Skip to content

Commit dd4e9fe

Browse files
ModeSevenIndustrialSolutionsModeSevenIndustrialSolutions
authored
Chore: Update test/audit actions (#808)
Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
1 parent 7311031 commit dd4e9fe

File tree

4 files changed

+156
-5
lines changed

4 files changed

+156
-5
lines changed

‎.github/actions/python-audit-action/README.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<!--
2+
# SPDX-License-Identifier: Apache-2.0
3+
# SPDX-FileCopyrightText: 2025 The Linux Foundation
4+
-->
5+
6+
# 🐍 Python Dependency Audit
7+
8+
Check a Python project's dependencies for known security vulnerabilities.
9+
10+
## python-audit-action
11+
12+
## Usage Example
13+
14+
<!-- markdownlint-disable MD046 -->
15+
16+
Below is a sample matrix job configuration for this action:
17+
18+
```yaml
19+
python-audit:
20+
name: "Python Audit"
21+
runs-on: "ubuntu-24.04"
22+
needs:
23+
- python-build
24+
# Matrix job
25+
strategy:
26+
fail-fast: false
27+
matrix: ${{ fromJson(needs.python-build.outputs.matrix_json) }}
28+
permissions:
29+
contents: read
30+
steps:
31+
- name: "Audit project dependencies"
32+
uses: lfreleng-actions/python-audit-action@main
33+
with:
34+
python_version: ${{ matrix.python-version }}
35+
```
36+
37+
In the above example, a prior Python build job has run (not shown).
38+
39+
<!-- markdownlint-enable MD046 -->
40+
41+
## Inputs
42+
43+
<!-- markdownlint-disable MD013 -->
44+
45+
| Variable Name | Required | Default | Description |
46+
| --------------- | -------- | ------- | ----------------------------------------------------------- |
47+
| PYTHON_VERSION | True | N/A | Matrix job Python version |
48+
| ARTEFACT_NAME | False | | Build artefacts from previous job(s) have this name/label |
49+
| ARTEFACT_PATH | False | "dist" | Build artefacts will download to this folder/directory |
50+
| NEVER_FAIL | False | False | Even if a test fails, the workflow will NOT stop on error |
51+
| ARTEFACT_PATH | False | "dist" | Stores the test coverage report bundle as an artefact |
52+
| SUMMARY | False | True | Whether pypa/gh-action-pip-audit generates summary output |
53+
| PATH_PREFIX | False | "" | Path/directory to Python project code |
54+
55+
<!-- markdownlint-enable MD013 -->
56+
57+
## Audit Implementation
58+
59+
The audit process uses an external public action:
60+
61+
[https://github.com/pypa/gh-action-pip-audit](https://github.com/pypa/gh-action-pip-audit)

‎.github/actions/python-audit-action/action.yaml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
# SPDX-License-Identifier: Apache-2.0
3+
# SPDX-FileCopyrightText: 2025 The Linux Foundation
4+
5+
# python-audit-action
6+
name: "🐍 Python Dependency Audit"
7+
# yamllint disable-line rule:line-length
8+
description: "Check a Python project's dependencies for known security vulnerabilities"
9+
10+
inputs:
11+
# Mandatory
12+
PYTHON_VERSION:
13+
description: "Python version used to perform audit"
14+
required: true
15+
# Optional
16+
ARTEFACT_NAME:
17+
description: "Build artefacts from previous job(s) have this name/label"
18+
required: false
19+
type: string
20+
ARTEFACT_PATH:
21+
description: "Build artefacts will be downloaded to this folder/directory"
22+
required: true
23+
type: string
24+
default: "dist"
25+
NEVER_FAIL:
26+
description: "Continue even when an audit fails"
27+
required: false
28+
default: false
29+
SUMMARY:
30+
description: "Whether to generate summary output"
31+
type: boolean
32+
required: false
33+
default: true
34+
PATH_PREFIX:
35+
description: "Directory location containing project code"
36+
type: string
37+
required: false
38+
default: ""
39+
40+
runs:
41+
using: "composite"
42+
steps:
43+
- name: "Download build artefacts ⬇"
44+
# yamllint disable-line rule:line-length
45+
uses: actions/download-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
46+
with:
47+
name: "${{ inputs.artefact_name }}"
48+
path: "${{ inputs.artefact_path }}"
49+
if-no-files-found: error
50+
51+
- name: "Setup Python ${{ inputs.python_version }}"
52+
# yamllint disable-line rule:line-length
53+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
54+
with:
55+
python-version: ${{ inputs.python_version }}
56+
57+
- name: "Install tooling and build products/dependencies"
58+
shell: bash
59+
run: |
60+
# Install tooling and build products/dependencies
61+
echo "Upgrading: pip, pipx, setuptools"
62+
python -m pip install -q --upgrade pip pipx setuptools
63+
echo "Installing built package(s) and dependencies"
64+
for WHEEL in ${{ inputs.artefact_path }}/*.whl; do
65+
echo "Installing: $WHEEL"
66+
pip install -q "$WHEEL"
67+
done
68+
69+
- name: "Install from Pipfile.lock/requirements.txt"
70+
shell: bash
71+
run: |
72+
# Export/install additional dependencies
73+
if [ -f "${{ inputs.path_prefix }}"Pipfile.lock ]; then
74+
echo "Exporting dependencies from: Pipfile.lock"
75+
pipx run pipfile-requirements ${{ inputs.path_prefix }}Pipfile.lock \
76+
> ${{ inputs.path_prefix }}requirements.txt
77+
fi
78+
if [ -f "${{ inputs.path_prefix }}"requirements.txt ]; then
79+
echo "Installing dependencies from: requirements.txt"
80+
pip install -q -r requirements.txt
81+
fi
82+
83+
- name: "Auditing with: pypa/gh-action-pip-audit"
84+
# yamllint disable-line rule:line-length
85+
uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 # v1.1.0
86+
with:
87+
inputs: ${{ inputs.path_prefix }}
88+
summary: ${{ inputs.summary }}
89+
virtual-environment: env/

‎.github/actions/python-test-action/action.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ runs:
4141
shell: bash
4242
run: |
4343
# Setup action/environment
44-
set -vx
4544
if [ -z "${{ inputs.python_version }}" ]; then
4645
echo "Error: Python version was not provided ❌"
4746
exit 1
@@ -74,10 +73,10 @@ runs:
7473
echo "Installing project and dependencies"
7574
# Note: quirks with pip install need careful handling
7675
77-
78-
if [ -f "$path_prefixpyproject.toml" ]; then
76+
if [ -f "$path_prefix"pyproject.toml ]; then
7977
echo "Source: ${path_prefix%/} ⬇️"
80-
pip install -q ${path_prefix%/}
78+
pip install -q "$path_prefix"
79+
# pip install -q ${path_prefix%/}
8180
elif [ -z "$path_prefix" ] && \
8281
[ -f pyproject.toml ]; then
8382
echo "Source: pyproject.toml ⬇️"

‎.github/workflows/build-test.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ jobs:
3636
runs-on: ubuntu-24.04
3737
outputs:
3838
matrix_json: ${{ steps.python-build.outputs.matrix_json }}
39+
artefact_name: ${{ steps.python-build.outputs.artefact_name }}
3940
artefact_path: ${{ steps.python-build.outputs.artefact_path }}
4041
permissions:
4142
contents: write
@@ -103,9 +104,10 @@ jobs:
103104

104105
- name: "Audit Python project"
105106
# yamllint disable-line rule:line-length
106-
uses: lfreleng-actions/python-audit-action@f6ded736889b9dd75ec36a5aa83ff1efc4a6fbc7 # v0.1.0
107+
uses: os-climate/osc-github-devops/.github/actions/python-audit-action@main
107108
with:
108109
python_version: ${{ matrix.python-version }}
110+
artefact_name: ${{ needs.python-build.outputs.artefact_name }}
109111
artefact_path: ${{ needs.python-build.outputs.artefact_path }}
110112

111113
notebooks:

0 commit comments

Comments
 (0)