alishahryar1--free-claude-code
Ali Khokhar
776a6a4c5f
## Problem Dependabot updates passed CI without uv checking their locked packages against known malware advisories. The supported uv minimum also predated this capability. ## Changes | Before | After | | --- | --- | | Project, installers, and CI allowed uv versions without malware checking. | All supported surfaces require uv `0.11.16` or newer. | | Parallel CI runners synchronized dependencies without an OSV malware check. | Workflow-wide uv environment settings enable the check independently on every runner. | | Installers treated prerelease builds as their equivalent stable version. | Installers accept stable uv releases only while preserving valid build metadata. | | uv security-policy values and edge behavior could drift between maintained surfaces. | Contract and installer tests enforce the shared policy. | | FCC reported version `4.8.5`. | FCC reports patch version `4.8.6`. | <!-- greptile_comment --> <details open><summary><h3>Greptile Summary</h3></summary> This PR enables uv malware checks across CI and raises the supported uv baseline. The main changes are: - Requires uv `0.11.16` across project, installer, and CI configuration. - Enables the malware-check preview policy at workflow scope. - Rejects prerelease uv versions in both installers. - Adds policy and installer tests for the updated behavior. - Bumps the package and lockfile version to `4.8.6`. </details> <h3>Confidence Score: 5/5</h3> This looks safe to merge. The installer fix preserves prerelease suffixes and rejects them before numeric comparison. Both installer variants cover stable releases, build metadata, and prerelease versions. No blocking issues remain in the changed code. <details><summary><h3><a href="https://www.greptile.com/trex"><img alt="T-Rex" src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg" height="20" align="absmiddle"></a> T-Rex Logs</h3></summary> **What T-Rex did** - Policy declarations were verified to include uv 0.11.16 in the pyproject, in both installers, and in CI setup, along with workflow-level malware variables. - The installer dry run printed all planned stages and ended with the message "Dry run complete. No changes were made.". - PowerShell execution was intentionally not attempted on Linux as part of the contract validation. - A set of 10 log artifacts was collected to support inspection of policy coverage, dry-run results, and environment constraints. <a href="https://app.greptile.com/trex/runs/14927224/artifacts"><picture><source media="(prefers-color-scheme: dark)" srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifactsDark.svg?v=4"><source media="(prefers-color-scheme: light)" srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"><img alt="View all artifacts" src="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"></picture></a> <sub><a href="https://www.greptile.com/trex"><img alt="T-Rex" src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg" height="14" align="absmiddle"></a> Ran code and verified through T-Rex</sub> </details> <details open><summary><h3>Important Files Changed</h3></summary> | Filename | Overview | |----------|----------| | .github/workflows/tests.yml | Enables the uv malware-check policy at workflow scope and installs uv 0.11.16. | | pyproject.toml | Raises the required uv version and bumps the package patch version. | | scripts/install.sh | Rejects prerelease uv versions while accepting stable versions with build metadata. | | scripts/install.ps1 | Applies the same stable-version requirement to the PowerShell installer. | | tests/contracts/test_uv_policy.py | Checks uv minimum consistency and workflow-wide malware policy placement. | | tests/scripts/test_installers.py | Adds stable, build-metadata, and prerelease cases for both installers. | | uv.lock | Synchronizes the locked project version with the package version bump. | </details> <sub>Reviews (2): Last reviewed commit: ["Reject prerelease uv in installers"](https://github.com/alishahryar1/free-claude-code/commit/d35d9d44d68d78ab2f00af0cb7297ffd7b7c4c3f) | [Re-trigger Greptile](https://app.greptile.com/api/retrigger?id=45238978)</sub> <!-- /greptile_comment -->
79 行
2.4 KiB
YAML
79 行
2.4 KiB
YAML
# Branch protection: require every status check this workflow reports, for example:
|
|
# Ban suppressions and legacy annotations
|
|
# ruff-format, ruff-check, ty, pytest
|
|
# GitHub may prefix with the workflow name (e.g. "CI / ruff-format"); use the names the branch protection UI offers after a run.
|
|
|
|
name: CI
|
|
|
|
env:
|
|
UV_MALWARE_CHECK: "1"
|
|
UV_PREVIEW_FEATURES: "malware-check"
|
|
|
|
on:
|
|
push:
|
|
branches: [main, master]
|
|
pull_request:
|
|
branches: [main, master]
|
|
merge_group:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
no-suppressions-or-legacy-annotations:
|
|
name: Ban suppressions and legacy annotations
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.ref }}
|
|
repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
|
|
fetch-depth: 1
|
|
|
|
- name: "Fail on type ignores and legacy future annotations"
|
|
run: |
|
|
if grep -rE '# type: ignore|# ty: ignore|from __future__ import annotations' --include='*.py' . --exclude-dir=.venv --exclude-dir=.git; then
|
|
echo "::error::type: ignore / ty: ignore comments and legacy future annotations are not allowed. Fix the underlying type/import issue instead."
|
|
exit 1
|
|
fi
|
|
exit 0
|
|
|
|
quality:
|
|
name: ${{ matrix.id }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- id: ruff-format
|
|
run: uv run ruff format --check
|
|
- id: ruff-check
|
|
run: uv run ruff check
|
|
- id: ty
|
|
run: uv run ty check
|
|
- id: pytest
|
|
run: uv run pytest -v --tb=short
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.ref }}
|
|
repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
|
|
fetch-depth: 1
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
|
|
with:
|
|
version: "0.11.16"
|
|
enable-cache: true
|
|
cache-python: true
|
|
|
|
- name: Run
|
|
run: ${{ matrix.run }}
|