Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/publish.yml → .github/workflows/cd.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,10 @@
- pyproject.toml

jobs:
lint:
uses: ./.github/workflows/lint.yml

build:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
name: Build
runs-on: ubuntu-latest

Expand Down
22 changes: 22 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: CI

permissions:
contents: read

on:
push:
branches:
- main
paths-ignore:
- pyproject.toml
pull_request:
branches:
- main

jobs:
commit-lint:
if: ${{ github.event_name == 'pull_request' }}
uses: ./.github/workflows/commitlint.yml

lint:
uses: ./.github/workflows/lint.yml
47 changes: 47 additions & 0 deletions .github/workflows/commitlint.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
name: Commit Lint

on:
workflow_call

jobs:
commitlint:
name: Commit Lint
runs-on: ubuntu-latest
permissions:
contents: read

steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Setup Node
uses: actions/setup-node@v3
with:
node-version: 22

- name: Install Git
run: |
if ! command -v git &> /dev/null; then
echo "Git is not installed. Installing..."
sudo apt-get update
sudo apt-get install -y git
else
echo "Git is already installed."
fi

- name: Install commitlint
run: |
npm install conventional-changelog-conventionalcommits
npm install commitlint@latest
npm install @commitlint/config-conventional

- name: Configure
run: |
echo "export default { extends: ['@commitlint/config-conventional'] };" > commitlint.config.js

- name: Validate PR commits with commitlint
run: |
git fetch origin pull/${{ github.event.pull_request.number }}/head:pr_branch
npx commitlint --from ${{ github.event.pull_request.base.sha }} --to pr_branch --verbose
Comment on lines +44 to +47

Check warning

Code scanning / CodeQL

Checkout of untrusted code in trusted context Medium

Potential unsafe checkout of untrusted pull request on privileged workflow.

Copilot Autofix

AI 4 months ago

To fix the problem, you should prevent the checkout and execution of untrusted PR code in a privileged context. The best practice is to separate the untrusted PR handling from privileged workflows. Specifically:

  1. Remove any direct fetching or checking out of PR HEAD code in a privileged workflow.
  2. Instead, perform commit linting in a workflow triggered by pull_request (unprivileged) rather than via workflow_call or pull_request_target.
  3. If you need to communicate results to privileged workflows, use artifacts and the workflow_run pattern as described in the background.
  4. For the workflow in question, you should remove the step that fetches and checks out the PR branch and instead run commitlint only on trusted code or in an unprivileged context.

Specifically, in .github/workflows/commitlint.yml, you should remove or adjust the step:

git fetch origin pull/${{ github.event.pull_request.number }}/head:pr_branch

and not run commitlint on untrusted PR code when triggered from a privileged context.


Suggested changeset 1
.github/workflows/commitlint.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -41,7 +41,7 @@
         run: |
           echo "export default { extends: ['@commitlint/config-conventional'] };" > commitlint.config.js
 
-      - name: Validate PR commits with commitlint
-        run: |
-          git fetch origin pull/${{ github.event.pull_request.number }}/head:pr_branch
-          npx commitlint --from ${{ github.event.pull_request.base.sha }} --to pr_branch --verbose
+      # Removed unsafe checkout and validation of untrusted PR branch.
+      # To safely lint PR commits, run this workflow from a 'pull_request' trigger and only on trusted refs.
+      # If needed, use artifacts to communicate results to privileged workflows.
+      # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request for safe patterns.
EOF
@@ -41,7 +41,7 @@
run: |
echo "export default { extends: ['@commitlint/config-conventional'] };" > commitlint.config.js

- name: Validate PR commits with commitlint
run: |
git fetch origin pull/${{ github.event.pull_request.number }}/head:pr_branch
npx commitlint --from ${{ github.event.pull_request.base.sha }} --to pr_branch --verbose
# Removed unsafe checkout and validation of untrusted PR branch.
# To safely lint PR commits, run this workflow from a 'pull_request' trigger and only on trusted refs.
# If needed, use artifacts to communicate results to privileged workflows.
# See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request for safe patterns.
Copilot is powered by AI and may make mistakes. Always verify output.
53 changes: 53 additions & 0 deletions .github/workflows/lint.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
name: Lint

on:
workflow_call

jobs:
# Job that runs when custom version testing is enabled - just completes successfully
skip-lint:
name: Skip Lint (Custom Version Testing)
runs-on: ubuntu-latest
if: contains(github.event.pull_request.labels.*.name, 'test-core-dev-version')
permissions:
contents: read
steps:
- name: Skip lint for custom version testing
run: |
echo "Custom version testing enabled - skipping normal lint process"
echo "This job completes successfully to allow PR merging"

# Job that runs normal lint process when custom version testing is NOT enabled
lint:
name: Lint
runs-on: ubuntu-latest
if: "!contains(github.event.pull_request.labels.*.name, 'test-core-dev-version')"
permissions:
contents: read

steps:
- name: Checkout
uses: actions/checkout@v4

- name: Setup uv
uses: astral-sh/setup-uv@v5

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Lint' step
Uses Step
uses 'astral-sh/setup-uv' with ref 'v5', not a pinned commit hash
with:
enable-cache: true

- name: Setup Python
uses: actions/setup-python@v5
with:
python-version-file: ".python-version"

- name: Install dependencies
run: uv sync --all-extras

- name: Check static types
run: uv run mypy --config-file pyproject.toml .

- name: Check linting
run: uv run ruff check .

- name: Check formatting
run: uv run ruff format --check .

3 changes: 3 additions & 0 deletions pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,9 @@ line-ending = "auto"
plugins = [
"pydantic.mypy"
]
exclude = [
"samples/.*"
]

follow_imports = "silent"
warn_redundant_casts = true
Expand Down
4 changes: 3 additions & 1 deletion samples/github-slack-agent/main.py
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,9 @@ def system_prompt(state: AgentState) -> AgentState:
_This review was generated automatically._
"""

return [{"role": "system", "content": system_message}] + state["messages"]
return [{"role": "system", "content": system_message}] + state[
"messages"
]

agent = create_react_agent(
model,
Expand Down
4 changes: 1 addition & 3 deletions samples/mcp-functions-agent/builder.py
Original file line number Diff line number Diff line change
Expand Up @@ -180,9 +180,7 @@ async def validator_agent(state: GraphState) -> GraphState:
**Example use case:** If the function reads files from disk, your setup function should create a temporary folder and write some files into it. Then, test the function against that folder path.
"""

seeder = create_react_agent(
model, tools=tools, prompt=test_case_prompt
)
seeder = create_react_agent(model, tools=tools, prompt=test_case_prompt)

test_result = await seeder.ainvoke(state)

Expand Down
1 change: 1 addition & 0 deletions samples/mcp-functions-server/server.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
# Initialize the MCP server
mcp = FastMCP("Code Functions MCP Server")


# Functions registry to track dynamically added code functions
class FunctionRegistry:
def __init__(self):
Expand Down
8 changes: 4 additions & 4 deletions src/uipath_mcp/_cli/_runtime/_context.py
Original file line number Diff line number Diff line change
Expand Up @@ -53,10 +53,10 @@ class UiPathServerType(Enum):
SelfHosted (3): Tunnel to externally hosted server
"""

UiPath = 0 # type: int # Processes, Agents, Activities
Command = 1 # type: int # npx, uvx
Coded = 2 # type: int # PackageType.MCPServer
SelfHosted = 3 # type: int # tunnel to externally hosted server
UiPath = 0 # Processes, Agents, Activities
Command = 1 # npx, uvx
Coded = 2 # PackageType.MCPServer
SelfHosted = 3 # tunnel to externally hosted server

@classmethod
def from_string(cls, name: str) -> "UiPathServerType":
Expand Down
Loading