Skip to content

chore: pin yamllint, golangci-lint#783

Merged
ramonpetgrave64 merged 6 commits intoslsa-framework:mainfrom
ramonpetgrave64:yamllint
Aug 2, 2024
Merged

chore: pin yamllint, golangci-lint#783
ramonpetgrave64 merged 6 commits intoslsa-framework:mainfrom
ramonpetgrave64:yamllint

Conversation

@ramonpetgrave64
Copy link
Copy Markdown
Contributor

@ramonpetgrave64 ramonpetgrave64 commented Jun 26, 2024

pins the yaml-lint and golangci-lint dependency used in pre-submits.

This is to fix code-scanning alerts about unpinned dependencies

Testing Process

The pre-submit test that uses yamllint and golangci-lint passes

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@ramonpetgrave64 ramonpetgrave64 marked this pull request as ready for review June 26, 2024 21:46
@ramonpetgrave64
Copy link
Copy Markdown
Contributor Author

@ianlewis

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@ramonpetgrave64 ramonpetgrave64 changed the title chore: pin yamllint chore: pin yamllint, golangci-lint Jun 26, 2024
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
@@ -0,0 +1,67 @@
#
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AFAICT this is like a lock file. Should we perhaps use the Pipfile and Pipfile.lock formats instead?

https://pipenv.pypa.io/en/latest/pipfile.html

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's right, it is a lock file. I tried pipenv, but you first have to install it into the actions runner. Even actions/setp-python doesn't actually install pipenv. So I think we may as well continue using the requirements.txt.

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@ramonpetgrave64 ramonpetgrave64 enabled auto-merge (squash) June 27, 2024 17:09
@ramonpetgrave64 ramonpetgrave64 disabled auto-merge June 27, 2024 17:10
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
Copy link
Copy Markdown
Collaborator

@Hayden-IO Hayden-IO left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can’t speak to what’s correct for python dep pinning, but this seems good from what I’ve seen.

@ramonpetgrave64 ramonpetgrave64 requested a review from a team August 2, 2024 19:38
@ramonpetgrave64 ramonpetgrave64 enabled auto-merge (squash) August 2, 2024 19:48
@ramonpetgrave64 ramonpetgrave64 merged commit 88bcb6b into slsa-framework:main Aug 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants