Skip to content

ci: keep CodeQL init/analyze on one SHA and unstick msgpack bumps #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sumitake wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: keep CodeQL init/analyze on one SHA and unstick msgpack bumps #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ updates:
day: monday
open-pull-requests-limit: 5
labels: ["dependencies", "github-actions"]
groups:
github-actions:
patterns:
- "*"

- package-ecosystem: npm
directory: /
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,11 +32,11 @@ jobs:
- name: Check out repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Initialize CodeQL
uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
with:
languages: ${{ matrix.language }}
queries: security-extended
- name: Analyze
uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
with:
category: /language:${{ matrix.language }}
2 changes: 1 addition & 1 deletion THIRD_PARTY_NOTICES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ license: <https://github.com/microsoft/vscode-languageserver-node>

## MessagePack for Python

The Python runtime depends on `msgpack` version `1.2.1`, distributed under the
The Python runtime depends on `msgpack` version `1.2.2`, distributed under the
Apache License 2.0. Source and license:
<https://github.com/msgpack/msgpack-python>

Expand Down
2 changes: 1 addition & 1 deletion docs/architecture-and-operations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,7 +230,7 @@ A production monitor should distinguish:
- Node.js: 20 and newer, continuously tested on 20, 22, and 24.
- Python: 3.11 and newer, continuously tested on 3.11 through 3.14.
- Microsoft dev-tunnels SDK: pinned to 1.3.50.
- MessagePack Python: pinned to 1.2.1.
- MessagePack Python: pinned to 1.2.2.
- RPC protocol: observed version 5 only.

The VS Code Remote RPC interface is private and can change without semantic
Expand Down
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ readme = "README.md"
requires-python = ">=3.11"
license = "MIT"
authors = [{ name = "John Osumi" }]
dependencies = ["msgpack==1.2.1"]
dependencies = ["msgpack==1.2.2"]

[project.scripts]
remote-ssh-tunnel-rpc = "remote_ssh_tunnel.cli:main"
Expand Down
2 changes: 1 addition & 1 deletion requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
msgpack==1.2.1
msgpack==1.2.2
6 changes: 4 additions & 2 deletions scripts/validate_repository.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,8 +151,10 @@ def check_runtime_contract(errors: list[str]) -> None:
errors.append("relay executable is not marked executable")

requirement = (ROOT / "requirements.txt").read_text().strip()
if requirement != "msgpack==1.2.1":
errors.append("requirements.txt must pin the audited msgpack runtime")
pyproject = (ROOT / "pyproject.toml").read_text()
pinned = re.search(r'"((?:msgpack==)[0-9][0-9.]*)"', pyproject)
if pinned is None or requirement != pinned.group(1):
errors.append("requirements.txt must pin the same msgpack version as pyproject.toml")
Comment on lines +155 to +157

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep the documented MessagePack pins synchronized

When the next Dependabot pip update changes both manifests, this check will pass even though Dependabot does not update the exact version literals in THIRD_PARTY_NOTICES.md:23 and docs/architecture-and-operations.md:233. Those files will consequently continue claiming the old runtime version. Either include those literals in the synchronization check or avoid documenting a duplicated exact version.

Useful? React with 👍 / 👎.



def check_plist(errors: list[str]) -> None:
Expand Down