Skip to content

fix: improve supply chain protections#802

Open
Lash-L wants to merge 1 commit intomainfrom
supply_chain_protections
Open

fix: improve supply chain protections#802
Lash-L wants to merge 1 commit intomainfrom
supply_chain_protections

Conversation

@Lash-L
Copy link
Copy Markdown
Collaborator

@Lash-L Lash-L commented Mar 31, 2026

Add some supply chain protections that help protect us from being a supply chain risk or falling victim to a supply chain risk.

  • Enabled immutable GH releases (will need to confirm this works well with semantic release once on main
  • Move to setup-uv 8.0.0 which is immutable
  • Remove github action for pre-commit as it is in maintenance only mode
  • Add requirement that packages must be older than 3 days to be installed

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 31, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
see 58 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR tightens dependency and CI supply-chain controls by adding an exclude-newer policy for uv and updating GitHub Actions to use setup-uv plus lockfile-frozen execution for linting/testing.

Changes:

  • Add uv configuration to only install packages older than 3 days (exclude-newer) and record corresponding lockfile options.
  • Update CI to use astral-sh/setup-uv@v8.0.0, replace the pre-commit GitHub Action with uv run ..., and run pytest with --frozen.
  • Add explicit per-job GitHub token permissions for several CI jobs.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

File Description
uv.lock Adds exclude-newer/span options to the lockfile to support time-based dependency cutoffs.
pyproject.toml Configures uv to enforce a “3 days old” installation policy.
.github/workflows/ci.yml Switches CI to setup-uv@v8.0.0, runs pre-commit/pytest via uv run --frozen, and scopes job permissions.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +35 to 37
- name: Set up uv
uses: astral-sh/setup-uv@v8.0.0
with:
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For supply-chain hardening, astral-sh/setup-uv@v8.0.0 is still a mutable ref unless you pin the action to an exact commit SHA (tags can be moved/replaced). Consider switching to uses: astral-sh/setup-uv@<full-sha> (and optionally leaving the tag in a comment) to make the workflow reference itself immutable.

Copilot uses AI. Check for mistakes.
with:
python-version: ${{ matrix.python-version }}
activate-environment: true
- run: uv pip install pip
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uv pip install pip pulls an unpinned pip version at CI runtime, which makes the environment less reproducible and works against the new --frozen/lockfile approach. Consider removing this step, or pinning pip to a specific version that is accounted for in your tooling strategy (so CI doesn't drift or unexpectedly fail under the new exclude-newer policy).

Suggested change
- run: uv pip install pip

Copilot uses AI. Check for mistakes.
Comment on lines +90 to +92
contents: write
issues: write
pull-requests: write
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR-only test-release job grants broad write permissions (contents, issues, pull-requests). Given the steps are configured for no-op/dry-run (no push/tag/release), these should likely be reduced to the minimum required (typically read-only) to limit blast radius if a workflow run is compromised.

Suggested change
contents: write
issues: write
pull-requests: write
contents: read
issues: read
pull-requests: read

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WDYT about this comment?

Comment on lines +90 to +92
contents: write
issues: write
pull-requests: write
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WDYT about this comment?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants