Release 0.198.0 - #4061
Open
odlbot wants to merge 17 commits into
Open
Conversation
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
* fix: make sync_db_to_hubspot resilient to bad data * test: add tests * fix: issues * fix: issues * fix: issues * fix: issues * fix: issues * fix: issues * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fix: issue --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
… updates (#4036) * Harden GitHub Actions supply-chain security with zizmor and delay dep updates Adds static analysis of GitHub Actions workflows so risky patterns (unpinned actions, excessive permissions, script injection, etc.) are caught before they land, both in CI and locally: - New CI workflow (actions-static-analysis.yml) runs zizmor against .github/workflows/ on any change to workflow files, mirroring the pattern already in use in mitodl/mitxonline. - Adds zizmor as a pre-commit hook so the same checks run locally before a workflow change is even pushed. Also sets exclude-newer = "7d" in [tool.uv] so `uv lock` only resolves packages that have been published for at least 7 days. This gives the ecosystem a window to catch and yank newly-published malicious or broken releases before mitxpro's lockfile can pick them up. Ran `uv lock` to regenerate uv.lock with the new exclude-newer-span; no package versions shifted as a result. * Exempt in-house MIT ODL packages from exclude-newer cool-down The 7-day exclude-newer added for zizmor security hardening is meant to guard against newly-published third-party malicious/vulnerable packages, not to slow down consumption of our own actively-developed releases. Add [tool.uv.exclude-newer-package] overrides of "0d" for every package we own in ol-concourse, django-aqueduct, open-edx-plugins, and ol-django, so uv always resolves these to their latest published version while the 7-day delay still applies to everything else. * Fix zizmor high-severity findings: pin unpinned actions, add uv version guard zizmor's auto-fix (zizmor --fix=all) refuses to guess a pin for non-version refs, so these two high-severity unpinned-uses findings needed manual pins to the commit each ref currently resolves to: - actions/setup-node@v2-beta in ci.yml (flagged by Sentry review on the actions-static-analysis workflow) -> pinned to the same commit as the released v2.1.3 tag. - mitodl/ol-github-workflows/.../add-to-ol-hq.yaml@main in new-issues.yml -> pinned to current main HEAD (repo has no version tags). Also added [tool.uv] required-version = ">=0.9.17" to pyproject.toml, the uv release that introduced relative-duration exclude-newer support already in use here, and aligned the pre-commit zizmor hook args (--min-severity=high --min-confidence=medium) with the CI check's threshold so local runs match CI. Deliberately left production.yml and release-candiate.yml untouched: zizmor --fix=all's incidental persist-credentials/comment fixes there are low-severity and not required to pass CI's high-severity gate, and leaving the files alone avoids any risk of touching the dangerous- triggers findings on their workflow_run trigger, which is under separate, active security review to determine actual exploitability. Remaining findings (including those) are tracked in a follow-up issue. * Harden deploy workflow permissions Add a minimal 'permissions: contents: read' block to production.yml and release-candiate.yml — neither declared one despite the repo defaulting GITHUB_TOKEN to write scope. Verified akhileshns/heroku-deploy takes no GitHub-token input and never calls the GitHub API (auth is purely via HEROKU_API_KEY/HEROKU_EMAIL), so contents: read (for actions/checkout) is sufficient. Matches the same fix applied to micromasters and ocw-studio. * fix(ci): drop redundant pull_request trigger from zizmor workflow Both push and pull_request fired on every PR commit for the same path-scoped check, running zizmor twice per push. push alone still covers PR branch commits. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(ci): add back pull_request trigger for zizmor workflow, scope push to master Bot reviewers (Copilot, Sentry) correctly flagged that a push-only trigger misses fork-based PRs and can't act as a required merge-gate status check. Scoping push to the default branch avoids the original double-run problem (push firing on every commit to a same-repo PR branch, redundant with pull_request) while restoring PR-gate coverage. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * chore: trim exclude-newer-package allowlist to this repo's actual dependencies The allowlist exempting in-house MIT ODL packages from the 7-day uv dependency cool-down was copy-pasted org-wide, unpruned. Reviewers on two separate PRs independently flagged the same thing: most of the ~44 entries (mostly Open edX plugins) aren't dependencies of this repo at all. Trimmed to the intersection with this repo's own dependency closure (uv.lock's locked package set, or pyproject.toml's declared deps where no lockfile exists). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * chore(ci): remove Heroku deployment workflows We no longer deploy mitxpro to Heroku. This also clears the two pre-existing dangerous-triggers findings zizmor flagged on these files' workflow_run usage (tracked in mitxpro#4037). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(deps): regenerate uv.lock to match the trimmed exclude-newer-package allowlist The previous commit edited pyproject.toml's allowlist without regenerating uv.lock, so 'uv sync --locked' correctly rejected the mismatch in CI. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(ci): lower zizmor gate to min-severity=medium, fix resulting findings - ci.yml: add workflow-level `permissions: contents: read` — both jobs (python-tests, javascript-tests) only checkout, build, test, and upload coverage to CodeCov, no elevated scope needed - new-issues.yml: - replace `secrets: inherit` on the `add-to-hq` reusable-workflow call with an explicit `secrets:` map naming only `OL_HQ_PROJECT_SECRET` (confirmed via the callee's `workflow_call.secrets` block in mitodl/ol-github-workflows — it's the only secret the workflow declares, used as the `github-token` for actions/add-to-project) - add `permissions: contents: read` on the `add-to-hq` job; the reusable workflow authenticates with the passed PAT secret, not GITHUB_TOKEN, so no elevated scope is needed - actions-static-analysis.yml: lower zizmor gate `min-severity` from `high` to `medium` (min-confidence stays `medium`) - .pre-commit-config.yaml: matching zizmor hook arg `--min-severity=medium` - .secrets.baseline: regenerated by detect-secrets after the `secrets: inherit` line (previously flagged as a false-positive "Secret Keyword") was removed Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
updates: - [github.com/astral-sh/ruff-pre-commit: v0.16.1 → v0.16.2](astral-sh/ruff-pre-commit@v0.16.1...v0.16.2) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
* fix(deps): revert pygsheets to 2.0.2 to unblock CI This reverts commit 8d7e6b6. pygsheets 2.0.6 depends on google-auth-oauthlib>=0.7.1, which requires google-auth>=2.14.0, but this project pins google-auth==1.35.0. That resolution is unsatisfiable, so uv.lock could never be updated to match the new pin, and CI's `uv sync --locked` has failed on every commit since 8d7e6b6 landed. Hold pygsheets at 2.0.2 until google-auth is upgraded to 2.x separately. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore(renovate): require review for google auth stack updates pygsheets, google-auth and google-auth-oauthlib are version-coupled — bumping any one of them alone is unsatisfiable against the current pins, which is how an unresolvable pygsheets bump automerged with a red python-tests and broke `uv sync --locked` on master. Add them to the existing review-required list so a bump in this cluster cannot automerge without a human looking at it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Muhammad Anas
renovate[bot]
pre-commit-ci[bot]
Tobias Macey