ci: Migrate to Hatch project manager + uv package manager and static anal… - #150
ci: Migrate to Hatch project manager + uv package manager and static anal…#150rolandriver wants to merge 1 commit into
Conversation
github-actions
Bot
added
the
dev
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Run static analysis tools (Ubuntu) | ||
| strategy: | ||
| matrix: | ||
| os: [ubuntu-latest] | ||
| python-version: ["3.10"] | ||
| runs-on: ${{ matrix.os }} | ||
| steps: | ||
| - name: Checkout deltakit | ||
| uses: actions/checkout@v6 | ||
| - name: Set up Python ${{ matrix.python-version }} | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: ${{ matrix.python-version }} | ||
| - name: Install Hatch | ||
| run: | | ||
| pip install hatch | ||
| - name: Run linter (ruff) | ||
| run: | | ||
| hatch -v run static:lint | ||
| - name: Run type checker (mypy) | ||
| run: | | ||
| hatch -v run static:type |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To fix the problem, add a permissions block at the job or workflow level to limit the GITHUB_TOKEN to the least privileges required. Here, the static_analysis job only needs to check out the code and perform analysis, so it only requires read access to contents. The best fix is to add permissions: contents: read at the root level of the workflow (after the name: and before on:) to apply least privilege to all jobs unless overridden. Alternatively, the key can be placed on the static_analysis job alone. Generally, root-level is best unless certain jobs need differing scopes.
Specifically, insert:
permissions:
contents: readAfter the name: line in .github/workflows/static.yml.
No extra imports or dependencies are needed.
| @@ -1,4 +1,6 @@ | ||
| name: Static analysis | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: |
|
Closing as resolved in #149 |
2 participants
…ysis workflow.
🔗 Closed Issues
Closes #145.
📝 Description
Simplify the project and package management by using hatch and uv.
🚦 Status
WIP