Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: pin yamllint, golangci-lint #783

Merged
merged 6 commits into from
Aug 2, 2024

Conversation

ramonpetgrave64
Copy link
Contributor

@ramonpetgrave64 ramonpetgrave64 commented Jun 26, 2024

pins the yaml-lint and golangci-lint dependency used in pre-submits.

This is to fix code-scanning alerts about unpinned dependencies

Testing Process

The pre-submit test that uses yamllint and golangci-lint passes

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@ramonpetgrave64 ramonpetgrave64 marked this pull request as ready for review June 26, 2024 21:46
@ramonpetgrave64
Copy link
Contributor Author

@ianlewis

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@ramonpetgrave64 ramonpetgrave64 changed the title chore: pin yamllint chore: pin yamllint, golangci-lint Jun 26, 2024
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
.github/workflows/requirements-lint.txt Outdated Show resolved Hide resolved
.github/workflows/requirements-lint.in Outdated Show resolved Hide resolved
@@ -0,0 +1,67 @@
#
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AFAICT this is like a lock file. Should we perhaps use the Pipfile and Pipfile.lock formats instead?

https://pipenv.pypa.io/en/latest/pipfile.html

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's right, it is a lock file. I tried pipenv, but you first have to install it into the actions runner. Even actions/setp-python doesn't actually install pipenv. So I think we may as well continue using the requirements.txt.

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@ramonpetgrave64 ramonpetgrave64 enabled auto-merge (squash) June 27, 2024 17:09
@ramonpetgrave64 ramonpetgrave64 disabled auto-merge June 27, 2024 17:10
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
Copy link
Contributor

@haydentherapper haydentherapper left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can’t speak to what’s correct for python dep pinning, but this seems good from what I’ve seen.

@ramonpetgrave64 ramonpetgrave64 requested a review from a team as a code owner August 2, 2024 19:38
@ramonpetgrave64 ramonpetgrave64 enabled auto-merge (squash) August 2, 2024 19:48
@ramonpetgrave64 ramonpetgrave64 merged commit 88bcb6b into slsa-framework:main Aug 2, 2024
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants