From 61e2dad306d8e0980d26fe8a672b01ec3f2af0fb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 09:26:32 +0000 Subject: [PATCH 1/2] ci: bump the actions group with 3 updates Bumps the actions group with 3 updates: [anchore/sbom-action](https://github.com/anchore/sbom-action), [python-semantic-release/python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) and [python-semantic-release/publish-action](https://github.com/python-semantic-release/publish-action). Updates `anchore/sbom-action` from 0.24.0 to 0.24.2 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26) Updates `python-semantic-release/python-semantic-release` from 10.6.1 to 10.6.2 - [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases) - [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.rst) - [Commits](https://github.com/python-semantic-release/python-semantic-release/compare/39dd2052f2ce8282a5d932c31d58a2ca06d2550e...9a026e9303981c866c3425723009becb2437c757) Updates `python-semantic-release/publish-action` from 10.6.1 to 10.6.2 - [Release notes](https://github.com/python-semantic-release/publish-action/releases) - [Changelog](https://github.com/python-semantic-release/publish-action/blob/main/releaserc.toml) - [Commits](https://github.com/python-semantic-release/publish-action/compare/5a5718ce47b892ef699f2972dae122297771d641...6d89e2de8d40ecb3717316ecbbf15a6fa8ea9039) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.24.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: python-semantic-release/python-semantic-release dependency-version: 10.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: python-semantic-release/publish-action dependency-version: 10.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/native-release.yml | 2 +- .github/workflows/release.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/native-release.yml b/.github/workflows/native-release.yml index 19d9692..8b94d95 100644 --- a/.github/workflows/native-release.yml +++ b/.github/workflows/native-release.yml @@ -630,7 +630,7 @@ jobs: run: python scripts/native_release.py validate-set --directory release-assets - name: Generate a machine-readable SBOM from the exact installer set - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: release-assets format: cyclonedx-json diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 016449b..bfc7164 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -141,7 +141,7 @@ jobs: - name: Python Semantic Release if: steps.check_skip.outputs.skip != 'true' id: release - uses: python-semantic-release/python-semantic-release@39dd2052f2ce8282a5d932c31d58a2ca06d2550e # v10.6.1 + uses: python-semantic-release/python-semantic-release@9a026e9303981c866c3425723009becb2437c757 # v10.6.2 with: github_token: ${{ secrets.ADMIN_TOKEN }} @@ -151,7 +151,7 @@ jobs: - name: Publish to GitHub Releases if: steps.check_skip.outputs.skip != 'true' && steps.release.outputs.released == 'true' - uses: python-semantic-release/publish-action@5a5718ce47b892ef699f2972dae122297771d641 # v10.6.1 + uses: python-semantic-release/publish-action@6d89e2de8d40ecb3717316ecbbf15a6fa8ea9039 # v10.6.2 with: github_token: ${{ secrets.ADMIN_TOKEN }} From 1b5489c982a12face29808dfd7a3a6aae3e5af46 Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 10 Sep 2026 16:34:57 -0400 Subject: [PATCH 2/2] chore: preserve token drift checks for dependency pull requests --- .github/workflows/build.yml | 6 +----- pyproject.toml | 2 +- scripts/vendor-design-tokens.mjs | 35 ++++++++++++-------------------- tests/test_public_metadata.py | 4 ++-- 4 files changed, 17 insertions(+), 30 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0e1c4fd..e22f89f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -67,14 +67,10 @@ jobs: run: npm run test:ui && npm run build # The offline half of this guard runs in test:ui above. This half needs - # the network: it fails when openadapt-web moves the canonical palette and + # the network: it fails when openadapt-web publishes the canonical palette and # the vendored copy here does not follow, which is how the installed app # and the marketing site drift into looking like two products. - name: Check the vendored design tokens against openadapt-web - env: - # github.token cannot read private OpenAdaptAI/openadapt-web. - # ADMIN_TOKEN can; fall back so local/fork runs still try github.token. - GITHUB_TOKEN: ${{ secrets.ADMIN_TOKEN || github.token }} run: npm run tokens:check python-distribution: diff --git a/pyproject.toml b/pyproject.toml index 8e7f628..4116c07 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -120,7 +120,7 @@ packages = ["engine"] # python-semantic-release 10.6.2 still accepts click 8.1.8, which pip-audit # reports as PYSEC-2026-2132 (fix: 8.3.3). The GitHub Action is SHA-pinned at -# v10.6.1 and does not use this lock; the constraint keeps the local extra +# v10.6.2 and does not use this lock; the constraint keeps the local extra # from regressing the audited tree. [tool.uv] constraint-dependencies = ["click>=8.3.3"] diff --git a/scripts/vendor-design-tokens.mjs b/scripts/vendor-design-tokens.mjs index b8698d2..fd9e213 100755 --- a/scripts/vendor-design-tokens.mjs +++ b/scripts/vendor-design-tokens.mjs @@ -26,28 +26,19 @@ const write = process.argv.includes('--write'); const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex'); async function fetchCanonical(entry) { - // openadapt-web is private, so raw.githubusercontent.com 404s. CI already - // passes GITHUB_TOKEN; use the Contents API the same way --write does. - const token = process.env.GITHUB_TOKEN; - if (token) { - const url = - `https://api.github.com/repos/${provenance.canonical_repository}` + - `/contents/${entry.canonical_path}` + - `?ref=${encodeURIComponent(provenance.canonical_branch)}`; - const response = await fetch(url, { - headers: { - accept: 'application/vnd.github.raw', - authorization: `Bearer ${token}`, - }, - }); - if (!response.ok) { - throw new Error(`GET ${url} -> HTTP ${response.status}`); - } - return Buffer.from(await response.arrayBuffer()); + // Web publishes byte-identical canonical files during its build. Public + // reads also work for Dependabot and fork PRs without private-repo tokens. + const url = write + ? `https://api.github.com/repos/${provenance.canonical_repository}` + + `/contents/${entry.canonical_path}?ref=${encodeURIComponent(provenance.canonical_branch)}` + : `https://openadapt.ai/${entry.canonical_path}`; + const headers = { accept: write ? 'application/vnd.github.raw' : 'text/plain' }; + if (write && process.env.GITHUB_TOKEN) { + headers.authorization = `Bearer ${process.env.GITHUB_TOKEN}`; } - const response = await fetch(entry.raw_url, { headers: { accept: 'text/plain' } }); + const response = await fetch(url, { headers }); if (!response.ok) { - throw new Error(`GET ${entry.raw_url} -> HTTP ${response.status}`); + throw new Error(`GET ${url} -> HTTP ${response.status}`); } return Buffer.from(await response.arrayBuffer()); } @@ -90,7 +81,7 @@ for (const [name, entry] of Object.entries(provenance.files)) { if (canonicalSha !== vendoredSha) { failures.push( - `${name}: drifted from ${provenance.canonical_repository}@${provenance.canonical_branch}.\n` + + `${name}: drifted from the published ${provenance.canonical_repository} palette.\n` + ` canonical ${entry.canonical_path} is ${canonicalSha}\n` + ` the vendored copy is ${vendoredSha}\n` + ` Run: node scripts/vendor-design-tokens.mjs --write`, @@ -113,4 +104,4 @@ if (failures.length > 0) { process.exit(1); } -console.log(`\nVendored design tokens match ${provenance.canonical_repository}@${provenance.canonical_branch}.`); +console.log(`\nVendored design tokens match the published ${provenance.canonical_repository} palette.`); diff --git a/tests/test_public_metadata.py b/tests/test_public_metadata.py index f9ea220..3e38596 100644 --- a/tests/test_public_metadata.py +++ b/tests/test_public_metadata.py @@ -180,7 +180,7 @@ def test_release_workflow_uses_matching_pinned_actions() -> None: assert uses assert all(re.fullmatch(r"[0-9a-f]{40}", revision) for revision in uses) - assert "# v10.6.1" in workflow + assert "# v10.6.2" in workflow assert "# v9.15.2" not in workflow assert "token: ${{ secrets.ADMIN_TOKEN }}" in workflow assert workflow.count("github_token: ${{ secrets.ADMIN_TOKEN }}") == 2 @@ -223,7 +223,7 @@ def test_dev_semantic_release_floor_matches_the_pinned_v10_action() -> None: lock, flags=re.MULTILINE, ) - assert "# v10.6.1" in workflow + assert "# v10.6.2" in workflow assert "python-semantic-release>=9" not in "\n".join(dev) assert " push:" not in workflow[workflow.index("\non:\n") : workflow.index("\njobs:\n")] uv = pyproject["tool"]["uv"]