cosmos/.github/workflows/python_lint.yml at main · OpenC3/cosmos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
# Copyright 2026 OpenC3, Inc.
# All Rights Reserved.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See LICENSE.md for more details.

# This file may also be used under the terms of a commercial license
# if purchased from OpenC3, Inc.

name: Python Lint

on:
  pull_request:
    branches-ignore:
      - "dependabot/**"
    types:
      - opened
      - reopened
      - synchronize
    paths:
      - ".github/workflows/python_lint.yml"
      - "openc3/python/**/*.py"
      - ".github/scripts/check_tool_versions.py"
      - "openc3-cosmos-script-runner-api/scripts/**/*.py"
      - "openc3-cosmos-script-runner-api/test/**/*.py"
      - "openc3/python/pyproject.toml"
      - "openc3/python/uv.lock"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  ruff:
    if: ${{ github.actor != 'dependabot[bot]' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Required to publish to Security > Code scanning
      security-events: write
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # ruff parses files and never imports them, so this job has no use for
      # openc3 being installed. Skipping that editable install lets the sync
      # run --no-build, so no third-party build backend executes here. The run
      # steps below then need --no-sync: with --frozen, uv re-evaluates whether
      # the skipped project could be installed and rejects it under --no-build.
      # --no-sync keeps --no-build meaningful on them -- ruff comes from the
      # venv this step built, and nothing is resolved or built at run time.
      - name: Set up uv and Python
        uses: ./.github/actions/setup-uv-python
        with:
          no-install-project: "true"
          no-build: "true"

      # uv emits SARIF directly, so this needs no converter, and its
      # artifactLocation is already repo-relative to uv.lock. Everything found
      # is published, including advisories with no fix yet, so the Security tab
      # shows the whole picture; only the fixable ones gate the build.
      - name: Audit Python dependencies
        shell: bash
        run: |
          audit_status=0
          uv audit \
            --frozen \
            --output-format sarif \
            --preview-features audit-command \
            > uv-audit.sarif || audit_status=$?

          # Exit 1 means vulnerabilities were found, which the gate step below
          # decides on. Higher exit codes mean the audit itself failed, such as
          # a network or configuration error, and must not look like a pass.
          if (( audit_status > 1 )); then
            exit "$audit_status"
          fi
        working-directory: openc3/python

      - name: Upload audit SARIF to code scanning
        # A pull request from a fork gets a read-only token and cannot write
        # security-events, so tolerate the upload failing there rather than
        # failing the job for every outside contributor
        continue-on-error: true
        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          sarif_file: openc3/python/uv-audit.sarif
          category: uv-audit

      - name: Upload audit SARIF as an artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: uv-audit-sarif
          path: openc3/python/uv-audit.sarif
          retention-days: 14

      - name: Run ruff check on openc3/python
        run: uv run --no-sync --no-build ruff check --output-format=github openc3 tools ../../.github/scripts/check_tool_versions.py
        working-directory: openc3/python
      - name: Run ruff format check on openc3/python
        run: uv run --no-sync --no-build ruff format --check openc3 tools ../../.github/scripts/check_tool_versions.py
        working-directory: openc3/python
      - name: Run ruff check on script-runner-api scripts
        run: uv run --no-sync --no-build ruff check --output-format=github ../../openc3-cosmos-script-runner-api/scripts
        working-directory: openc3/python
      - name: Run ruff format check on script-runner-api scripts
        run: uv run --no-sync --no-build ruff format --check ../../openc3-cosmos-script-runner-api/scripts
        working-directory: openc3/python

      # Last so a vulnerable dependency does not stop ruff from reporting in
      # the same run. Only advisories with a fix version fail the build: there
      # is nothing to do about the rest, and failing on them would mean the job
      # stays red no matter what this repository changes.
      - name: Fail on fixable vulnerabilities
        shell: bash
        run: |
          fixable=$(jq -r '
            .runs[0].results[]?
            | select(.properties["uv/fixVersions"] | length > 0)
            | "\(.properties["uv/package"]) \(.properties["uv/version"])  \(.properties["uv/displayId"])  fix=\(.properties["uv/fixVersions"] | join(","))"
          ' uv-audit.sarif)

          if [ -n "$fixable" ]; then
            echo "$fixable"
            echo "::error::Dependencies with fixable vulnerabilities were found"
            exit 1
          fi
          echo "No fixable vulnerabilities found"
        working-directory: openc3/python