[Snyk] Security upgrade setuptools from 68.0.0 to 70.0.0 #3582
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR | |
| on: | |
| pull_request_target: | |
| types: | |
| - opened | |
| - synchronize | |
| - ready_for_review | |
| - labeled | |
| jobs: | |
| env: # setup shared env | |
| runs-on: ubuntu-latest | |
| permissions: { } | |
| outputs: | |
| python-version: '3.9' | |
| source-ref: refs/pull/${{github.event.pull_request.number}}/merge | |
| upload-binaries: >- | |
| ${{ contains(github.event.pull_request.labels.*.name, 'PR: upload binaries') }} | |
| steps: | |
| - run: echo done | |
| changes: # detect changes | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| src: ${{ steps.filter.outputs.src }} | |
| scripts: ${{ steps.filter.outputs.scripts }} | |
| doc: ${{ steps.filter.outputs.doc }} | |
| build: ${{ steps.filter.outputs.build }} | |
| steps: | |
| - uses: dorny/paths-filter@v3 | |
| id: filter | |
| with: | |
| filters: | | |
| src: | |
| - '.github/workflows/pytest.yml' | |
| - '.github/workflows/guitest.yml' | |
| - '.github/workflows/coverage.yml' | |
| - '.github/actions/**' | |
| - 'src/**' | |
| - 'requirements*' | |
| scripts: | |
| - '.github/workflows/scripttest.yml' | |
| - '.github/actions/**' | |
| - 'scripts/**' | |
| - 'src/**' | |
| - 'requirements*' | |
| doc: | |
| - '.github/workflows/documentation.yml' | |
| - '.github/actions/**' | |
| - 'doc/**' | |
| - 'src/**' | |
| - 'requirements*' | |
| build: | |
| - '.github/workflows/build*.yml' | |
| - '.github/actions/**' | |
| - 'build/**' | |
| - 'src/**' | |
| - 'requirements*' | |
| gatekeeper: # check user's permissions | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: write | |
| steps: | |
| - name: Check if PR has label | |
| id: label_check | |
| uses: docker://agilepathway/pull-request-label-checker:v1.6.29 | |
| with: | |
| one_of: 'PR: safe to check' | |
| repo_token: ${{ secrets.GITHUB_TOKEN }} | |
| allow_failure: true | |
| - name: Check if user has write access | |
| id: permission_check | |
| if: steps.label_check.outputs.label_check == 'failure' | |
| uses: actions-cool/check-user-permission@956b2e73cdfe3bcb819bb7225e490cb3b18fd76e | |
| with: | |
| username: ${{ github.triggering_actor }} | |
| require: 'write' | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Find Comment | |
| if: steps.label_check.outputs.label_check == 'failure' && steps.permission_check.outputs.require-result == 'false' | |
| uses: peter-evans/find-comment@v3 | |
| id: fc | |
| with: | |
| issue-number: ${{ github.event.pull_request.number }} | |
| comment-author: 'github-actions[bot]' | |
| body-includes: add the label | |
| - name: Create comment | |
| if: steps.label_check.outputs.label_check == 'failure' && steps.permission_check.outputs.require-result == 'false' && steps.fc.outputs.comment-id == '' | |
| uses: peter-evans/create-or-update-comment@48bb05bd5554c378187694936d277d48652922e7 | |
| with: | |
| issue-number: ${{ github.event.pull_request.number }} | |
| body: | | |
| Hi @${{ github.actor }}, thank you for contributing to Tribler! 🚀 | |
| This PR was created by an outside collaborator, so some checks were not run for security reasons. | |
| To trigger the full set of checks, any member of the Tribler team can add the label `PR: safe to check` to the current PR. | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Fail if user has no access | |
| if: steps.label_check.outputs.label_check == 'failure' && steps.permission_check.outputs.require-result == 'false' | |
| run: exit 1 | |
| # ---------------------------------------------------------------------------- | |
| # PR stage: Draft | |
| coverage_draft: | |
| needs: [ changes, gatekeeper, env ] | |
| if: ${{ needs.changes.outputs.src == 'true' }} | |
| uses: ./.github/workflows/coverage.yml | |
| secrets: | |
| CODECOV_TOKEN: ${{secrets.CODECOV_TOKEN}} | |
| with: | |
| python-version: ${{needs.env.outputs.python-version}} | |
| ref: ${{needs.env.outputs.source-ref}} | |
| guitest_draft: | |
| needs: [ changes, gatekeeper, env ] | |
| if: ${{ needs.changes.outputs.src == 'true' }} | |
| uses: ./.github/workflows/guitest.yml | |
| with: | |
| python-version: ${{needs.env.outputs.python-version}} | |
| matrix: '{"os": ["windows-latest"]}' | |
| ref: ${{needs.env.outputs.source-ref}} | |
| application_tester_draft: | |
| needs: [ changes, gatekeeper, env ] | |
| if: ${{ needs.changes.outputs.src == 'true' || needs.changes.outputs.scripts == 'true'}} | |
| uses: ./.github/workflows/application_tester.yml | |
| with: | |
| python-version: ${{needs.env.outputs.python-version}} | |
| matrix: '{"os": ["ubuntu-latest"]}' | |
| ref: ${{needs.env.outputs.source-ref}} | |
| scripttest_draft: | |
| needs: [ changes, gatekeeper, env ] | |
| if: ${{ needs.changes.outputs.scripts == 'true' }} | |
| uses: ./.github/workflows/scripttest.yml | |
| with: | |
| python-version: ${{needs.env.outputs.python-version}} | |
| ref: ${{needs.env.outputs.source-ref}} | |
| # ---------------------------------------------------------------------------- | |
| # PR stage: Ready | |
| pytest: | |
| needs: [ changes, gatekeeper, env ] | |
| if: ${{needs.changes.outputs.src == 'true' && !github.event.pull_request.draft}} | |
| uses: ./.github/workflows/pytest.yml | |
| with: | |
| python-version: ${{needs.env.outputs.python-version}} | |
| matrix: '{"os": ["windows-latest", "macos-13"]}' | |
| ref: ${{needs.env.outputs.source-ref}} | |
| guitest: | |
| needs: [ changes, gatekeeper, env ] | |
| if: ${{needs.changes.outputs.src == 'true' && !github.event.pull_request.draft}} | |
| uses: ./.github/workflows/guitest.yml | |
| with: | |
| python-version: ${{needs.env.outputs.python-version}} | |
| matrix: '{"os": ["ubuntu-latest", "macos-13"]}' | |
| ref: ${{needs.env.outputs.source-ref}} | |
| application_tester: | |
| needs: [ changes, gatekeeper, env ] | |
| if: ${{ (needs.changes.outputs.src == 'true' || needs.changes.outputs.scripts == 'true') && !github.event.pull_request.draft}} | |
| uses: ./.github/workflows/application_tester.yml | |
| with: | |
| python-version: ${{needs.env.outputs.python-version}} | |
| matrix: '{"os": ["windows-latest", "macos-13"]}' | |
| ref: ${{needs.env.outputs.source-ref}} | |
| # build binaries | |
| ubuntu: | |
| needs: [ changes, env ] | |
| if: ${{needs.changes.outputs.build == 'true' && !github.event.pull_request.draft}} | |
| uses: ./.github/workflows/build_ubuntu.yml | |
| with: | |
| upload: ${{ needs.env.outputs.upload-binaries == 'true' }} | |
| os: ubuntu-latest | |
| python-version: ${{needs.env.outputs.python-version}} | |
| ref: ${{needs.env.outputs.source-ref}} | |
| mac: | |
| needs: [ changes, env ] | |
| if: ${{needs.changes.outputs.build == 'true' && !github.event.pull_request.draft}} | |
| uses: ./.github/workflows/build_mac.yml | |
| with: | |
| upload: ${{ needs.env.outputs.upload-binaries == 'true' }} | |
| os: macos-12 | |
| python-version: ${{needs.env.outputs.python-version}} | |
| ref: ${{needs.env.outputs.source-ref}} | |
| windows: | |
| needs: [ changes, env ] | |
| if: ${{needs.changes.outputs.build == 'true' && !github.event.pull_request.draft}} | |
| uses: ./.github/workflows/build_windows.yml | |
| with: | |
| upload: ${{ needs.env.outputs.upload-binaries == 'true' }} | |
| os: windows-latest | |
| python-version: ${{needs.env.outputs.python-version}} | |
| ref: ${{needs.env.outputs.source-ref}} | |
| # check documentation build | |
| documentation: | |
| needs: [ changes, env ] | |
| if: ${{needs.changes.outputs.doc == 'true' && !github.event.pull_request.draft}} | |
| uses: ./.github/workflows/documentation.yml | |
| with: | |
| python-version: ${{needs.env.outputs.python-version}} | |
| ref: ${{needs.env.outputs.source-ref}} |