-
Notifications
You must be signed in to change notification settings - Fork 4
updates #250
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
updates #250
Changes from all commits
9c7127f
4b3e008
74b04c2
ccd0aea
381b949
8b91411
cefb61e
27ca90d
56a6a83
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
This file was deleted.
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,8 +1,101 @@ | ||||||||||||||||||||||||||
| version = "3.9.9" | ||||||||||||||||||||||||||
| runner.dialect = scala213 | ||||||||||||||||||||||||||
| # Main goals: | ||||||||||||||||||||||||||
| # - nicer commit diffs (trailing commas, no alignment for pattern matching, force new lines) | ||||||||||||||||||||||||||
| # - better interop with default IntelliJ IDEA setup (matching import and modifiers sorting logic) | ||||||||||||||||||||||||||
| # - better developer experience on laptop screens (like 16' MBPs) with IntelliJ IDEA (line wraps) | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| version = 3.11.5 | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| runner.dialect = scala213source3 | ||||||||||||||||||||||||||
| fileOverride { | ||||||||||||||||||||||||||
| "glob:**/src/main/scala-3/**" { | ||||||||||||||||||||||||||
| "glob:**/scala-3/**" { | ||||||||||||||||||||||||||
| runner.dialect = scala3 | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| # only format files tracked by git | ||||||||||||||||||||||||||
| project.git = true | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| maxColumn = 120 | ||||||||||||||||||||||||||
| trailingCommas = always | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| preset = default | ||||||||||||||||||||||||||
| # do not align to make nicer commit diffs | ||||||||||||||||||||||||||
| align.preset = none | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| indent { | ||||||||||||||||||||||||||
| # altering defnSite and extendSite to have this: | ||||||||||||||||||||||||||
| # final class MyErr extends RuntimeException( | ||||||||||||||||||||||||||
| # "super error message", | ||||||||||||||||||||||||||
| # ) | ||||||||||||||||||||||||||
| # instead of this: | ||||||||||||||||||||||||||
| # final class MyErr extends RuntimeException( | ||||||||||||||||||||||||||
| # "super error message", | ||||||||||||||||||||||||||
| # ) | ||||||||||||||||||||||||||
| defnSite = 2 | ||||||||||||||||||||||||||
| extendSite = 0 | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| spaces { | ||||||||||||||||||||||||||
| # makes string interpolation with curlies more visually distinct | ||||||||||||||||||||||||||
| inInterpolatedStringCurlyBraces = true | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| newlines { | ||||||||||||||||||||||||||
| # keep author new lines where possible | ||||||||||||||||||||||||||
| source = keep | ||||||||||||||||||||||||||
| # force new line after "(implicit" for multi-line arg lists | ||||||||||||||||||||||||||
| implicitParamListModifierForce = [after] | ||||||||||||||||||||||||||
| avoidForSimpleOverflow = [ | ||||||||||||||||||||||||||
| tooLong, # if the line would be too long even after newline inserted, do nothing | ||||||||||||||||||||||||||
| slc, # do nothing if overflow caused by single line comment | ||||||||||||||||||||||||||
| ] | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| verticalMultiline { | ||||||||||||||||||||||||||
| atDefnSite = true | ||||||||||||||||||||||||||
| arityThreshold = 4 # more than 3 args in a list will be turned vertical | ||||||||||||||||||||||||||
| newlineAfterOpenParen = true # for nicer commit diffs | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| # for nicer commit diffs - forces new line before last parenthesis: | ||||||||||||||||||||||||||
| # class MyCls( | ||||||||||||||||||||||||||
| # arg1: String, | ||||||||||||||||||||||||||
| # arg2: String, | ||||||||||||||||||||||||||
| # ) extends MyTrait { | ||||||||||||||||||||||||||
| # | ||||||||||||||||||||||||||
| # without it: | ||||||||||||||||||||||||||
| # class MyCls( | ||||||||||||||||||||||||||
| # arg1: String, | ||||||||||||||||||||||||||
| # arg2: String) extends MyTrait { | ||||||||||||||||||||||||||
| danglingParentheses.exclude = [] | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| docstrings { | ||||||||||||||||||||||||||
| # easier to view diffs in IDEA on 16' MBP screen if docs max line are shorter than code | ||||||||||||||||||||||||||
| wrapMaxColumn = 100 | ||||||||||||||||||||||||||
| # next settings make it similar to the default IDEA javadoc formatting | ||||||||||||||||||||||||||
| style = Asterisk | ||||||||||||||||||||||||||
| oneline = unfold | ||||||||||||||||||||||||||
| blankFirstLine = unfold | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| rewrite.rules = [ | ||||||||||||||||||||||||||
| Imports, | ||||||||||||||||||||||||||
| RedundantParens, | ||||||||||||||||||||||||||
| SortModifiers, | ||||||||||||||||||||||||||
| prefercurlyfors, | ||||||||||||||||||||||||||
| ] | ||||||||||||||||||||||||||
|
Comment on lines
+81
to
+86
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
curl -fsSL \
https://raw.githubusercontent.com/scalameta/scalafmt/v3.11.5/scalafmt-core/shared/src/main/scala/org/scalafmt/rewrite/Rewrite.scala \
| rg -n -C 2 'PreferCurlyFors|ConfCodecEx\.oneOf'Repository: evolution-gaming/random Length of output: 448 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- repository configuration ---'
sed -n '70,92p' .scalafmt.conf
printf '%s\n' '--- Scalafmt rewrite-rule decoding ---'
curl -fsSL \
https://raw.githubusercontent.com/scalameta/scalafmt/v3.11.5/scalafmt-core/shared/src/main/scala/org/scalafmt/rewrite/Rewrite.scala \
| sed -n '96,132p'
printf '%s\n' '--- documented rule name ---'
curl -fsSL \
https://scalameta.org/scalafmt/docs/configuration.html \
| rg -n -C 3 'PreferCurlyFors|prefercurlyfors'Repository: evolution-gaming/random Length of output: 50380 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- Scalafmt references in the repository ---'
rg -n -i --glob '!target/**' --glob '!node_modules/**' 'scalafmt|scalafmtVersion|scalafmt-core' . | head -80 || true
printf '%s\n' '--- Exact rule-name comparison ---'
python3 - <<'PY'
import re
import urllib.request
from pathlib import Path
source = urllib.request.urlopen(
"https://raw.githubusercontent.com/scalameta/scalafmt/v3.11.5/"
"scalafmt-core/shared/src/main/scala/org/scalafmt/rewrite/Rewrite.scala"
).read().decode()
config = Path(".scalafmt.conf").read_text()
registered = re.findall(r"^\s{4}([A-Z][A-Za-z0-9]+),\s*$", source, re.M)
configured = re.search(r"^\s*prefercurlyfors,\s*$", config, re.M)
print("registered_prefer_curly_fors:", "PreferCurlyFors" in registered)
print("configured_lowercase_token:", configured.group(0).strip() if configured else None)
print("exact_registered_match:", configured and configured.group(0).strip() in registered)
print("registered_rules:", registered)
PYRepository: evolution-gaming/random Length of output: 2764 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- build plugin configuration ---'
cat -n project/plugins.sbt
printf '%s\n' '--- Scalafmt configuration version declarations ---'
rg -n -i -uu 'scalafmt|version\s*=' .scalafmt.conf .github project build.sbt 2>/dev/null || true
printf '%s\n' '--- sbt-scalafmt 2.6.2 dependency metadata ---'
curl -fsSL \
https://repo1.maven.org/maven2/org/scalameta/sbt-scalafmt_2.12_1.0/2.6.2/sbt-scalafmt_2.12_1.0-2.6.2.pom \
| rg -n -C 2 'scalafmt|version' || true
curl -fsSL \
https://repo1.maven.org/maven2/org/scalameta/sbt-scalafmt_2.12_1.0/2.6.2/sbt-scalafmt_2.12_1.0-2.6.2.pom \
| head -40 || trueRepository: evolution-gaming/random Length of output: 4965 🏁 Script executed: #!/bin/bash
set -euo pipefail
for version in v3.11.4 v3.11.5; do
printf '%s\n' "--- Rewrite.scala ${version} ---"
curl -fsSL \
"https://raw.githubusercontent.com/scalameta/scalafmt/${version}/scalafmt-core/shared/src/main/scala/org/scalafmt/rewrite/Rewrite.scala" \
| sed -n '/private val rewrites/,/implicit val reader/p'
done
printf '%s\n' '--- Configured rewrite-rule tokens ---'
sed -n '/^rewrite\.rules[[:space:]]*=/,/^[[:space:]]*]/p' .scalafmt.confRepository: evolution-gaming/random Length of output: 1106 Use the registered Line 85 uses Proposed fix- prefercurlyfors,
+ PreferCurlyFors,📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| # put visibility modifier first | ||||||||||||||||||||||||||
| rewrite.sortModifiers.preset = styleGuide | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| # Import sorting as similar as possible to scalafix's "OrganizeImports.preset = INTELLIJ_2020_3". | ||||||||||||||||||||||||||
| # Scalafix is not used as its commands mess up "all .." build aliases and it takes long time to run, | ||||||||||||||||||||||||||
| # while its code semantic based features are not needed here. | ||||||||||||||||||||||||||
| # I.e. detection of unused imports is done with Scala compiler options. | ||||||||||||||||||||||||||
| rewrite.imports { | ||||||||||||||||||||||||||
| sort = ascii | ||||||||||||||||||||||||||
| groups = [ | ||||||||||||||||||||||||||
| [".*"], | ||||||||||||||||||||||||||
| ["java\\..*", "javax\\..*", "scala\\..*"], | ||||||||||||||||||||||||||
| ] | ||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,17 +1,17 @@ | ||
| import sbt._ | ||
| import sbt.* | ||
|
|
||
| object Dependencies { | ||
|
|
||
| val `cats-helper` = "com.evolutiongaming" %% "cats-helper" % "3.7.0" | ||
| val scalatest = "org.scalatest" %% "scalatest" % "3.2.19" | ||
| val `cats-helper` = "com.evolutiongaming" %% "cats-helper" % "3.12.2" | ||
| val scalatest = "org.scalatest" %% "scalatest" % "3.2.20" | ||
|
|
||
| object Cats { | ||
| private val version = "2.9.0" | ||
| private val version = "2.13.0" | ||
| val core = "org.typelevel" %% "cats-core" % version | ||
| } | ||
|
|
||
| object CatsEffect { | ||
| private val version = "3.4.11" | ||
| private val version = "3.7.0" | ||
| val effect = "org.typelevel" %% "cats-effect" % version | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| sbt.version=1.12.2 | ||
| sbt.version = 1.12.15 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
Repository: evolution-gaming/random
Length of output: 2245
🏁 Script executed:
Repository: evolution-gaming/random
Length of output: 1573
🌐 Web query:
GitHub Actions reusable workflow secrets inherit secret not defined workflow_call contract💡 Result:
In GitHub Actions, you can pass secrets to a reusable workflow using either explicit mapping or the inherit keyword [1][2]. When using secrets: inherit in the calling workflow, all secrets from the caller are implicitly passed to the reusable workflow [1][3]. A key behavior of this method is that it bypasses the need to explicitly define the secrets in the workflow_call trigger of the reusable workflow [1][4]. You can access these inherited secrets directly within the reusable workflow using the ${{ secrets.SECRET_NAME }} syntax, even if they are not listed in the on.workflow_call.secrets contract [1][2]. If you choose not to use secrets: inherit, you must explicitly pass each required secret in the calling workflow and define those secrets in the on.workflow_call.secrets block of the reusable workflow [5][6]. Important considerations regarding secret inheritance include: 1. Scope and Access: Secrets are only passed to directly called workflows. In a workflow chain (A > B > C), workflow C will only receive secrets from A if they are explicitly passed or inherited through each step in the chain [1][2]. 2. Environment Secrets: The on.workflow_call trigger does not support the environment keyword [1][7]. Environment secrets are not passed automatically from the caller; instead, if a reusable workflow job references an environment, it will use the environment secrets defined in the repository where the reusable workflow resides [1][7]. 3. Security: The inherit keyword provides a convenient way to share secrets, but ensure that the reusable workflow is intended to have access to all secrets available to the caller [1][3].
Citations:
🏁 Script executed:
Repository: evolution-gaming/random
Length of output: 212
🏁 Script executed:
Repository: evolution-gaming/random
Length of output: 862
🌐 Web query:
site:docs.github.com/en/actions reusable workflow caller explicit secrets must be defined workflow_call secrets inherit GITHUB_TOKEN💡 Result:
In GitHub Actions, secrets do not need to be explicitly defined in a reusable workflow's on.workflow_call block if you use the inherit keyword in the calling workflow [1]. When you use secrets: inherit in the caller workflow, all secrets available to the caller are implicitly passed to the reusable workflow, allowing you to reference them directly without prior definition in the reusable workflow's interface [1]. Regarding the GITHUB_TOKEN, it is important to note that it is automatically generated for every workflow job and is handled differently than user-defined secrets [2][3]. While the inherit keyword passes user-defined repository/environment secrets, the GITHUB_TOKEN is available by default in every job context regardless of secret inheritance [2][3]. You do not need to pass the GITHUB_TOKEN explicitly or via inheritance; it is always available, and you can reference it using ${{ secrets.GITHUB_TOKEN }} [3]. Summary of behavior: 1. Explicit definition: Required only if you are manually mapping specific secrets using the secrets keyword in the caller workflow [4][5]. 2. Implicit inheritance: If you use secrets: inherit, you do not need to define secrets in the reusable workflow's on.workflow_call block [1]. 3. GITHUB_TOKEN: This is not a standard repository secret; it is a built-in token automatically available to all workflow jobs [2]. It does not need to be defined in on.workflow_call or passed via inherit [2][3].
Citations:
🌐 Web query:
GitHub Actions reusable workflow secrets inherit GITHUB_TOKEN secrets context called workflow explicit mapping workflow_call💡 Result:
In GitHub Actions, the GITHUB_TOKEN behaves differently than standard repository secrets when using reusable workflows. 1. Automatic Availability: The called (reusable) workflow is automatically granted access to the GITHUB_TOKEN without needing explicit mapping or inheritance [1]. You do not need to pass it via the secrets map or use secrets: inherit for the GITHUB_TOKEN to be available within the called workflow [1]. 2. Permissions: When a reusable workflow is triggered, it inherits the permissions associated with the GITHUB_TOKEN as defined by the caller job [1]. If the caller job does not specify permissions, the called workflow will have default permissions [1]. Importantly, any permissions specified in the called workflow can only be the same as or more restrictive (downgraded) than those provided by the caller; they cannot be elevated [1]. 3. Comparison with Other Secrets: Unlike the GITHUB_TOKEN, standard repository secrets are not automatically passed to reusable workflows [2]. To use them, you must either: - Explicitly map them using the secrets keyword in the job definition [3]: jobs: call_workflow: uses: path/to/reusable.yml secrets: MY_SECRET: ${{ secrets.MY_SECRET }} - Use the secrets: inherit keyword to pass all secrets available to the caller workflow to the called workflow [4][5]. For reusable workflows, remember that while GITHUB_TOKEN is always accessible, any other secrets required must be explicitly handled via mapping or inheritance to avoid "secret not defined" errors during the workflow parse phase [5].
Citations:
Pin the reusable workflow and narrow secret access.
Use commit
b4557d9a82c03596dc2425e19b3cb9a6280a4739instead of@v5. The workflow reads onlyJFROG_ACCESS_TOKENbesides the automaticGITHUB_TOKEN, butsecrets: inheritpasses all caller secrets. Afterv5declaresJFROG_ACCESS_TOKENin itsworkflow_callcontract, replace inheritance with explicit mapping.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 10-10: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Sources: MCP tools, Linters/SAST tools