From 78b6c97eb7d32e8370f3743e2d81dc3ec5c807ff Mon Sep 17 00:00:00 2001 From: Erik Schaareman Date: Mon, 26 Oct 2026 22:53:51 +0100 Subject: [PATCH] chore(deps): consolidate pending Python and Actions updates Combine updates from #118, #119 and #120. Keep the Homebrew Action contract SHA-pinned without coupling its test to one dependency revision. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/check.yml | 2 +- .github/workflows/commit.yml | 2 +- .github/workflows/publish.yml | 8 +-- .github/workflows/release.yml | 2 +- .github/workflows/security.yml | 4 +- .github/workflows/verify.yml | 6 +-- poetry.lock | 71 ++++++++++++++------------- pyproject.toml | 4 +- tests/vstack/test_publish_workflow.py | 6 +-- 9 files changed, 52 insertions(+), 53 deletions(-) diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 338e6525..364f1acf 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -43,7 +43,7 @@ jobs: run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ env.PYTHON_VERSION }} cache: poetry diff --git a/.github/workflows/commit.yml b/.github/workflows/commit.yml index bbe31c33..bc1f420e 100644 --- a/.github/workflows/commit.yml +++ b/.github/workflows/commit.yml @@ -137,7 +137,7 @@ jobs: run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ env.PYTHON_VERSION }} cache: poetry diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index e24f50c1..3825d027 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -92,7 +92,7 @@ jobs: run: pipx inject poetry "poetry-dynamic-versioning[plugin]>=1.10.0,<2.0.0" - name: Setup Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ env.PYTHON_VERSION }} @@ -140,11 +140,11 @@ jobs: - name: Publish to PyPI (trusted publishing) id: publish_trusted continue-on-error: true - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 - name: Publish to PyPI (API token fallback) if: steps.publish_trusted.outcome == 'failure' && env.PYPI_API_TOKEN != '' - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 with: user: __token__ password: ${{ env.PYPI_API_TOKEN }} @@ -212,7 +212,7 @@ jobs: - name: Create Homebrew tap app token id: create_tap_token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 with: client-id: ${{ env.HOMEBREW_TAP_APP_CLIENT_ID }} private-key: ${{ env.HOMEBREW_TAP_APP_PRIVATE_KEY }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fef1a00f..b361b075 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Generate app token id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 with: # v3 requires the GitHub App client ID. client-id: ${{ secrets.APP_CLIENT_ID }} diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index fcd211e3..6601f947 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -42,7 +42,7 @@ jobs: run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ env.PYTHON_VERSION }} cache: poetry @@ -60,7 +60,7 @@ jobs: - name: Secret scan # Scan only PR diff range to reduce noise and speed up checks. - uses: trufflesecurity/trufflehog@363923b901c911a9164f50b6c423f47c15372b1c + uses: trufflesecurity/trufflehog@31ce31ee1abbcc7dc8eee5764c17121c3044c8b2 with: path: ./ base: ${{ github.event.pull_request.base.sha }} diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 27ce56bd..8b3bec39 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -45,7 +45,7 @@ jobs: run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ matrix.python-version }} cache: poetry @@ -70,7 +70,7 @@ jobs: run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ env.PYTHON_VERSION }} cache: poetry @@ -95,7 +95,7 @@ jobs: run: pipx install "poetry==${POETRY_VERSION}" - name: Setup Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 with: python-version: ${{ env.PYTHON_VERSION }} cache: poetry diff --git a/poetry.lock b/poetry.lock index 202e7452..c8f35cdc 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1,4 +1,4 @@ -# This file is automatically @generated by Poetry 2.5.1 and should not be changed by hand. +# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand. [[package]] name = "ast-serialize" @@ -511,14 +511,14 @@ files = [ [[package]] name = "packaging" -version = "26.2" +version = "26.3" description = "Core utilities for Python packages" optional = false -python-versions = ">=3.8" +python-versions = ">=3.9" groups = ["dev"] files = [ - {file = "packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e"}, - {file = "packaging-26.2.tar.gz", hash = "sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661"}, + {file = "packaging-26.3-py3-none-any.whl", hash = "sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c"}, + {file = "packaging-26.3.tar.gz", hash = "sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79"}, ] [[package]] @@ -757,30 +757,30 @@ files = [ [[package]] name = "ruff" -version = "0.17.0" +version = "0.17.1" description = "An extremely fast Python linter and code formatter, written in Rust." optional = false python-versions = ">=3.7" groups = ["dev"] files = [ - {file = "ruff-0.17.0-py3-none-linux_armv6l.whl", hash = "sha256:0e271826af9a20d18c6cfae8c51e82959167c24859686ddd3eb9a7f0842ce81e"}, - {file = "ruff-0.17.0-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:5f0ca4a40f81403689c04f12966e22f44e329ae362072d8f1587b7bda87f603b"}, - {file = "ruff-0.17.0-py3-none-macosx_11_0_arm64.whl", hash = "sha256:cbf7149e0927dc3295d5d64679a4765576eef71b00782b2ae969ef82274d6bb9"}, - {file = "ruff-0.17.0-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:13ee90156522998c3037059d8f66885c8adeeaf7643bdce2caceee196ecd23e0"}, - {file = "ruff-0.17.0-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:3d8e4a002a94cd9d0dc48b51dc69d807a172b5b9bf2b668e656424dc5b55ead1"}, - {file = "ruff-0.17.0-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c0b8a60c06a218c337e1161638d34757f83449243e2db161483ddf948e53ad14"}, - {file = "ruff-0.17.0-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a330178bdffc4205dbf3bda11d93e059e388fd6546f8cdd304501a9160363c0d"}, - {file = "ruff-0.17.0-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7bb08489e234876fa2da67ae3ea938e9a2156da80293e0e4365abd6973d98329"}, - {file = "ruff-0.17.0-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bc73e7c133e82d55b5f15897b2a442d72c0cb4a0c886c46801ce3c247150b60c"}, - {file = "ruff-0.17.0-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:db4f74c533403ab70fe4007873f6ae0c9f94a8b03158cf48d78788e47cdbe399"}, - {file = "ruff-0.17.0-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:3d8cc360e666d1914e47b0777c6906d70cf18891a55532bd0a16844195d70859"}, - {file = "ruff-0.17.0-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:d66de796b726c4801e05fa99a2a8d7a780e107be222486c304ab61765561e866"}, - {file = "ruff-0.17.0-py3-none-musllinux_1_2_i686.whl", hash = "sha256:c3f268baf004aea944f040623327119527ea231af15f7fb7890e82cea0679589"}, - {file = "ruff-0.17.0-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:864b6c1acb6b0bccf94b5a3938a1531fd09aaca5e5659a2e7bf0f3cf2a685540"}, - {file = "ruff-0.17.0-py3-none-win32.whl", hash = "sha256:5e50aa5b84decd9fe5b0bb0e6f71c3b592f1767ed09faa4b7207d933961e35cd"}, - {file = "ruff-0.17.0-py3-none-win_amd64.whl", hash = "sha256:8ab76bcda86dfd28e13776cb5de3c7bcdcf1ae3d37ed761113d1a5a415dc134c"}, - {file = "ruff-0.17.0-py3-none-win_arm64.whl", hash = "sha256:c154c73ff43f9854395e24cac507af13078962e53d2b511605058d22af1fdb88"}, - {file = "ruff-0.17.0.tar.gz", hash = "sha256:5cd03240d8208a557c2a9655a5cb07ebe36aa6bb35065f97d48c1f6adef5a322"}, + {file = "ruff-0.17.1-py3-none-linux_armv6l.whl", hash = "sha256:1796c41eafec66f4635125dd1e074a7aa27b8d20c187d484360acf11d247fc4a"}, + {file = "ruff-0.17.1-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:8eadb09a788010be29c895418bdfa513e4e1c65e64b94e5b19e4cd381f6cc7fb"}, + {file = "ruff-0.17.1-py3-none-macosx_11_0_arm64.whl", hash = "sha256:29b454f18ca3eeaf37fbf140841dcf27d36109e29dee9aae8acecb68c26c6f74"}, + {file = "ruff-0.17.1-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:872e03dd231744d6c5ec5c8af6be52b71323fc6ee096e4c8b34d9f844ee3b978"}, + {file = "ruff-0.17.1-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:4c0d6cb5f8fbac77eec9af49f4fc0eaf856b05545e372b0694d24b4e76b1c640"}, + {file = "ruff-0.17.1-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:78beced4a3c94dfedbee4b999b95b6a27b35820fdc0afbacc6d37a8da26c1cd1"}, + {file = "ruff-0.17.1-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:7feefc63921202894f0e158b0e32f45a5950d70a7fb693ccb9264816c25b1c05"}, + {file = "ruff-0.17.1-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:684154861a819bf1f433669d2a0ce9c3e54677c65b8ebb866cc2a7ec86345785"}, + {file = "ruff-0.17.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a6ef98e51de8ef38082f90653ceeb84944bd7673783eea13e1647c5b9b064189"}, + {file = "ruff-0.17.1-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:8f9aa5b5bd5fa1937803ea609c8f153b8de39bf3e0e149897ae34b0c5b52f467"}, + {file = "ruff-0.17.1-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:80e53b0e5faa3c5667f035daaa032893ae42b7cfe708c886d39ed131e54688ab"}, + {file = "ruff-0.17.1-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:056c5d5fa0ac790051ae165d7035c7bf956d02de2db557f2e9b31d877a505fca"}, + {file = "ruff-0.17.1-py3-none-musllinux_1_2_i686.whl", hash = "sha256:bd8f5a55b10f371642eacd0e8665a42a8b97da15c9a7187c79e697b77b5e0ce4"}, + {file = "ruff-0.17.1-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:ce05e6f3973611d9550a600e04bb531061e368baba31610eb57c1509a8f21a0a"}, + {file = "ruff-0.17.1-py3-none-win32.whl", hash = "sha256:1de0030a8aa78c65c5fecb84b2e5c390ac684c0452875a02afc7c083d49a496a"}, + {file = "ruff-0.17.1-py3-none-win_amd64.whl", hash = "sha256:5df76f16580fab58d0f6c98a3ac254a4abceb7b2489b8b678335869cff77b3d7"}, + {file = "ruff-0.17.1-py3-none-win_arm64.whl", hash = "sha256:42400b9a6ff8515ff27796f07f92e0195be011c86e81e381606f58ea5502fef4"}, + {file = "ruff-0.17.1.tar.gz", hash = "sha256:5bb796c5112e9fb9527f2ef2faa0a130d6312d19de92bcfaddd70dbb2d41020f"}, ] [[package]] @@ -797,14 +797,14 @@ files = [ [[package]] name = "tox" -version = "4.65.5" +version = "4.67.1" description = "tox is a generic virtualenv management and test command line tool" optional = false python-versions = ">=3.11" groups = ["dev"] files = [ - {file = "tox-4.65.5-py3-none-any.whl", hash = "sha256:17baefa138f8f4c6a552f6afc136008e7bce11a94f4b8e47c87b22dd33fc80f8"}, - {file = "tox-4.65.5.tar.gz", hash = "sha256:9b7296cc43f358736665afecb9154b04309e500c1ebe6aafe86632211b8cad41"}, + {file = "tox-4.67.1-py3-none-any.whl", hash = "sha256:23d614cb703e1f7bd39e00c046d4c261b63fb9986e185134c6be2f93531d9726"}, + {file = "tox-4.67.1.tar.gz", hash = "sha256:a68602f64421b199016127364ee47347b958391d19c2b2e53fe95673a8fe98e9"}, ] [package.dependencies] @@ -850,23 +850,24 @@ files = [ [[package]] name = "virtualenv" -version = "21.7.13" +version = "21.14.13" description = "Virtual Python Environment builder" optional = false python-versions = ">=3.9" groups = ["dev"] files = [ - {file = "virtualenv-21.7.13-py3-none-any.whl", hash = "sha256:1bea5af7463f59c4719db48fe739579a2a4f569c96f26c086edda85c96da9f59"}, - {file = "virtualenv-21.7.13.tar.gz", hash = "sha256:0355558b6f33619aab31347e43643b0ebc97f61ea3acf617b2b69e1f8a843d11"}, + {file = "virtualenv-21.14.13-py3-none-any.whl", hash = "sha256:5fbb04138a4861580b78ba9110d529a26bc48fcc93c8ec36bc0202eeed96a788"}, + {file = "virtualenv-21.14.13.tar.gz", hash = "sha256:de5307ba4b9a0001d9c8ea02832d38f63ca432880f416c1bface61c4323fd905"}, ] [package.dependencies] -distlib = ">=0.3.7,<1" -filelock = {version = ">=3.24.2,<4", markers = "python_version >= \"3.10\""} -platformdirs = ">=3.9.1,<5" -python-discovery = ">=1.6" +distlib = ">=0.4.3,<1" +filelock = {version = ">=3.24.2,<5", markers = "python_version >= \"3.10\""} +packaging = ">=26.3" +platformdirs = ">=4.4,<5" +python-discovery = ">=1.6.1" [metadata] lock-version = "2.1" python-versions = ">=3.11" -content-hash = "cc9e3044975dd758e364bd4cfa97664292356b6a9c6bda288e9e23d292cc1239" +content-hash = "26db8df7847d4e5a6a7502af4265bff7c5ff979accec42c82a7b240bf3e8014a" diff --git a/pyproject.toml b/pyproject.toml index a9963cdd..340f54b9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -80,10 +80,10 @@ poetry-dynamic-versioning = { version = ">=1.10.0,<2.0.0", extras = ["plugin"] } [tool.poetry.group.dev.dependencies] pytest = ">=9.1.1" pytest-cov = ">=7.1.0" -ruff = ">=0.17.0" +ruff = ">=0.17.1" mypy = ">=2.4.0" pre-commit = ">=4.7.0" -tox = ">=4.65.5" +tox = ">=4.67.1" types-PyYAML = ">=6.0.12.20260906" diff --git a/tests/vstack/test_publish_workflow.py b/tests/vstack/test_publish_workflow.py index 9b42406b..63fcbacb 100644 --- a/tests/vstack/test_publish_workflow.py +++ b/tests/vstack/test_publish_workflow.py @@ -2,6 +2,7 @@ from __future__ import annotations +import re from pathlib import Path import yaml @@ -66,10 +67,7 @@ def test_homebrew_job_verifies_sdist_and_dispatches_update(self) -> None: assert "HOMEBREW_TAP_DISPATCH_SECRET" in config_script app_token_step = next(step for step in steps if step.get("id") == "create_tap_token") - assert ( - app_token_step["uses"] - == "actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1" - ) + assert re.fullmatch(r"actions/create-github-app-token@[0-9a-f]{40}", app_token_step["uses"]) assert app_token_step["with"]["client-id"] == "${{ env.HOMEBREW_TAP_APP_CLIENT_ID }}" assert app_token_step["with"]["private-key"] == "${{ env.HOMEBREW_TAP_APP_PRIVATE_KEY }}" assert app_token_step["with"]["owner"] == "${{ env.HOMEBREW_TAP_REPOSITORY_OWNER }}"