ci(api-docs/py): bring pypi's cache-poisoning fix upstream, reconcile pins - #135
Merged
Merged
Conversation
… pins pypi set `enable-cache: false` on setup-uv downstream in resq-software/pypi#48 to close a zizmor cache-poisoning finding, and the template never received it. `automation/sync-templates.sh` is a blind `cp`, so the next run would have deleted the mitigation. Also bumps the four action pins to the versions pypi actually runs. The templates live outside `.github/workflows/`, which is the only path Dependabot's github-actions ecosystem scans, so they get no bump PRs. The template had fallen 1-4 majors behind every consumer, meaning a sync today would have rolled those pins backward. The rationale comment is rewritten rather than copied across. pypi's version says setup-uv "enables caching by default"; at v10.1.0 the default is `auto`, which already skips the cache on tag pushes. The case that still needs an explicit opt-out is workflow_dispatch -- the trigger these runs actually use. Verified: each SHA resolves to its commented tag; every input the template passes is declared by the bumped version (create-pull-request v7 -> v8 uses 12 of the 24 inputs v8 declares); actionlint clean.
|
Warning Review limit reachedNext included review available in 16 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The python counterpart to #134. Same three buckets, same conclusion.
What was drifting
automation/source-repo-templates/api-docs.python.ymlvs what pypi actually runs:enable-cache: falseon setup-uvThe security line
pypi set
enable-cache: falsein resq-software/pypi#48 (commitde461aa4, 2026-05-10) to close a zizmor cache-poisoning finding — alert #44 in that repo. The template never received it.That matters because
automation/sync-templates.shline 89 is a plaincp: no merge, no conflict detection. The next sync deletes every downstream line. This job opens a cross-repo PR withDOCS_REPO_PR_TOKEN, so it runs privileged — restoring a cache a less-trusted run could have populated is exactly the exposure the alert named.The comment is rewritten, not copied
pypi's rationale says setup-uv "enables caching by default". That was true at v6.0.0. At v10.1.0 the default is
auto, whose own description reads: "enables caching on GitHub-hosted runners except for release, tag push, pull_request_target, and workflow_run events."So upstream now handles the tag-push case pypi's comment cites. The opt-out is still load-bearing, for a case the original comment doesn't mention:
workflow_dispatchis not in that exclusion list, and every recorded run of these workflows across all five consumers has beenworkflow_dispatch. The comment now says that.Why the pins moved too
The templates sit in
automation/, not.github/workflows/— the only path Dependabot'sgithub-actionsecosystem scans. So they receive no bump PRs while every consumer with a Dependabot config drifts forward weekly. The template was behind pypi by:actions/checkoutv6.0.2 → v7.0.1 (×2)actions/setup-pythonv5.6.0 → v7.0.0astral-sh/setup-uvv6.0.0 → v10.1.0peter-evans/create-pull-requestv7.0.8 → v8.1.1Syncing before this PR would have rolled all four backward on pypi.
Verification
refs/tags— not assumed from the comment.action.ymlat the pinned SHA.create-pull-requestv7→v8 is the only risky one: the template passes 12 inputs, v8 declares 24, all 12 present.actionlintclean.Not addressed here
The mechanism is still a hand-run laptop script that last fired 2026-05-10. This PR makes a sync safe for pypi; it does not make syncing automatic or safe in general.