From d89be06541358722d53df69edb98575bf3d75b1f Mon Sep 17 00:00:00 2001 From: Joeri Abbo Date: Sat, 26 Sep 2026 12:53:06 +0200 Subject: [PATCH] build(deps): bump actions and pip packages - actions/setup-python v6.2.0 -> v7.0.0 - anchore/scan-action v6.2.0 -> v7.4.2 - actions/checkout v6.0.2 -> v7.0.1 - schubergphilis/mcvs-general-action v0.5.8 -> v0.7.1 - schubergphilis/mcvs-pr-validation-action v0.2.0 -> v0.2.2 - flake8 7.4.1, pycodestyle 2.15.0, pyflakes 4.0.0 - pyinstaller 6.22.3 plus hashed transitive deps (needed for --require-hashes now that the unhashed install is gone) - docs: refresh versions and line refs in CLAUDE.md Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/general.yml | 4 ++-- .github/workflows/mcvs-pr-validation.yml | 4 ++-- .github/workflows/python.yml | 2 +- CLAUDE.md | 29 ++++++++++++------------ action.yml | 4 ++-- configs/pip/flake8/requirements.txt | 8 +++---- configs/pip/pyinstaller/requirements.txt | 7 +++++- 7 files changed, 31 insertions(+), 27 deletions(-) diff --git a/.github/workflows/general.yml b/.github/workflows/general.yml index 1f5658b..8bae435 100644 --- a/.github/workflows/general.yml +++ b/.github/workflows/general.yml @@ -15,8 +15,8 @@ jobs: - testing-type: yamllint runs-on: ubuntu-slim steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # yamllint disable-line rule:line-length - - uses: schubergphilis/mcvs-general-action@f52c4433add29d8eff9036bf37b5b69a2c4cf28b # v0.5.8 + - uses: schubergphilis/mcvs-general-action@c367827038743325c7f56a9490b5e3df59060986 # v0.7.1 with: testing-type: ${{ matrix.args.testing-type }} diff --git a/.github/workflows/mcvs-pr-validation.yml b/.github/workflows/mcvs-pr-validation.yml index 5c77b5c..c5c4010 100644 --- a/.github/workflows/mcvs-pr-validation.yml +++ b/.github/workflows/mcvs-pr-validation.yml @@ -15,6 +15,6 @@ jobs: MCVS-PR-validation-action: runs-on: ubuntu-slim steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # yamllint disable-line rule:line-length - - uses: schubergphilis/mcvs-pr-validation-action@b1c337a896fea52b52a93335713a435d5a07ea72 # v0.2.0 + - uses: schubergphilis/mcvs-pr-validation-action@6f153c01301ab2f92336781173b7f3a796de5f3e # v0.2.2 diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml index e5b42de..d0ef156 100644 --- a/.github/workflows/python.yml +++ b/.github/workflows/python.yml @@ -8,7 +8,7 @@ jobs: mcvs-python-action: runs-on: ubuntu-slim steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./ with: token: ${{ secrets.GITHUB_TOKEN }} diff --git a/CLAUDE.md b/CLAUDE.md index abfb040..c6685f9 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -24,22 +24,22 @@ The action is defined in `action.yml` and executes as a series of composite step - **Composite vs Docker**: Uses `using: composite` to avoid Docker overhead and enable caching - **Conditional Execution**: Steps like testing and binary building only run when applicable -- **Token Authentication**: Requires GitHub token for package registry and Docker registry access +- **Token Authentication**: Requires GitHub token to attach binaries to releases - **Version Pinning**: All tools are pinned to specific versions for reproducibility ## Version Constraints -**CRITICAL**: The following versions are pinned in `action.yml`: +**CRITICAL**: Actions are pinned by commit SHA in `action.yml`; pip packages are pinned with hashes in `configs/pip/*/requirements.txt`: -- `yamllint==1.37.1` (action.yml:21) -- `actions/setup-python@v5.6.0` (action.yml:28) -- `anchore/scan-action@v6.2.0` (action.yml:34) -- `flake8==7.2.0` (action.yml:75) -- `pyinstaller==v6.13.0` (action.yml:102) -- `svenstaro/upload-release-action@2.9.0` (action.yml:106) +- `actions/setup-python@v7.0.0` (action.yml:22) +- `anchore/scan-action@v7.4.2` (action.yml:29) +- `flake8==7.4.1` (configs/pip/flake8/requirements.txt) +- `pyinstaller==6.22.3` (configs/pip/pyinstaller/requirements.txt) +- `svenstaro/upload-release-action@2.11.5` (action.yml:104) When updating dependencies: -- Update the version in `action.yml` +- Actions: update the commit SHA and the `# vX` comment in `action.yml` +- Pip packages: update the version and all `--hash` entries (including transitive deps, required by `--require-hashes`) - Dependabot automatically creates PRs for GitHub Actions updates (see `.github/dependabot.yml`) - Python package versions must be updated manually @@ -49,7 +49,7 @@ This action is tested via PR validation: ```yaml # Validation happens automatically on PRs via .github/workflows/mcvs-pr-validation.yml -# Uses schubergphilis/mcvs-pr-validation-action@v0.2.0 +# Uses schubergphilis/mcvs-pr-validation-action@v0.2.2 ``` To test locally before committing: @@ -84,7 +84,7 @@ The action has a **configurable error threshold** for Flake8: --exclude=client/,.venv/,venv/ ``` -Pipeline fails if error count > 4 (action.yml:81-83). This threshold may need adjustment when adding strict linting rules. +Pipeline fails if error count > 4 (action.yml:76). This threshold may need adjustment when adding strict linting rules. ## PyInstaller Binary Building @@ -92,7 +92,7 @@ Binary building is **conditional** and requires: 1. Push event to a tag (`refs/tags/*`) 2. Non-empty `pyinstaller-binary-name` input -The binary is automatically attached to GitHub releases (action.yml:89-111). +The binary is automatically attached to GitHub releases (action.yml:86-111). ## Action Inputs @@ -100,7 +100,7 @@ Required inputs when using this action: | Input | Required | Purpose | |-------|----------|---------| -| `token` | Yes | GitHub token for package registry and Docker login | +| `token` | Yes | GitHub token used to attach binaries to releases | | `pyinstaller-binary-name` | No | If set, builds and releases a binary | ## Important Workflow Notes @@ -108,5 +108,4 @@ Required inputs when using this action: - Projects using this action must have a `.python-version` file to specify Python version - `requirements.txt` is optional - only installed if present - Tests only run if `import pytest` is found in Python files -- Security scanning uses severity cutoff of "high" (action.yml:39) -- Docker login required for security scanning (action.yml:40-44) +- Security scanning uses severity cutoff of "high" (action.yml:34) diff --git a/action.yml b/action.yml index 80a6a9a..653aa05 100644 --- a/action.yml +++ b/action.yml @@ -19,14 +19,14 @@ runs: # file. # # yamllint disable-line rule:line-length - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: cache: pip # # Code security scanning. # # yamllint disable-line rule:line-length - - uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v6.2.0 + - uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2 with: only-fixed: false output-format: table diff --git a/configs/pip/flake8/requirements.txt b/configs/pip/flake8/requirements.txt index 4b1f349..3bc22fb 100644 --- a/configs/pip/flake8/requirements.txt +++ b/configs/pip/flake8/requirements.txt @@ -1,4 +1,4 @@ -flake8==7.3.0 --hash=sha256:b9696257b9ce8beb888cdbe31cf885c90d31928fe202be0889a7cdafad32f01e --hash=sha256:fe044858146b9fc69b551a4b490d69cf960fcb78ad1edcb84e7fbb1b4a8e3872 -pycodestyle==2.14.0 --hash=sha256:c4b5b517d278089ff9d0abdec919cd97262a3367449ea1c8b49b91529167b783 --hash=sha256:dd6bf7cb4ee77f8e016f9c8e74a35ddd9f67e1d5fd4184d86c3b98e07099f42d -pyflakes==3.4.0 --hash=sha256:b24f96fafb7d2ab0ec5075b7350b3d2d2218eab42003821c06344973d3ea2f58 --hash=sha256:f742a7dbd0d9cb9ea41e9a24a918996e8170c799fa528688d40dd582c8265f4f -mccabe==0.7.0 --hash=sha256:6c2d30ab6be0e4a46919781807b4f0d834ebdd6c6e3dca0bda5a15f863427b6e +flake8==7.4.1 --hash=sha256:78480274a6d7289d9cb8eafeda241fac57d4ea687d26e32dfdca37b72cdeddad --hash=sha256:84ea5afcaf344487b0ea5baaebb8100f4cfaebc01f755998f75876664029f587 +pycodestyle==2.15.0 --hash=sha256:12fd2f73c7b8ee8845a0431111df8faf4c1a07d6e64e2ee7f0c74014dab14181 --hash=sha256:318f5db083869b4c4dad922d0b11124fb27ab181b6730b93371da671e31bd50e +pyflakes==4.0.0 --hash=sha256:0f7b7a78e8fcffd78b205200f045a70911f4179be1b42eac82c3323e0bf5c8aa --hash=sha256:492b27735181e3d4a6acfc08738948b666bf3e696781854ea6e0d8540d566d52 +mccabe==0.7.0 --hash=sha256:6c2d30ab6be0e4a46919781807b4f0d834ebdd6c6e3dca0bda5a15f863427b6e --hash=sha256:348e0240c33b60bbdf4e523192ef919f28cb2c3d7d5c7794f74009290f236325 diff --git a/configs/pip/pyinstaller/requirements.txt b/configs/pip/pyinstaller/requirements.txt index 5cba207..ba84073 100644 --- a/configs/pip/pyinstaller/requirements.txt +++ b/configs/pip/pyinstaller/requirements.txt @@ -1 +1,6 @@ -pyinstaller==v6.19.0 --hash=sha256:1ec54ef967996ca61dacba676227e2b23219878ccce5ee9d6f3aada7b8ed8abf --hash=sha256:3c5c251054fe4cfaa04c34a363dcfbf811545438cb7198304cd444756bc2edd2 --hash=sha256:4190e76b74f0c4b5c5f11ac360928cd2e36ec8e3194d437bf6b8648c7bc0c134 --hash=sha256:481a909c8e60c8692fc60fcb1344d984b44b943f8bc9682f2fcdae305ad297e6 --hash=sha256:4ab2bb52e58448e14ddf9450601bdedd66800465043501c1d8f1cab87b60b122 --hash=sha256:8bd68abd812d8a6ba33b9f1810e91fee0f325969733721b78151f0065319ca11 --hash=sha256:a0fc5f6b3c55aa54353f0c74ffa59b1115433c1850c6f655d62b461a2ed6cbbe --hash=sha256:b5bb6536c6560330d364d91522250f254b107cf69129d9cbcd0e6727c570be33 --hash=sha256:c2d5a539b0bfe6159d5522c8c70e1c0e487f22c2badae0f97d45246223b798ea --hash=sha256:da6d5c6391ccefe73554b9fa29b86001c8e378e0f20c2a4004f836ba537eff63 --hash=sha256:e649ba6bd1b0b89b210ad92adb5fbdc8a42dd2c5ca4f72ef3a0bfec83a424b83 --hash=sha256:ec73aeb8bd9b7f2f1240d328a4542e90b3c6e6fbc106014778431c616592a865 +pyinstaller==6.22.3 --hash=sha256:052f4a1cd4f81092ccb7a18fe8ebc9ecf832a5917317e39fb3775af4e959b253 --hash=sha256:312da84b4b31ab9750066a823734c11b7c68757fdd67c9f038bf19c330a954e4 --hash=sha256:020d4fe0627f5c73dfbcfad1a6578ef354d5fe4bdccd9d8e5a615528f5a45d2b --hash=sha256:9e4f7bd64b2103f14b4a6240fb9155e9fe7bc61391b4043bbddb7d3ebc8ab0fa --hash=sha256:f82d0fb89f21c3ed6f482ee16f341bc59e8a31dbabb9bae9ef04e53ade4dc0d9 --hash=sha256:451a4ae14b719365bf1a2f0a99dae7b3463060061c3a394c70d5264cfb439528 --hash=sha256:ea240b5dfa831ff673c97505eee0ec24670bccf71396c83109440348944c83d0 --hash=sha256:a2b6fc26601e8c2596c3d54981566934a3382e85d05d0fe91b55b6a8dcc6b282 --hash=sha256:46a3e30a118341a1ec20667a5a95aa7e0aa8c4fa129893c0151b3eb3f801a722 --hash=sha256:500bd58c7bf7e584a8435adccbd763a0b918d5c12b08d74ff50fd79b2915458b --hash=sha256:31df3cc4261e804a53d358b7897c293ec8b88b167a7cca06c78018085c855f97 --hash=sha256:05eb2f5615503e72939a7224d68b4aff572c6b0438ee4a17d0a4b481f399362d +altgraph==0.17.5 --hash=sha256:f3a22400bce1b0c701683820ac4f3b159cd301acab067c51c653e06961600597 --hash=sha256:c87b395dd12fabde9c99573a9749d67da8d29ef9de0125c7f536699b4a9bc9e7 +packaging==26.3 --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 +setuptools==84.0.0 --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 --hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73 +pyinstaller-hooks-contrib==2026.7 --hash=sha256:24257a04c7a5a7a034cf28e39dcee20fbeeb9f043076729480f2e1b69904408a --hash=sha256:5fbcaacb22c4f4aac869a127dce283f67a4b4cfcc37d496f2446603e6d68aefa +macholib==1.16.4 ; sys_platform == "darwin" --hash=sha256:da1a3fa8266e30f0ce7e97c6a54eefaae8edd1e5f86f3eb8b95457cae90265ea --hash=sha256:f408c93ab2e995cd2c46e34fe328b130404be143469e41bc366c807448979362