Skip to content

Commit b206a7b

Browse files
Vianpyrogithub-advanced-security[bot]
Vianpyro
and
github-advanced-security[bot]
authored
Simplify development (#39)
* Refactor Dockerfile and devcontainer.json for improved user setup and pip installation * Remove VS Code settings from .gitignore and add tasks.json for test automation * Update postStartCommand to run tests after installing dependencies and change task run options to default * Add GitHub Actions workflow for creating draft releases * Fix tag versioning logic to increment MINOR instead of PATCH * Separate postStartCommand and postAttachCommand for clearer execution of dependency installation and testing * Refactor environment variable definitions for pip in Dockerfile for improved readability * Add GitHub Actions workflow for Python dependencies audit * Update dependencies in requirements.txt for improved security and functionality * Remove unnecessary directory creation and ownership change in Dockerfile user setup * Potential fix for code scanning alert no. 9: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Update draft-release.yml * Add permissions section to workflow files for enhanced security * Refactor workflow files to simplify input handling and improve consistency --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent 5d574d5 commit b206a7b

File tree

10 files changed

+184
-33
lines changed

10 files changed

+184
-33
lines changed

‎.devcontainer/Dockerfile‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,17 @@ RUN apk add --no-cache bash git \
77
# Setup default user
88
ARG USERNAME=vscode
99
ARG USER_UID=1000
10-
ARG USER_GID=$USER_UID
10+
ARG USER_GID=${USER_UID}
1111

12-
RUN addgroup -g $USER_GID -S $USERNAME && \
13-
adduser -u $USER_UID -S -G $USERNAME -s /bin/bash $USERNAME
12+
RUN addgroup -g ${USER_GID} -S ${USERNAME} && \
13+
adduser -u ${USER_UID} -S -G ${USERNAME} -s /bin/bash ${USERNAME}
1414

1515
# Switch to the default user
16-
USER $USERNAME
16+
USER ${USERNAME}
17+
18+
# Set environment variables for pip
19+
ENV PATH="/home/${USERNAME}/.local/bin:$PATH" \
20+
PIP_BREAK_SYSTEM_PACKAGES=1 \
21+
PIP_DISABLE_PIP_VERSION_CHECK=1 \
22+
PIP_NO_CACHE_DIR=1 \
23+
PYTHONUNBUFFERED=1

‎.devcontainer/devcontainer.json‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,14 @@
77
},
88
"vscode": {
99
"extensions": [
10+
"gruntfuggly.triggertaskonsave",
1011
"ms-python.black-formatter",
1112
"ms-python.python",
12-
"ms-python.isort",
13-
"emeraldwalk.RunOnSave"
13+
"ms-python.isort"
1414
]
1515
}
1616
},
17-
"postStartCommand": "pip3 --disable-pip-version-check --no-cache-dir install -r requirements.txt --break-system-packages && python3 -m pytest tests",
17+
"postStartCommand": "pip3 install --user -r requirements.txt",
18+
"postAttachCommand": "python3 -m pytest tests",
1819
"remoteUser": "vscode"
1920
}

‎.github/workflows/draft-release.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: Create a Draft Release
2+
3+
permissions:
4+
contents: write
5+
6+
on:
7+
push:
8+
branches:
9+
- main
10+
workflow_dispatch:
11+
12+
env:
13+
TRIGGER_BRANCH: main
14+
FILE_FILTER_PATTERN: '^(?!tests/).*\.py$'
15+
16+
jobs:
17+
create-release-draft:
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout code and fetch tags
22+
uses: actions/checkout@v4
23+
with:
24+
fetch-depth: 0
25+
26+
- name: Check for modified matching files
27+
id: check_changes
28+
run: |
29+
echo "Trigger branch: $TRIGGER_BRANCH"
30+
echo "File filter pattern: $FILE_FILTER_PATTERN"
31+
32+
git fetch origin "$TRIGGER_BRANCH" --depth=2
33+
MODIFIED=$(git diff --name-only HEAD^ HEAD)
34+
35+
echo "Modified files:"
36+
echo "$MODIFIED"
37+
38+
MATCHING=$(echo "$MODIFIED" | grep -E "$FILE_FILTER_PATTERN" || true)
39+
40+
echo "Matching files:"
41+
echo "$MATCHING"
42+
43+
if [[ -n "$MATCHING" ]]; then
44+
echo "should_trigger=true" >> "$GITHUB_OUTPUT"
45+
else
46+
echo "should_trigger=false" >> "$GITHUB_OUTPUT"
47+
fi
48+
49+
- name: Determine next tag version
50+
id: version
51+
run: |
52+
LATEST=$(git tag --sort=-v:refname | head -n 1)
53+
echo "Latest tag: $LATEST"
54+
55+
if [[ -z "$LATEST" ]]; then
56+
NEXT_TAG="v0.0.1"
57+
else
58+
[[ "$LATEST" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)(-.+)?$ ]]
59+
MAJOR=${BASH_REMATCH[1]}
60+
MINOR=${BASH_REMATCH[2]}
61+
PATCH=${BASH_REMATCH[3]}
62+
SUFFIX=${BASH_REMATCH[4]}
63+
MINOR=$((MINOR + 1))
64+
NEXT_TAG="v$MAJOR.$MINOR.$PATCH$SUFFIX"
65+
fi
66+
67+
echo "Next tag: $NEXT_TAG"
68+
echo "tag=$NEXT_TAG" >> "$GITHUB_OUTPUT"
69+
70+
- name: Create draft release
71+
if: steps.check_changes.outputs.should_trigger == 'true'
72+
run: |
73+
curl -X POST \
74+
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
75+
-H "Accept: application/vnd.github+json" \
76+
https://api.github.com/repos/${{ github.repository }}/releases \
77+
-d '{
78+
"tag_name": "${{ steps.version.outputs.tag }}",
79+
"target_commitish": "'"$TRIGGER_BRANCH"'",
80+
"name": "${{ steps.version.outputs.tag }}",
81+
"draft": true,
82+
"prerelease": false,
83+
"generate_release_notes": true
84+
}'

‎.github/workflows/pip-audit.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Python Dependencies Audit
2+
3+
permissions:
4+
contents: read
5+
6+
on:
7+
push:
8+
paths:
9+
- requirements.txt
10+
pull_request:
11+
paths:
12+
- requirements.txt
13+
schedule:
14+
- cron: "0 4 * * 1" # Every Monday at 4:00 UTC
15+
workflow_dispatch:
16+
17+
jobs:
18+
pip-audit:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@v4
23+
24+
- name: Set up Python
25+
uses: actions/setup-python@v5
26+
with:
27+
python-version: "3.x"
28+
29+
- name: Install dependencies
30+
run: |
31+
python -m pip install --upgrade pip
32+
pip install pip-audit
33+
34+
- name: Run pip-audit
35+
run: pip-audit -r requirements.txt

‎.github/workflows/pytest.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
name: Pytest CI
22

3+
permissions:
4+
contents: read
5+
36
on:
47
push:
58
branches:
69
- main
710
pull_request:
811

9-
permissions: {}
10-
1112
jobs:
1213
test:
1314
name: Pytest on ${{ matrix.os }} with Python ${{ matrix.python-version }}

‎.github/workflows/super-linter.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
1-
---
21
name: Lint
32

3+
permissions:
4+
contents: read
5+
46
on:
57
push:
68
branches:
79
- main
810
pull_request: null
911

10-
permissions: {}
11-
1212
jobs:
1313
build:
1414
name: Lint

‎.gitignore‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -122,9 +122,3 @@ dmypy.json
122122

123123
# Cython debug symbols
124124
cython_debug/
125-
126-
# VS Code
127-
.vscode/*
128-
129-
# Except this specific file
130-
!.vscode/settings.json

‎.vscode/settings.json‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,13 @@
2323
"--profile",
2424
"black"
2525
],
26-
"emeraldwalk.runonsave": {
27-
"commands": [
28-
{
29-
"match": "tests[/\\\\](.*[/\\\\])?test_.*\\.py$",
30-
"cmd": "python3 -m pytest '${relativeFile}' -v",
31-
"autoShowOutputPanel": "error"
32-
}
26+
"triggerTaskOnSave.tasks": {
27+
"Run on test file": [
28+
"tests/**/test_*.py"
29+
],
30+
"Run all tests": [
31+
"!tests/**",
32+
"**/*.py"
3333
]
3434
},
3535
"python.testing.pytestArgs": [

‎.vscode/tasks.json‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
"version": "2.0.0",
3+
"tasks": [
4+
{
5+
"label": "Run all tests",
6+
"type": "shell",
7+
"command": "python3 -m pytest tests",
8+
"group": {
9+
"kind": "test",
10+
"isDefault": true
11+
},
12+
"problemMatcher": [],
13+
"runOptions": {
14+
"runOn": "default"
15+
}
16+
},
17+
{
18+
"label": "Run on test file",
19+
"type": "shell",
20+
"command": "python3 -m pytest '${relativeFile}' -v -x",
21+
"group": {
22+
"kind": "test"
23+
},
24+
"problemMatcher": [],
25+
"runOptions": {
26+
"runOn": "default"
27+
}
28+
}
29+
]
30+
}

‎requirements.txt‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
argon2-cffi>=23.1.0
2-
cryptography>=44.0.2
3-
Flask>=3.0.3
4-
Flask-JWT-Extended>=2.8.0
5-
Flask-Limiter>=3.7.0
6-
flask-cors>=4.0.1
2+
cryptography>=45.0.2
3+
Flask>=3.1.1
4+
Flask-JWT-Extended>=4.7.1
5+
Flask-Limiter>=3.12.0
6+
flask-cors>=6.0.0
77
PyMySQL>=1.1.1
8-
requests>=2.32.3
9-
waitress>=3.0.0
108
pytest>=8.3.5
11-
python-dotenv>=1.0.1
9+
python-dotenv>=1.1.0
10+
requests>=2.32.3

0 commit comments

Comments
 (0)