From 7669d0e41fc566457dc07b0ae30198503c553cca Mon Sep 17 00:00:00 2001 From: CJ Steiner Date: Fri, 20 Dec 2024 06:22:37 -0600 Subject: [PATCH 1/7] ci: fix issue causing runner to crash in setup * caused by harden runner issues * set-output step also has been deprecated in github actions commit 1e4e57c6c2fc25948cced37e30d62ffe0743a931 Author: csteiner <47841949+clintonsteiner@users.noreply.github.com> Date: Wed Dec 18 05:59:54 2024 -0600 Update python-package.yml commit e6cb694404424940f715ef48924b7aa36672feca Author: csteiner <47841949+clintonsteiner@users.noreply.github.com> Date: Wed Dec 18 05:58:12 2024 -0600 Update python-package.yml commit 0404295c9c2b751a1f86a299a009bbd781a88fbd Author: csteiner <47841949+clintonsteiner@users.noreply.github.com> Date: Wed Dec 18 05:52:50 2024 -0600 Update python-package.yml commit a237595c992228cf18f64640561c90186a1ccb25 Author: csteiner <47841949+clintonsteiner@users.noreply.github.com> Date: Wed Dec 18 05:51:27 2024 -0600 Update python-package.yml commit 634edf75eead461a766ea3157e464135d9ad99ed Author: csteiner <47841949+clintonsteiner@users.noreply.github.com> Date: Wed Dec 18 05:48:28 2024 -0600 Update python-package.yml --- .github/workflows/python-package.yml | 27 +++++---------------------- 1 file changed, 5 insertions(+), 22 deletions(-) diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index 14e7ee03..e5fbb075 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -11,10 +11,7 @@ on: - '**.yml' pull_request: branches: [ "master" ] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true + workflow_dispatch: # allow manual run jobs: build: @@ -28,7 +25,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v2.2.1 + uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 with: egress-policy: block allowed-endpoints: > @@ -39,6 +36,8 @@ jobs: ftp-nyc.osuosl.org:443 get.jenkins.io:443 github.com:443 + api.github.com:443 + int.api.stepsecurity.io:443 mirror.xmission.com:443 motd.ubuntu.com:443 packages.microsoft.com:443 @@ -55,23 +54,7 @@ jobs: uses: actions/setup-python@v3 with: python-version: ${{ matrix.python-version }} - - - name: Get pip cache dir - id: pip-cache - run: | - echo "::set-output name=dir::$(pip cache dir)" - - - name: Setup the Pip cache - uses: actions/cache@v3 - with: - path: ${{ steps.pip-cache.outputs.dir }} - key: >- - ${{ matrix.python-version }}-pip-${{ hashFiles('setup.cfg') }}-${{ - hashFiles('setup.py') }}-${{ hashFiles('tox.ini') }}-${{ - hashFiles('.pre-commit-config.yaml') }} - restore-keys: | - ${{ matrix.python-version }}-pip- - ${{ matrix.python-version }}- + cache: 'pip' # caching pip dependencies - name: Install dependencies run: | From 3aa16562a46da28c12b55fb65e34494067522100 Mon Sep 17 00:00:00 2001 From: CJ Steiner Date: Fri, 20 Dec 2024 06:23:02 -0600 Subject: [PATCH 2/7] makefile: fix py.test according to pytest documentation commit d05a7157fe1863bb23e3e9117ad0bc459b027ab0 Author: CJ Steiner Date: Wed Dec 18 06:38:16 2024 -0600 fix Makefile: py.test was deprecated in 2016 in favor of pytest --- Makefile | 4 ++-- jenkinsapi_tests/unittests/test_build.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Makefile b/Makefile index fd547c78..b3dec4eb 100644 --- a/Makefile +++ b/Makefile @@ -1,7 +1,7 @@ .PHONY: test lint tox coverage dist test: - py.test -sv jenkinsapi_tests + pytest -sv jenkinsapi_tests lint: pycodestyle @@ -14,4 +14,4 @@ dist: python setup.py sdist bdist_wheel coverage: - py.test -sv --cov=jenkinsapi --cov-report=term-missing --cov-report=xml jenkinsapi_tests + pytest -sv --cov=jenkinsapi --cov-report=term-missing --cov-report=xml jenkinsapi_tests diff --git a/jenkinsapi_tests/unittests/test_build.py b/jenkinsapi_tests/unittests/test_build.py index a53c439c..97db35ec 100644 --- a/jenkinsapi_tests/unittests/test_build.py +++ b/jenkinsapi_tests/unittests/test_build.py @@ -3,6 +3,7 @@ import pytz from . import configs import datetime +import warnings from typing import List from jenkinsapi.build import Build from jenkinsapi.job import Job @@ -275,10 +276,9 @@ def fake_get_data(cls, tree=None, params=None): monkeypatch.setattr(Build, "get_data", fake_get_data) with pytest.raises(Exception) as excinfo: - with pytest.warns(None) as record: + with warnings.catch_warnings(): build.get_env_vars() assert "" == str(excinfo.value) - assert len(record) == 0 def test_build_get_status(build) -> None: From 1f719afcbb42c215f3e3886b653e6f121a7178ce Mon Sep 17 00:00:00 2001 From: CJ Steiner Date: Fri, 20 Dec 2024 06:24:38 -0600 Subject: [PATCH 3/7] ci: tests fail because jenkins requires java 17 - setup in github action --- .github/workflows/python-package.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index e5fbb075..100ee2b5 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -56,6 +56,12 @@ jobs: python-version: ${{ matrix.python-version }} cache: 'pip' # caching pip dependencies + - name: setup java 17 + uses: actions/setup-java@v3 + with: + java-version: '17' + distribution: 'temurin' + - name: Install dependencies run: | sudo apt-get update; sudo apt-get install gcc libkrb5-dev From d09c1601ca0f77a6be84a750f12155470f9889f8 Mon Sep 17 00:00:00 2001 From: CJ Steiner Date: Fri, 20 Dec 2024 06:25:01 -0600 Subject: [PATCH 4/7] test_build: fix failing tests --- jenkinsapi_tests/unittests/test_build.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jenkinsapi_tests/unittests/test_build.py b/jenkinsapi_tests/unittests/test_build.py index 97db35ec..37fae50e 100644 --- a/jenkinsapi_tests/unittests/test_build.py +++ b/jenkinsapi_tests/unittests/test_build.py @@ -259,7 +259,7 @@ def fake_get_data(cls, tree=None, params=None): monkeypatch.setattr(Build, "get_data", fake_get_data) with pytest.raises(requests.HTTPError) as excinfo: - with pytest.warns(None) as record: + with pytest.warns(UserWarning) as record: build.get_env_vars() assert "404" == str(excinfo.value) assert len(record) == 1 From 770a93b672d35ce129407f8d3d613629866880ae Mon Sep 17 00:00:00 2001 From: CJ Steiner Date: Fri, 20 Dec 2024 06:44:10 -0600 Subject: [PATCH 5/7] ci: add mirrors to harden whitelist --- .github/workflows/python-package.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index 100ee2b5..adbfe744 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -45,6 +45,7 @@ jobs: pypi.org:443 updates.jenkins-ci.org:80 updates.jenkins.io:443 + mirrors.updates.jenkins.io:443 updates.jenkins.io:80 - name: Checkout From dccedc9a83f2e0c6b3265146ec872d1ff5c945b2 Mon Sep 17 00:00:00 2001 From: CJ Steiner Date: Fri, 20 Dec 2024 06:56:20 -0600 Subject: [PATCH 6/7] ci: harden runner - set to audit for now --- .github/workflows/python-package.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index adbfe744..18d66fd1 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -27,7 +27,7 @@ jobs: - name: Harden Runner uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1 with: - egress-policy: block + egress-policy: audit allowed-endpoints: > azure.archive.ubuntu.com:80 esm.ubuntu.com:443 From b7b6262034d84a4a125eda9607713068b0a14885 Mon Sep 17 00:00:00 2001 From: CJ Steiner Date: Fri, 20 Dec 2024 07:28:07 -0600 Subject: [PATCH 7/7] ci: add in missing plugins --- jenkinsapi_tests/systests/conftest.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/jenkinsapi_tests/systests/conftest.py b/jenkinsapi_tests/systests/conftest.py index 1ca2960a..d5cf871f 100644 --- a/jenkinsapi_tests/systests/conftest.py +++ b/jenkinsapi_tests/systests/conftest.py @@ -16,6 +16,7 @@ "http://updates.jenkins.io/latest/" "apache-httpcomponents-client-4-api.hpi", "http://updates.jenkins.io/latest/jsch.hpi", + "http://updates.jenkins.io/latest/gson-api.hpi", "http://updates.jenkins.io/latest/trilead-api.hpi", "http://updates.jenkins.io/latest/workflow-api.hpi", "http://updates.jenkins.io/latest/display-url-api.hpi", @@ -25,7 +26,9 @@ "http://updates.jenkins.io/latest/script-security.hpi", "http://updates.jenkins.io/latest/matrix-project.hpi", "http://updates.jenkins.io/latest/credentials.hpi", + "http://updates.jenkins.io/latest/variant.hpi", "http://updates.jenkins.io/latest/ssh-credentials.hpi", + "http://updates.jenkins.io/latest/asm-api.hpi", "http://updates.jenkins.io/latest/scm-api.hpi", "http://updates.jenkins.io/latest/mailer.hpi", "http://updates.jenkins.io/latest/git.hpi", @@ -43,6 +46,7 @@ "http://updates.jenkins.io/latest/caffeine-api.hpi", "http://updates.jenkins.io/latest/script-security.hpi", "http://updates.jenkins.io/latest/checks-api.hpi", + "http://updates.jenkins.io/latest/json-api.hpi", "http://updates.jenkins.io/latest/jackson2-api.hpi", "http://updates.jenkins.io/latest/bootstrap5-api.hpi", "http://updates.jenkins.io/latest/echarts-api.hpi",