Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
43 commits
Select commit Hold shift + click to select a range
e85f303
Compile Python client C code with /RTC1
juliannguyen4 Mar 12, 2026
b3e5f45
/O1 is not compatible with /RTC1
juliannguyen4 Mar 12, 2026
688b45e
Add job to run dev tests on windows with debug build of python interp…
juliannguyen4 Mar 12, 2026
364f69c
Add job to run dev tests on windows with debug build of python interp…
juliannguyen4 Mar 12, 2026
0e9c280
trigger
juliannguyen4 Mar 12, 2026
b4f95ef
Somehow the shell script isn't updating the PATH for future steps
juliannguyen4 Mar 12, 2026
462a3ae
Add missing pyenv installation steps. This wasn't clear in their README
juliannguyen4 Mar 12, 2026
d964162
Try different syntax.
juliannguyen4 Mar 12, 2026
13b2d7b
Try using python.org installer
juliannguyen4 Mar 13, 2026
ab82066
Commands are powershell.
juliannguyen4 Mar 13, 2026
949162a
Fix workflow...
juliannguyen4 Mar 13, 2026
4dd0bac
3.10.19 doesn't have windows binaries
juliannguyen4 Mar 13, 2026
3fceedb
This workflow doesn't have inputs to customize the test config yet, b…
juliannguyen4 Mar 13, 2026
9c85eb7
These inputs will default to empty strings which will cause login-act…
juliannguyen4 Mar 13, 2026
e8d1a71
Fix incorrect flags. Seems like Google search assistant was making th…
juliannguyen4 Mar 13, 2026
0ad25f7
Fix the binary name.
juliannguyen4 Mar 13, 2026
70051cd
Installer is not showing logs, but /log is an available option
juliannguyen4 Mar 13, 2026
2b2e30a
Install command doesn't fail out
juliannguyen4 Mar 13, 2026
8a1437f
Run the installer directly since Start-Process does not fail if the p…
juliannguyen4 Mar 13, 2026
a9c87b1
In powershell, variable substitution is only supported with double qu…
juliannguyen4 Mar 13, 2026
d95b12a
Use call operator.
juliannguyen4 Mar 13, 2026
4c6bd7b
Turns out call operator may not wait for GUI processes to finish befo…
juliannguyen4 Mar 13, 2026
ee9af6b
WIP not done: switch to new python install manager since using the st…
juliannguyen4 Mar 14, 2026
2d2598b
Try building CPython from source with debug symbols.
juliannguyen4 Mar 15, 2026
2c9e9c4
think this is failing because of command prompt syntax
juliannguyen4 Mar 15, 2026
9111e5c
Forgot to cd into cloned repo.
juliannguyen4 Mar 15, 2026
05da20d
PATH isn't getting updated by build.bat
juliannguyen4 Mar 15, 2026
3440b0c
Fix updating PATH
juliannguyen4 Mar 16, 2026
4ce3acd
Debug why python_d is not accessible in future steps. Also possible t…
juliannguyen4 Mar 16, 2026
ac12701
This will fail without the folder actually existing...
juliannguyen4 Mar 16, 2026
54ebefd
I'm assuming GITHUB_PATH doesn't update PATH until following steps.
juliannguyen4 Mar 16, 2026
b0d46a4
Believe that the second git checkout causes cpython repo to be overwr…
juliannguyen4 Mar 16, 2026
c81ca1f
As workaround, just clone cpython inside aerospike-client-python repo…
juliannguyen4 Mar 16, 2026
70f6fad
Forgot that PATH has windows style paths. Used windows libasan branch…
juliannguyen4 Mar 16, 2026
bf56f5d
Fix pip not found error.
juliannguyen4 Mar 16, 2026
5070ce9
Fix incorrect build command. And since debug interpreter probably has…
juliannguyen4 Mar 16, 2026
7971c9c
Forgot that shell is not unix
juliannguyen4 Mar 16, 2026
2535f0e
forgot
juliannguyen4 Mar 16, 2026
11a7b5c
Fix versioningit failing to get previous tag
juliannguyen4 Mar 16, 2026
b6fcb85
Add missing build steps.
juliannguyen4 Mar 16, 2026
711db74
Somehow VS code didn't save this
juliannguyen4 Mar 16, 2026
9c77402
Nuget cli doesn't come with vs 2022
juliannguyen4 Mar 16, 2026
e3a589f
Cherry pick setup.py changes from CLIENT-4237-debug-windows-crash-dur…
juliannguyen4 Mar 16, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
on:
workflow_call:
workflow_dispatch:
pull_request:

jobs:
windows-python-dbg:
runs-on: ["self-hosted", "Windows", "X64"]
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
with:
egress-policy: audit

- name: Get tests and Github action scripts
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
ref: ${{ inputs.use_jfrog_builds && inputs.jfrog-build-version-to-test || github.sha }}
submodules: recursive
# Always required for versioningit to work when building
# TODO: maybe move to a single config file
fetch-depth: 0

- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
repository: python/cpython
submodules: recursive
path: cpython

# Why install from source:
# 1. Not using pyenv, because I believe pyenv is more suited for user installations. Installing on Github Actions
# means installing as administrator. When doing so, pyenv could not be called automatically even after setting the PATH.
# 2. Using the legacy Python install wizard to install in debug mode fails with error code 1 as well.
# 3. The newer Python install manager doesn't have a Python debug build available for Windows
- run: ./build.bat -d
working-directory: cpython/PCbuild

- run: |
pydebug_abs_path="$(realpath PCbuild/amd64/)"
echo $(cygpath -w "$pydebug_abs_path") >> $GITHUB_PATH
shell: bash
working-directory: cpython

- uses: ./.github/actions/run-ee-server
with:
# registry-name: ${{ inputs.registry-name }}
registry-username: ${{ secrets.DOCKER_HUB_BOT_USERNAME }}
registry-password: ${{ secrets.DOCKER_HUB_BOT_PW }}
# image-name: ${{ inputs.image-name }}
# server-tag: ${{ inputs.server-tag }}
where-is-client-connecting-from: 'remote-connection'

- name: 'Windows: Add msbuild to PATH'
uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2.0.0

- name: 'Windows: Install C client deps'
run: |
choco install --yes nuget.commandline
nuget restore
working-directory: aerospike-client-c/vs

- name: Install wheel
run: |
# pip isn't included by default here
python_d -m ensurepip --upgrade
python_d -m pip install build -c requirements.txt
python_d -m build
python_d -m pip install dist/*.whl
env:
UNOPTIMIZED: 1

- name: Install test dependencies
run: python_d -m pip install pytest -c requirements.txt
working-directory: test

- name: Run tests
run: python_d -m pytest new_tests/
working-directory: test
Comment on lines +8 to +78

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 1 month ago

In general, to fix this issue you must explicitly declare a permissions: block in the workflow or in the specific job, restricting the GITHUB_TOKEN to the least privileges required (typically contents: read for workflows that only need to check out code). This overrides potentially broader repo/org defaults.

For this specific workflow, the simplest, non‑breaking fix is to add a root‑level permissions: block that applies to all jobs, immediately under the on: section. The job uses actions/checkout (which needs contents: read) but does not appear to need to write to the repository or manage issues, PRs, etc. Therefore contents: read is sufficient and safe. No changes are needed to steps or secrets usage; they are unaffected by the GITHUB_TOKEN scope.

Concretely, in .github/workflows/build-and-run-dev-tests-with-windows-python-dbg.yml, insert:

permissions:
  contents: read

between the trigger block (on: ...) and the jobs: key. No imports or additional methods are needed since this is a YAML configuration change only.

Suggested changeset 1
.github/workflows/build-and-run-dev-tests-with-windows-python-dbg.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/build-and-run-dev-tests-with-windows-python-dbg.yml b/.github/workflows/build-and-run-dev-tests-with-windows-python-dbg.yml
--- a/.github/workflows/build-and-run-dev-tests-with-windows-python-dbg.yml
+++ b/.github/workflows/build-and-run-dev-tests-with-windows-python-dbg.yml
@@ -3,6 +3,9 @@
   workflow_dispatch:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   windows-python-dbg:
     runs-on: ["self-hosted", "Windows", "X64"]
EOF
@@ -3,6 +3,9 @@
workflow_dispatch:
pull_request:

permissions:
contents: read

jobs:
windows-python-dbg:
runs-on: ["self-hosted", "Windows", "X64"]
Copilot is powered by AI and may make mistakes. Always verify output.
3 changes: 3 additions & 0 deletions .github/workflows/stage-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -258,3 +258,6 @@
if: ${{ matrix.runner-os-and-arch[1] == 'arm64' }}
run: python3 -c "import aerospike"
working-directory: test

windows-dbg:
uses: .github/workflows/build-and-run-dev-tests-with-windows-python-dbg.yml

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 month ago

In general, the problem is fixed by adding an explicit permissions: block to the workflow or to the specific job so that the GITHUB_TOKEN is limited to the minimum required scope, typically contents: read (and other read scopes if needed). This documents the workflow’s expectations and prevents accidental elevation if repository or organization defaults change.

For this specific workflow, the smallest, least intrusive fix is to add a permissions: block at the root level of .github/workflows/stage-tests.yml, right after the on: definition. That block will apply to all jobs that do not override permissions, including windows-dbg. Since the shown jobs only check out code, run tests, pull Docker images, and use reusable workflows, they only need read access to repository contents; write permissions are not required. Therefore, we can safely set permissions: contents: read globally. No imports or additional methods are needed because this is a YAML configuration change only.

Concretely, in .github/workflows/stage-tests.yml, add:

permissions:
  contents: read

immediately after the on: block (after the workflow_call: configuration). This will satisfy CodeQL’s requirement and enforce least privilege for the GITHUB_TOKEN used by all jobs, including the windows-dbg job that reuses another workflow.

Suggested changeset 1
.github/workflows/stage-tests.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/stage-tests.yml b/.github/workflows/stage-tests.yml
--- a/.github/workflows/stage-tests.yml
+++ b/.github/workflows/stage-tests.yml
@@ -41,6 +41,9 @@
         description: 'Test macOS x86 wheels (unstable)'
 
 env:
+
+permissions:
+  contents: read
   REGISTRY_USERNAME: ${{ inputs.registry-name == 'docker.io' && secrets.DOCKER_HUB_BOT_USERNAME || secrets.QE_DOCKER_REGISTRY_USERNAME }}
   REGISTRY_PASSWORD: ${{ inputs.registry-name == 'docker.io' && secrets.DOCKER_HUB_BOT_PW || secrets.QE_DOCKER_REGISTRY_PASSWORD }}
 
EOF
@@ -41,6 +41,9 @@
description: 'Test macOS x86 wheels (unstable)'

env:

permissions:
contents: read
REGISTRY_USERNAME: ${{ inputs.registry-name == 'docker.io' && secrets.DOCKER_HUB_BOT_USERNAME || secrets.QE_DOCKER_REGISTRY_USERNAME }}
REGISTRY_PASSWORD: ${{ inputs.registry-name == 'docker.io' && secrets.DOCKER_HUB_BOT_PW || secrets.QE_DOCKER_REGISTRY_PASSWORD }}

Copilot is powered by AI and may make mistakes. Always verify output.
32 changes: 25 additions & 7 deletions setup.py
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@
['/usr/local/opt/openssl/include'] + \
['aerospike-client-c/modules/common/src/include']
extra_compile_args = [
'-std=gnu99', '-g', '-Wall', '-fPIC', '-DDEBUG', '-O1',
'-std=gnu99', '-g', '-Wall', '-fPIC', '-DDEBUG',
'-fno-common', '-fno-strict-aliasing',
'-D_FILE_OFFSET_BITS=64', '-D_REENTRANT',
'-DMARCH_' + machine,
Expand Down Expand Up @@ -119,8 +119,15 @@
extra_compile_args.append('-ftest-coverage')
extra_link_args.append('-lgcov')

data_files = []

if UNOPTIMIZED:
extra_compile_args.append('-O0')
if WINDOWS:
extra_compile_args.append('/Zi')
extra_link_args.append('/DEBUG')
# data_files.append("*.pdb")
else:
extra_compile_args.append('-O0')

################################################################################
# STATIC SSL LINKING BUILD SETTINGS
Expand All @@ -140,6 +147,11 @@
################################################################################

if WINDOWS:
if UNOPTIMIZED:
VS_PROJECT_CONFIGURATION = "Debug"
else:
VS_PROJECT_CONFIGURATION = "Release"

AEROSPIKE_C_TARGET = AEROSPIKE_C_HOME
tree = ET.parse(f"{AEROSPIKE_C_TARGET}/vs/aerospike/packages.config")
packages = tree.getroot()
Expand All @@ -166,8 +178,13 @@
libraries = libraries + ['rt']
AEROSPIKE_C_TARGET = AEROSPIKE_C_HOME + '/target/Linux-' + machine
elif WINDOWS:
libraries.append("pthreadVC2")
if UNOPTIMIZED:
libraries.append("pthreadVC2d")
else:
libraries.append("pthreadVC2")
extra_compile_args.append("-DAS_SHARED_IMPORT")
extra_compile_args.append("/O0")
extra_compile_args.append("/RTC1")
include_dirs.append(f"{AEROSPIKE_C_TARGET}/vs/packages/aerospike-client-c-dependencies.{c_client_dependencies_version}/build/native/include")
else:
print("error: OS not supported:", PLATFORM, file=sys.stderr)
Expand All @@ -184,9 +201,9 @@
]
else:
include_dirs.append(AEROSPIKE_C_TARGET + '/src/include')
library_dirs.append(f"{AEROSPIKE_C_TARGET}/vs/packages/aerospike-client-c-dependencies.{c_client_dependencies_version}/build/native/lib/x64/Release")
library_dirs.append(f"{AEROSPIKE_C_TARGET}/vs/packages/aerospike-client-c-dependencies.{c_client_dependencies_version}/build/native/lib/x64/{VS_PROJECT_CONFIGURATION}")
# Needed for linking the Python client with the C client
extra_objects.append(AEROSPIKE_C_TARGET + "/vs/x64/Release/aerospike.lib")
extra_objects.append(AEROSPIKE_C_TARGET + f"/vs/x64/{VS_PROJECT_CONFIGURATION}/aerospike.lib")

os.putenv('CPATH', ':'.join(include_dirs))
os.environ['CPATH'] = ':'.join(include_dirs)
Expand Down Expand Up @@ -230,7 +247,7 @@ def clean():
cmd = [
'msbuild',
'vs/aerospike.sln',
'/property:Configuration=Release'
f"/property:Configuration={VS_PROJECT_CONFIGURATION}"
]
else:
cmd = [
Expand Down Expand Up @@ -324,5 +341,6 @@ def clean():
cmdclass={
'build': CClientBuild,
'clean': CClientClean
}
},
data_files=data_files
)
Loading