Skip to content

Ci/python enable checks - #236

Merged
jonas-dfns merged 3 commits into
mainfrom
ci/python-enable-checks
Jul 2, 2026
Merged

Ci/python enable checks#236
jonas-dfns merged 3 commits into
mainfrom
ci/python-enable-checks

Conversation

@jonas-dfns

@jonas-dfns jonas-dfns commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

No description provided.

jonas-dfns and others added 2 commits July 2, 2026 11:12
@jonas-dfns
ci: enable lint, type-check and test workflow
108ec64 
Add a Build workflow running ruff check, mypy --strict and pytest across the
supported Python matrix (3.10/3.11/3.12), plus the client/delegated/multipart
test suites. Declare typing_extensions as a runtime dependency (the generated
SDK imports NotRequired/deprecated from it) and respx as a dev dependency (used
by the HTTP-mocking tests).

pyproject.toml, tests/ and .github/ are hand-maintained in this repo (the sync
from the monorepo overlays only generated code and preserves them), so these
gates persist across syncs. The generated SDK is emitted lint- and type-clean
by the monorepo generator, so no hand-edits to dfns_sdk/ are needed.
@jonas-dfns @claude
test: cover KeySigner user-action challenge signing
44b2b63 
Repo-owned tests for dfns_sdk.auth.KeySigner: Ed25519 + ECDSA(P-256) assertion structure
(kind/credId/clientData) and signature verification against the public key over the exact
clientData bytes, Ed25519 determinism, and app_origin propagation. Generates ephemeral keys
in-test (cryptography), no fixtures.

NOTE: unsigned (author away) — amend/re-sign on review.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@jonas-dfns
jonas-dfns requested a review from a team July 2, 2026 09:14
@socket-security

socket-security Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedpypi/​typing-extensions@​4.16.0100100100100100
Addedpypi/​respx@​0.23.1100100100100100

View full report

@socket-security

socket-security Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Medium
System shell access: pypi typing-extensions

Location: Package overview

From: pyproject.toml → pypi/typing-extensions@4.16.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/typing-extensions@4.16.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Filesystem access: pypi typing-extensions

Location: Package overview

From: pyproject.toml → pypi/typing-extensions@4.16.0

ℹ Read more on: This package | This alert | What is filesystem access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/typing-extensions@4.16.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@jonas-dfns
jonas-dfns enabled auto-merge July 2, 2026 09:42
james-dfns
james-dfns requested changes Jul 2, 2026
View reviewed changes
Comment thread .github/workflows/build.yaml Outdated
@jonas-dfns @james-dfns
Update .github/workflows/build.yaml
673a2af 
Co-authored-by: James Barrios <jamesbarrios@dfns.co>
@jonas-dfns
jonas-dfns requested a review from james-dfns July 2, 2026 13:30
@jonas-dfns
jonas-dfns merged commit 9e847d7 into main Jul 2, 2026
4 of 5 checks passed
@james-dfns

james-dfns commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

@SocketSecurity ignore pypi/typing-extensions@4.16.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@james-dfns james-dfns james-dfns approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jonas-dfns @james-dfns