f2b74307728c71afe1d85afe8b6ece8be8a Mon Sep 17 00:00:00 2001 From: Gonzalo Diaz Date: Mon, 10 Aug 2026 21:01:58 -0400 Subject: [PATCH 1/3] [BUGFIX] [Github Actions] Omitting "--only-binary :all:" can lead to the execution of setup scripts. Make sure it is safe here.sonarqube(githubactions:S8541) Using dependencies without locking resolved versions is security-sensitive.sonarqube(githubactions:S8544) --- .github/workflows/yamllint.yml | 7 +- Pipfile | 12 ---- Pipfile.lock | 117 --------------------------------- 3 files changed, 2 insertions(+), 134 deletions(-) delete mode 100644 Pipfile delete mode 100644 Pipfile.lock diff --git a/.github/workflows/yamllint.yml b/.github/workflows/yamllint.yml index 1c9cbbf..10bfecf 100644 --- a/.github/workflows/yamllint.yml +++ b/.github/workflows/yamllint.yml @@ -22,12 +22,9 @@ jobs: with: python-version: 3.14 - - name: Install pipenv - run: > - sudo apt install pipenv - name: Install yamllint - run: > - pipenv sync --dev + run: | + pip install --only-binary :all: yamllint==1.38.0 - name: Lint YAML files run: > diff --git a/Pipfile b/Pipfile deleted file mode 100644 index 4f46c20..0000000 --- a/Pipfile +++ /dev/null @@ -1,12 +0,0 @@ -[[source]] -url = "https://pypi.org/simple" -verify_ssl = true -name = "pypi" - -[packages] -yamllint = "*" - -[dev-packages] - -[requires] -python_version = "3.14" diff --git a/Pipfile.lock b/Pipfile.lock deleted file mode 100644 index 5775b3b..0000000 --- a/Pipfile.lock +++ /dev/null @@ -1,117 +0,0 @@ -{ - "_meta": { - "hash": { - "sha256": "f5f822ff228cbcb30b9b437c9ecc1b629eed30cd095e91950048ead4ffa603f9" - }, - "pipfile-spec": 6, - "requires": { - "python_version": "3.14" - }, - "sources": [ - { - "name": "pypi", - "url": "https://pypi.org/simple", - "verify_ssl": true - } - ] - }, - "default": { - "pathspec": { - "hashes": [ - "sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a", - "sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189" - ], - "markers": "python_version >= '3.9'", - "version": "==1.1.1" - }, - "pyyaml": { - "hashes": [ - "sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c", - "sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a", - "sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3", - "sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956", - "sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6", - "sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c", - "sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65", - "sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a", - "sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0", - "sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b", - "sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1", - "sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6", - "sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7", - "sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e", - "sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007", - "sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310", - "sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4", - "sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9", - "sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295", - "sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea", - "sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0", - "sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e", - "sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac", - "sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9", - "sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7", - "sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35", - "sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb", - "sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b", - "sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69", - "sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5", - "sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b", - "sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c", - "sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369", - "sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd", - "sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824", - "sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198", - "sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065", - "sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c", - "sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c", - "sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764", - "sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196", - "sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b", - "sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00", - "sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac", - "sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8", - "sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e", - "sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28", - "sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3", - "sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5", - "sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4", - "sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b", - "sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf", - "sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5", - "sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702", - "sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8", - "sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788", - "sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da", - "sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d", - "sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc", - "sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c", - "sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba", - "sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f", - "sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917", - "sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5", - "sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26", - "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f", - "sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b", - "sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be", - "sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c", - "sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3", - "sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6", - "sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926", - "sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0" - ], - "markers": "python_version >= '3.8'", - "version": "==6.0.3" - }, - "yamllint": { - "hashes": [ - "sha256:09e5f29531daab93366bb061e76019d5e91691ef0a40328f04c927387d1d364d", - "sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220" - ], - "index": "pypi", - "markers": "python_version >= '3.10'", - "version": "==1.38.0" - } - }, - "develop": {} -} From d4a456bc0e8e63f54ee1e452d678554cd62540c5 Mon Sep 17 00:00:00 2001 From: Gonzalo Diaz Date: Mon, 10 Aug 2026 21:06:35 -0400 Subject: [PATCH 2/3] [BUGFIX] [Github Actions] base images upgraded. --- .github/workflows/codeql.yml | 2 +- .github/workflows/docker-image.yml | 2 +- .github/workflows/dotnet-lint.yml | 10 +++++++++- .github/workflows/dotnet-test.yml | 11 ++++++++++- .github/workflows/gitleaks.yml | 2 +- .github/workflows/markdown-lint.yml | 2 +- 6 files changed, 23 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 63453c0..65c06e3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -37,7 +37,7 @@ jobs: # - https://gh.io/using-larger-runners (GitHub.com only) # Consider using larger runners or machines with greater resources # for possible analysis time improvements. - runs-on: ${{ (matrix.language == 'swift' && 'macos-14') || 'ubuntu-24.04' }} + runs-on: ${{ (matrix.language == 'swift' && 'macos-26') || 'ubuntu-26.04' }} timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} permissions: # required for all workflows diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index 3cd7805..09f7ef6 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -16,7 +16,7 @@ env: jobs: build: name: "Build Docker images" - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 diff --git a/.github/workflows/dotnet-lint.yml b/.github/workflows/dotnet-lint.yml index e4cbfa7..672b2bf 100644 --- a/.github/workflows/dotnet-lint.yml +++ b/.github/workflows/dotnet-lint.yml @@ -20,7 +20,15 @@ jobs: strategy: fail-fast: false matrix: - os: ["windows-2022", "windows-2025", "ubuntu-24.04", "macos-14"] + os: + - "windows-2022" + - "windows-2025" + - "ubuntu-24.04" + - "ubuntu-26.04" + - "macos-15" + - "macos-15-intel" + - "macos-26" + - "macos-26-intel" dotnet-version: [9.0.x, 10.0.x] runs-on: ${{ matrix.os }} steps: diff --git a/.github/workflows/dotnet-test.yml b/.github/workflows/dotnet-test.yml index 5a4ed89..1c53ce2 100644 --- a/.github/workflows/dotnet-test.yml +++ b/.github/workflows/dotnet-test.yml @@ -20,7 +20,16 @@ jobs: strategy: fail-fast: false matrix: - os: ["windows-2022", "windows-2025", "ubuntu-24.04", "macos-14"] + os: + - "windows-2022" + - "windows-2025" + - "ubuntu-24.04" + - "ubuntu-26.04" + - "macos-15" + - "macos-15-intel" + - "macos-26" + - "macos-26-intel" + dotnet-version: [9.0.x, 10.0.x] runs-on: ${{ matrix.os }} steps: diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index 73effc2..26d11ef 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -19,7 +19,7 @@ on: # yamllint disable-line rule:truthy jobs: scan: name: gitleaks - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: diff --git a/.github/workflows/markdown-lint.yml b/.github/workflows/markdown-lint.yml index 051f6e7..54fe76d 100644 --- a/.github/workflows/markdown-lint.yml +++ b/.github/workflows/markdown-lint.yml @@ -19,7 +19,7 @@ permissions: jobs: markdownlint: name: Markdown Lint - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 steps: - name: Checkout repository From a624cc4def65414469de839bd424c0452ddfc818 Mon Sep 17 00:00:00 2001 From: Gonzalo Diaz Date: Tue, 11 Aug 2026 04:23:29 +0000 Subject: [PATCH 3/3] [BUGFIX] fix dotnet versions pick-up --- .github/workflows/dotnet-lint.yml | 2 +- .github/workflows/dotnet-test.yml | 20 +++++++++++++++++--- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dotnet-lint.yml b/.github/workflows/dotnet-lint.yml index 672b2bf..3692f7a 100644 --- a/.github/workflows/dotnet-lint.yml +++ b/.github/workflows/dotnet-lint.yml @@ -29,7 +29,7 @@ jobs: - "macos-15-intel" - "macos-26" - "macos-26-intel" - dotnet-version: [9.0.x, 10.0.x] + dotnet-version: [8.0.x, 9.0.x, 10.0.x] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 diff --git a/.github/workflows/dotnet-test.yml b/.github/workflows/dotnet-test.yml index 1c53ce2..f097a60 100644 --- a/.github/workflows/dotnet-test.yml +++ b/.github/workflows/dotnet-test.yml @@ -29,15 +29,29 @@ jobs: - "macos-15-intel" - "macos-26" - "macos-26-intel" - - dotnet-version: [9.0.x, 10.0.x] + dotnet-version: [8.0.x, 9.0.x, 10.0.x] runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - name: Setup .NET ${{ matrix.dotnet-version }} + - id: setup-dotnet + name: Setup .NET ${{ matrix.dotnet-version }} uses: actions/setup-dotnet@v6 with: dotnet-version: ${{ matrix.dotnet-version }} + # FIX: Dynamically generate global.json so the CLI doesn't default + # to the highest pre-installed version + - name: Enforce Matrix .NET SDK Version + shell: bash + run: | + cat <<'EOF' > ./global.json + { + "sdk": { + "version": "${{ steps.setup-dotnet.outputs.dotnet-version }}", + "rollForward": "latestPatch" + } + } + EOF + - name: Tooling check run: > dotnet --version