search

cjkrolak / ThermostatSupervisor

supervisor to detect and correct thermostat deviations
MIT License
0 stars 0 forks source link

Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 #817

Closed dependabot[bot] closed 3 months ago

dependabot[bot] commented 4 months ago

Bumps pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0.

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.9.0

💅 Cosmetic Output Improvements

🛠️ Internal Dependencies

  • pre-commit linters got auto-updated @ #225
  • some notable dependency bumps include
    • cryptography == 42.0.7
    • id == 1.4.0
    • idna == 3.7 via #228
    • requests == 2.32.0 via #240
    • Twine == 5.1.0

⚙️ Secret Stuff

In #241, @​br3ndonland💰 added a Docker label linking the container image to this repository for GHCR to display it nicely. This is preparatory work for a big performance-focused refactoring he's working on in #230.

💪 New Contributors

🪞 Full Diff: https://github.com/pypa/gh-action-pypi-publish/compare/v1.8.14...v1.9.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​pradyunsg💰 for promptly unblocking this release to Marketplace as GitHub started asking for yet another developer agreement signature from the organization admins.

Commits
  • ec4db0b Merge PR #243 into unstable/v1
  • e790844 oidc-exchange: link to status dashboard
  • 87b624f 💅Update homepage @ Dockerfile to GH Marketplace
  • da2f9bb Merge pull request #241 from br3ndonland/ghcr-label
  • abbea2d Add Docker label for GHCR
  • 2734d07 build(deps): bump requests from 2.31.0 to 2.32.0 in /requirements (#240)
  • a54b9b8 ---
  • 699cd61 ⇪📦 Bump the runtime dep lockfile
  • 8414fc2 [pre-commit.ci] pre-commit autoupdate (#225)
  • 67a07eb Disable the progress bar when running twine upload
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dryrunsecurity[bot] commented 4 months ago

Hi there :wave:, @dryrunsecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
Server-Side Request Forgery Analyzer :white_check_mark: 0 findings
Configured Codepaths Analyzer :white_check_mark: 0 findings
Authn/Authz Analyzer :white_check_mark: 0 findings
IDOR Analyzer :white_check_mark: 0 findings
Secrets Analyzer :white_check_mark: 0 findings
Sensitive Files Analyzer :white_check_mark: 0 findings
SQL Injection Analyzer :white_check_mark: 0 findings

[!Note] :green_circle: Risk threshold not exceeded.

Change Summary (click to expand) The following is a summary of changes in this pull request made by me, your security buddy :robot:. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective. **Summary:** The provided code changes are related to a GitHub Actions workflow that automates the process of publishing a Python package to the PyPI (Python Package Index) repository. The changes update the version of the `pypa/gh-action-pypi-publish` action used in the workflow, which is responsible for publishing the Python package to PyPI. From an application security perspective, the key points to consider are the dependency update, the handling of sensitive information (the `PYPI_API_TOKEN`), the workflow permissions, and the workflow triggers. While the changes appear to be routine updates, it's essential to regularly review dependencies, ensure that sensitive information is properly secured, and verify that the workflow permissions and triggers are appropriate for the specific use case. **Files Changed:** - `.github/workflows/python-publish.yml`: This file is a GitHub Actions workflow configuration that sets up the necessary Python environment, installs dependencies, builds the package, and then publishes it to PyPI using the `pypa/gh-action-pypi-publish` action. The changes update the version of the `pypa/gh-action-pypi-publish` action used in the workflow.

Powered by DryRun Security

dryrunsecurity[bot] commented 3 months ago

DryRun Security Summary

The provided code changes focus on improving the security and reliability of the GitHub Actions workflow for publishing a Python package to PyPI and the Azure Pipelines YAML file for a Python project, including the use of a secure token for PyPI authentication, dependency management practices, and the inclusion of a tool to check for known security vulnerabilities, while also addressing some temporary workarounds and the secure storage of sensitive environment variables.

Expand for full summary
**Summary:** The provided code changes are related to the GitHub Actions workflow for publishing a Python package to the PyPI repository and the Azure Pipelines YAML file for a Python project. From an application security perspective, the changes introduce several security-focused improvements, including the use of a secure token for PyPI authentication, dependency management practices, and the inclusion of a tool to check for known security vulnerabilities in the project's dependencies. However, there are a few areas that require further attention, such as the temporary workarounds for ignored vulnerabilities and the secure storage of sensitive environment variables. **Files Changed:** 1. `.github/workflows/python-publish.yml`: - The code change updates the version of the `pypa/gh-action-pypi-publish` GitHub Action used in the workflow. - The workflow uses a secret `PYPI_API_TOKEN` to authenticate with the PyPI package repository when publishing the package, which is a good security practice. - The workflow installs dependencies using `pip install -r requirements.txt`, which is a common and secure way to manage Python project dependencies. - The change in the GitHub Action version used for publishing the package is a good practice, as it ensures that the workflow is using the latest version of the action. 2. `.github/azure-pipelines.yml`: - The code includes a step to run the "safety" tool to check for security vulnerabilities in the project's dependencies, which is a good security practice. - The code includes two lines to ignore specific vulnerabilities, identified by their CVE numbers (62044 and 70612). This is a temporary workaround that should be addressed in the long run. - The code includes several environment variables that are used for unit tests, such as GMAIL_USERNAME, GMAIL_PASSWORD, TCC_USERNAME, TCC_PASSWORD, and others. These sensitive information should be properly secured and not exposed in the codebase. - The code includes steps to install dependencies using pip, and it's important to ensure that the project's dependencies are up-to-date and that the versions used are the latest stable versions. - The code includes a step to run the Flake8 linter, which is a good practice to maintain code quality and catch potential issues early in the development process.

Code Analysis

We ran 7 analyzers against 2 files and 0 analyzers had findings. 7 analyzers had no findings.

Riskiness

:green_circle: Risk threshold not exceeded.

View PR in the DryRun Dashboard.