Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/check.yml
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:
with:
python-version: "3.12"
enable-cache: true
cache-dependency-glob: "pyproject.toml"
cache-dependency-glob: "uv.lock"

- name: Install package with check dependencies
run: uv sync --group check
Expand Down
12 changes: 4 additions & 8 deletions .github/workflows/python-publish.yml
Original file line number Diff line number Diff line change
Expand Up @@ -25,16 +25,12 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
- name: Set up uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
python-version: "3.x"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install build
python-version: "3.12"
- name: Build package
run: python -m build
run: uv build
Comment on lines +28 to +33

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

astral-sh/setup-uv action enable-cache default value GitHub Actions

💡 Result:

The default value for the enable-cache input in the astral-sh/setup-uv GitHub Action is "auto" [1][2][3]. When set to "auto," the action automatically enables caching on GitHub-hosted runners and disables it on self-hosted runners [1][2][3]. Other valid values for this input are "true" (to force enable) and "false" (to force disable) [1][2].

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the workflow file with line numbers around the referenced section.
sed -n '1,120p' .github/workflows/python-publish.yml | cat -n

Repository: dh-tech/undate-python

Length of output: 1605


Disable setup-uv caching in this release workflow. astral-sh/setup-uv defaults to enable-cache: auto, which turns caching on for ubuntu-latest; this job publishes artifacts to PyPI, so set enable-cache: false here.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 29-29: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default

(cache-poisoning)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/python-publish.yml around lines 28 - 33, The release
workflow currently uses astral-sh/setup-uv with its default caching behavior,
which should be disabled for the PyPI publish job. Update the Set up uv step to
explicitly set enable-cache to false in the setup-uv configuration so the Build
package/publish flow does not use cache in this workflow.

Source: Linters/SAST tools

- name: Publish package
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
with:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/unit_tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,8 @@ jobs:
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
python-version: ${{ matrix.python }}
cache: "pip"
cache-dependency-path: "**/pyproject.toml"
enable-cache: true
cache-dependency-glob: "uv.lock"

- name: Install package with check dependencies
run: uv sync --group test
Expand Down
5 changes: 5 additions & 0 deletions docs/_static/custom.css
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@

.sidebar-logo {
width: 200px;
height: auto;
}

div.sphinxsidebar .powered_by a {
text-decoration: none;
border-bottom: none;
Expand Down
14 changes: 14 additions & 0 deletions docs/_static/undate_logo.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Loading