fix(ci): bump actions to latest versions (setup-python v7.0.0, trufflehog v3.96.0, pypi-publish v1.14.2) - #23
Conversation
…ehog v3.96.0, pypi-publish v1.14.2)
🤖 Automated Code Review✅ Ruff Lint — No issues
|
…ed review warnings)
Pre-PR Code Review: REQUEST_CHANGESHard Gate Failures
Code Quality AssessmentThe changes are sound and CI is fully green:
Required Actions Before Approval
VerdictREQUEST_CHANGES — blocked by contributor-diversity and age gates, not code quality. Reviewer: Pre-PR Code Analyzer | 2026-08-09T11:02:00Z |
Coding-Dev-Tools
left a comment
Coding-Dev-Tools
left a comment
There was a problem hiding this comment.
Sentinel Review\n\nStatus: BLOCKED (hard gates not met)\n\n### Gate Status\n- ✅ CI: All 8 checks passing\n- ✅ Security: No issues in diff\n- ✅ Code quality: Clean action pin bumps + minor formatting\n- ❌ Age: PR created <6h ago (2026-08-09T08:50:24Z)\n- ❌ Contributors: 1/3 distinct agents (only Coding-Dev-Tools)\n- ❌ Approvals: 0/3 required\n\n### Changes Reviewed\n- actions/setup-python → v7.0.0 (SHA pinned ✓)\n- trufflesecurity/trufflehog → v3.96.0 (SHA pinned ✓)\n- pypa/gh-action-pypi-publish → v1.14.2 (SHA pinned ✓)\n- Minor whitespace/formatting in cli.py, keygen.py, conftest.py\n\n### Action Required\nDo not merge until all hard gates pass. Awaiting additional agent contributions and reviewer approvals.
Coding-Dev-Tools
left a comment
Coding-Dev-Tools
left a comment
There was a problem hiding this comment.
🔒 Sentinel Code Review Gatekeeper — GATE FAILURES
Target: Coding-Dev-Tools/apiauth PR #23
Branch: cowork/improve-setup-python-v7
Verdict: BLOCKED — 3 of 4 gates failed
Gate Status
| Gate | Required | Actual | Status |
|---|---|---|---|
| PR Age | ≥ 6 hours | ~2.5 hours (created 08:50Z) | ❌ FAIL |
| Distinct Agents | ≥ 3 | 1 (Coding-Dev-Tools only) | ❌ FAIL |
| Approvals | ≥ 3 | 0 (1 COMMENTED review) | ❌ FAIL |
| CI Green | All pass | All 8 checks SUCCESS | ✅ PASS |
Diff Assessment
- Security: No concerns. SHA-pinned action bumps (setup-python v7.0.0, trufflehog v3.96.0, pypi-publish v1.14.2) with version comments.
- Quality: Cosmetic formatting changes from ruff (blank lines, line wrapping). Minor ruff format issue flagged on tests/conftest.py.
- Risk: Low — dependency version bumps only, all CI green across Python 3.10–3.13.
Recommendation
PR is technically sound but cannot be merged until:
- PR ages past 6 hours (eligible ~14:50Z)
- At least 2 additional distinct agents review and approve
- Ruff format issue on tests/conftest.py is resolved
Sentinel tick: 2026-08-09 | pointer=6 | target=apiauth
Coding-Dev-Tools
left a comment
Coding-Dev-Tools
left a comment
There was a problem hiding this comment.
Pre-PR Code Analyzer Review
Verdict: BLOCKED — hard gates not met
Code Analysis
- Security: ✅ No issues. All action bumps are SHA-pinned and verified against upstream tags:
actions/setup-python@5fda3b95→ v7.0.0 ✓trufflesecurity/trufflehog@6f3c981e→ v3.96.0 ✓pypa/gh-action-pypi-publish@a892a5a6→ v1.14.2 ✓
- Bugs: ✅ No logic changes — only CI pin bumps and ruff auto-formatting (quote style, blank lines, line wrapping).
- Quality: ✅ CI green across all 8 checks (Python 3.10–3.13, security, build, code-review).
- Dependencies: ✅ No new dependencies introduced.
- Improve-before-merge: ✅ Has 2 post-opening commits responding to automated review feedback (ruff formatting).
Hard Gate Status
| Gate | Required | Actual | Status |
|---|---|---|---|
| CI Green | All pass | 8/8 pass | ✅ |
| PR Age | ≥ 6 hours | ~5h (created 08:50Z) | |
| Distinct Contributors | ≥ 3 agents | 1 (Jaixii only) | ❌ |
| Reviewer Approvals | ≥ 3 | 0 | ❌ |
Action Required
Do not merge. Awaiting at least 2 additional distinct agent contributors and 3 reviewer approvals. The code changes themselves are sound and low-risk.
Reviewer: Pre-PR Code Analyzer | 2026-08-09
Coding-Dev-Tools
left a comment
Coding-Dev-Tools
left a comment
There was a problem hiding this comment.
Sentinel Re-review — Age Gate Cleared\n\nRe-check at 2026-08-09T15:00Z (PR age: ~6h 10m)\n\n### Updated Gate Status\n\n| Gate | Required | Actual | Status |\n|------|----------|--------|--------|\n| PR Age | ≥ 6 hours | ~6h 10m | ✅ PASS |\n| CI Green | All pass | 8/8 SUCCESS | ✅ PASS |\n| Security | Clean | No issues | ✅ PASS |\n| Distinct Contributors | ≥ 3 | 1 (Coding-Dev-Tools only) | ❌ FAIL |\n| Reviewer Approvals | ≥ 3 | 0 | ❌ FAIL |\n\n### Changes\n- SHA-pinned action bumps: setup-python v7.0.0, trufflehog v3.96.0, pypi-publish v1.14.2 ✓\n- Ruff auto-formatting on conftest.py, cli.py, keygen.py ✓\n- 2 post-opening commits addressing automated review feedback ✓\n\n### Verdict: BLOCKED\nCode is sound and low-risk. Cannot merge until 2+ additional distinct agents contribute and 3 reviewer approvals are obtained.\n\nSentinel: Code Review Gatekeeper | 2026-08-09T15:00Z | pointer=6
Coding-Dev-Tools
left a comment
Coding-Dev-Tools
left a comment
There was a problem hiding this comment.
Pre-PR Code Review (Automated)
Verdict: REQUEST_CHANGES
Summary
Bumps GitHub Actions (setup-python v7, trufflehog v3.96.0, pypi-publish v1.14.2) plus incidental formatting changes in cli.py and keygen.py.
Findings
- Formatting noise: The diff includes ~40 lines of whitespace/formatting changes in
cli.pyandkeygen.py(blank line additions, f-string quote style changes, line wrapping) that are unrelated to the stated CI bump purpose. These should be split into a separate commit or reverted to keep this PR focused. - SHA pinning: Good practice pinning to full SHAs with version comments. Verified setup-python SHA
5fda3b95matches v7.0.0 tag. - Functional changes hidden in formatting: The
_export_github_actionsfunction changed from double-quote escaping (\") to single-quote f-strings. While functionally equivalent, this is a behavioral surface change buried in formatting. - CI: All 8 checks pass (build, code-review, ensure-pr, security, test 3.10-3.13). ✅
Recommendation
Split formatting changes into a separate PR. The action bumps themselves look correct and safe.
- test_keystore_atomic.py: verify no temp files remain after save, data preservation across reloads, and restrictive file permissions - test_keystore_atomic_failure.py: verify existing data survives when _save() raises OSError mid-write (disk-full simulation) Addresses PR #23 reviewer feedback requesting additional test coverage for keystore persistence guarantees.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1dc7bc7daf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| with patch("pathlib.Path.write_bytes") as mock_write: | ||
| mock_write.side_effect = OSError("Disk full") |
There was a problem hiding this comment.
Patching Path.write_bytes replaces the entire method, so this exception occurs before the existing store is opened or truncated—not “after opening file” as intended. Because _save() still writes directly to keys.json, a real short write or disk-full error after truncation can corrupt the store while this test passes; simulate a partial underlying write or implement a temporary-file-and-replace path so the persistence guarantee is actually exercised.
Useful? React with 👍 / 👎.
Coding-Dev-Tools
left a comment
Coding-Dev-Tools
left a comment
There was a problem hiding this comment.
Sentinel Re-review — Security Gate FAILURE on latest commit
Commit: 1dc7bc7daf9f783f2096ec840b84421ebfd1f74e (2026-08-09T20:36:30Z)
CI Result: security job FAILED — TruffleHog v3.96.0 exit code 183
Hard Gate Status (updated)
| Gate | Required | Actual | Status |
|---|---|---|---|
| CI Green | All pass | security FAILED | ❌ NEW FAILURE |
| Security | Clean | 1 verified Lob secret | ❌ NEW FAILURE |
| PR Age | ≥ 6 hours | ~13 hours | ✅ PASS |
| Distinct Contributors | ≥ 3 | 1 (Coding-Dev-Tools only) | ❌ FAIL |
| Reviewer Approvals | ≥ 3 | 0 | ❌ FAIL |
Security Finding
TruffleHog v3.96.0 reports:
- Verified Lob result at
tests/test_keystore_atomic.py:8 verified_secrets: 1, unverified_secrets: 0
Root cause analysis: This appears to be a false positive from the Lob API key detector in TruffleHog v3.96.0. The flagged line is def test_keystore_atomic_write_no_temp_files(tmp_path: Path) -> None: which contains no API key. The detector may be matching a substring pattern in the test data (e.g., "value": "test123" on nearby lines).
Recommended fix: Either add a .trufflehogignore pattern or use extra_args: ["--exclude-paths=trufflehog-ignore.txt"] to exclude test fixtures from scanning. Alternatively, investigate if the "test123" string triggers the Lob detector pattern.
Verdict: BLOCKED
Do not merge. Three hard gates still failing: CI security, contributor diversity (1/3), and approvals (0/3).
Sentinel: Code Review Gatekeeper | 2026-08-09T21:50Z | pointer=6 | target=apiauth
1 participant
Summary
Bumps pinned GitHub Actions to their latest releases:
actions/setup-pythonv5.6.0 → v7.0.0trufflesecurity/trufflehogv3.95.6 → v3.96.0pypa/gh-action-pypi-publish→ v1.14.2Verification
pytest tests/— 76 passedruff check src/— all checks passedCI will re-run the updated actions on this PR.