diff --git a/.github/actions/setup-test-image/action.yml b/.github/actions/setup-test-image/action.yml index 1601a5eac..238cb9bb0 100644 --- a/.github/actions/setup-test-image/action.yml +++ b/.github/actions/setup-test-image/action.yml @@ -3,15 +3,15 @@ description: 'Setup docker builder for using github actions cache' runs: using: "composite" steps: - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Set metadata id: metadata - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ibet-wallet-api tags: | type=sha,format=short - - uses: docker/build-push-action@v6 + - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: ./tests/Dockerfile_unittest diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2b8d86181..641ff700b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -10,13 +10,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -27,7 +27,7 @@ jobs: run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//} - name: Build and Push (ibet-wallet) - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . file: Dockerfile diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index c4d0d096c..8fc7d6a6e 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -25,20 +25,20 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 with: languages: ${{ matrix.language }} # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 488026845..d78acecf7 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -6,14 +6,14 @@ jobs: name: 'Build docker image' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - uses: ./.github/actions/setup-test-image lint-ruff: name: 'Lint check (ruff)' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: astral-sh/ruff-action@v3 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + - uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3 unit-test: name: 'Unit tests' runs-on: ubuntu-latest @@ -27,7 +27,7 @@ jobs: 'tests/batch/', ] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - uses: ./.github/actions/setup-test-image - name: build image on compose run: docker compose build @@ -38,14 +38,14 @@ jobs: - name: run unit test using ${{ matrix.db }} run: docker compose run -e TEST_TARGET="${{ matrix.test_target }}" ibet-wallet-api-${{ matrix.db }} - run: mv cov/.coverage cov/.coverage-${{ strategy.job-index }} - - uses: actions/upload-artifact@v6 + - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 if: matrix.db == 'postgres' with: name: .coverage-${{ strategy.job-index }} path: cov/.coverage-${{ strategy.job-index }} include-hidden-files: true - run: mv cov/pytest.xml cov/pytest-${{ strategy.job-index }}.xml - - uses: actions/upload-artifact@v6 + - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 if: matrix.db == 'postgres' with: name: pytest-${{ strategy.job-index }} @@ -59,7 +59,7 @@ jobs: packages: read pull-requests: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - uses: ./.github/actions/setup-test-image - name: build image on compose run: docker compose build @@ -67,7 +67,7 @@ jobs: run: | sudo chown runner:docker /home/runner/work/ibet-Wallet-API/ibet-Wallet-API/cov sudo chmod 777 /home/runner/work/ibet-Wallet-API/ibet-Wallet-API/cov - - uses: actions/download-artifact@v7 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: pattern: '.coverage-*' path: cov/ @@ -76,12 +76,12 @@ jobs: run: docker compose run -w /app/ibet-Wallet-API/cov ibet-wallet-api-postgres bash --login -c 'uv run coverage combine .coverage-*' - name: generate coverage xml file run: docker compose run -w /app/ibet-Wallet-API ibet-wallet-api-postgres bash --login -c 'uv run coverage xml --data-file=cov/.coverage -o cov/coverage.xml' - - uses: actions/download-artifact@v7 + - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: pattern: 'pytest-*' path: cov/ merge-multiple: true - - uses: actions/setup-node@v6 + - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: node-version: 20 - name: Install junit-report-merger @@ -115,7 +115,7 @@ jobs: matrix: db: [postgres, mysql] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - uses: ./.github/actions/setup-test-image - name: run unit test using ${{ matrix.db }} run: docker compose run ibet-wallet-api-${{ matrix.db }} bash --login -c "cd /app/ibet-Wallet-API && uv run pytest -vv --test-alembic -m 'alembic'" diff --git a/pyproject.toml b/pyproject.toml index 1a4de03e5..2cf10861c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -126,3 +126,7 @@ include = [ "batch/**/*", "cmd/**/*", ] + +[tool.uv] +# GHSA-6q48-6c7w-9gw2: require the fixed CA bundle. +constraint-dependencies = ["certifi>=2026.10.19"] diff --git a/uv.lock b/uv.lock index a1093c4af..18f3196fe 100644 --- a/uv.lock +++ b/uv.lock @@ -2,6 +2,9 @@ version = 1 revision = 3 requires-python = "==3.13.11" +[manifest] +constraints = [{ name = "certifi", specifier = ">=2026.10.19" }] + [[package]] name = "aiohappyeyeballs" version = "2.6.1" @@ -215,11 +218,11 @@ wheels = [ [[package]] name = "certifi" -version = "2025.4.26" +version = "2026.10.19" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/e8/9e/c05b3920a3b7d20d3d3310465f50348e5b3694f4f88c6daf736eef3024c4/certifi-2025.4.26.tar.gz", hash = "sha256:0a816057ea3cdefcef70270d2c515e4506bbc954f417fa5ade2021213bb8f0c6", size = 160705, upload-time = "2025-04-26T02:12:29.51Z" } +sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/4a/7e/3db2bd1b1f9e95f7cddca6d6e75e2f2bd9f51b1246e546d88addca0106bd/certifi-2025.4.26-py3-none-any.whl", hash = "sha256:30350364dfe371162649852c63336a15c70c6510c2ad5015b21c2345311805f3", size = 159618, upload-time = "2025-04-26T02:12:27.662Z" }, + { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" }, ] [[package]]