Skip to content

Commit 43f74b5

Browse files
Tednoob17Tednoob17
authored
Merge branch 'main' into feat/cloudvulndb-importer
2 parents b7e51a9 + 818b92b commit 43f74b5

128 files changed

Lines changed: 6790 additions & 2064 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/docs.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ on: [push, pull_request]
55
jobs:
66
build:
77
runs-on: ubuntu-22.04
8+
permissions:
9+
contents: read
810

911
strategy:
1012
max-parallel: 4
@@ -13,10 +15,10 @@ jobs:
1315

1416
steps:
1517
- name: Checkout code
16-
uses: actions/checkout@v2
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1719

1820
- name: Set up Python ${{ matrix.python-version }}
19-
uses: actions/setup-python@v2
21+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2022
with:
2123
python-version: ${{ matrix.python-version }}
2224

‎.github/workflows/main.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ name: run tests
22

33
on: [push, pull_request]
44

5+
56
env:
67
DB_NAME: vulnerablecode
78
DB_USER: vulnerablecode
@@ -10,6 +11,8 @@ env:
1011
jobs:
1112
build:
1213
runs-on: ubuntu-22.04
14+
permissions:
15+
contents: read
1316

1417
services:
1518
postgres:
@@ -33,10 +36,10 @@ jobs:
3336

3437
steps:
3538
- name: Checkout code
36-
uses: actions/checkout@v2
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3740

3841
- name: Set up Python ${{ matrix.python-version }}
39-
uses: actions/setup-python@v2
42+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
4043
with:
4144
python-version: ${{ matrix.python-version }}
4245

‎.github/workflows/pypi-release-aboutcode-federated.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,14 @@ jobs:
1010
build-and-publish:
1111
name: Build and publish library to PyPI
1212
runs-on: ubuntu-22.04
13+
permissions:
14+
contents: read
1315

1416
steps:
15-
- uses: actions/checkout@v4
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1618

1719
- name: Set up Python
18-
uses: actions/setup-python@v5
20+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
1921
with:
2022
python-version: 3.11
2123

@@ -27,6 +29,6 @@ jobs:
2729

2830
- name: Publish to PyPI
2931
if: startsWith(github.ref, 'refs/tags')
30-
uses: pypa/gh-action-pypi-publish@release/v1
32+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
3133
with:
3234
password: ${{ secrets.PYPI_API_TOKEN_ABOUTCODE_FEDERATED }}

‎.github/workflows/pypi-release-aboutcode-hashid.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,14 @@ jobs:
1010
build-and-publish:
1111
name: Build and publish library to PyPI
1212
runs-on: ubuntu-22.04
13+
permissions:
14+
contents: read
1315

1416
steps:
15-
- uses: actions/checkout@v4
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1618

1719
- name: Set up Python
18-
uses: actions/setup-python@v5
20+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
1921
with:
2022
python-version: 3.11
2123

@@ -27,12 +29,12 @@ jobs:
2729

2830
- name: Publish to PyPI
2931
if: startsWith(github.ref, 'refs/tags')
30-
uses: pypa/gh-action-pypi-publish@release/v1
32+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
3133
with:
3234
password: ${{ secrets.PYPI_API_TOKEN_ABOUTCODE_HASHID }}
3335

3436
- name: Upload built archives
35-
uses: actions/upload-artifact@v4
37+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
3638
with:
3739
name: pypi_archives
3840
path: dist/*

‎.github/workflows/pypi-release.yml‎

Lines changed: 19 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,14 @@ on:
2121
jobs:
2222
build-pypi-distribs:
2323
name: Build and publish library to PyPI
24-
runs-on: ubuntu-22.04
24+
runs-on: ubuntu-24.04
25+
permissions:
26+
contents: read
2527

2628
steps:
27-
- uses: actions/checkout@master
29+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2830
- name: Set up Python
29-
uses: actions/setup-python@v1
31+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
3032
with:
3133
python-version: 3.12
3234

@@ -37,7 +39,7 @@ jobs:
3739
run: python -m build --sdist --wheel --outdir dist/
3840

3941
- name: Upload built archives
40-
uses: actions/upload-artifact@v4
42+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
4143
with:
4244
name: pypi_archives
4345
path: dist/*
@@ -47,37 +49,41 @@ jobs:
4749
name: Create GH release
4850
needs:
4951
- build-pypi-distribs
50-
runs-on: ubuntu-22.04
52+
runs-on: ubuntu-24.04
5153

5254
steps:
5355
- name: Download built archives
54-
uses: actions/download-artifact@v4
56+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
5557
with:
5658
name: pypi_archives
5759
path: dist
5860

5961
- name: Create GH release
60-
uses: softprops/action-gh-release@v1
62+
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
6163
with:
62-
draft: true
64+
draft: false
65+
generate_release_notes: true
6366
files: dist/*
6467

6568

6669
create-pypi-release:
6770
name: Create PyPI release
6871
needs:
6972
- create-gh-release
70-
runs-on: ubuntu-22.04
73+
runs-on: ubuntu-24.04
74+
environment: pypi-publish
75+
permissions:
76+
id-token: write
7177

7278
steps:
7379
- name: Download built archives
74-
uses: actions/download-artifact@v4
80+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
7581
with:
7682
name: pypi_archives
7783
path: dist
7884

7985
- name: Publish to PyPI
80-
if: startsWith(github.ref, 'refs/tags')
81-
uses: pypa/gh-action-pypi-publish@master
86+
if: startsWith(github.ref, 'refs/tags/')
87+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
8288
with:
83-
password: ${{ secrets.PYPI_API_TOKEN }}
89+
verbose: true

‎.github/workflows/test-import-using-nix.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@ on:
77
jobs:
88
nix-check-and-import:
99
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
1012

1113
steps:
12-
- uses: actions/checkout@v2
14+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1315
with:
1416
fetch-depth: 0
15-
- uses: cachix/install-nix-action@v11
17+
- uses: cachix/install-nix-action@95a8068e317b8def9482980abe762f36c77ccc99 # v11
1618
env:
1719
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
1820
with:

‎.github/workflows/upstream_test.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,15 @@ on:
77
jobs:
88
unit_tests:
99
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
1012

1113
steps:
1214
- name: Checkout code
13-
uses: actions/checkout@v2
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1416

1517
- name: Set up Python 3.8.11
16-
uses: actions/setup-python@v2
18+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
1719
with:
1820
python-version: 3.8.11
1921

‎CHANGELOG.rst‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,51 @@
11
Release notes
22
=============
33

4+
next release
5+
---------------------
6+
7+
- WARNING: Vulnerablecode V1 API and UI has stopped supporting Ubuntu OVAL advisories, please shift to V3 API for new Ubuntu advisories.
8+
9+
Version v38.6.0
10+
---------------------
11+
12+
- fix: add missing clean_downloads step for alpine_linux v2 importer (https://github.com/aboutcode-org/vulnerablecode/pull/2282)
13+
- fix: fix AdvisoryDataV2 deserialization and validate version ranges correctly (https://github.com/aboutcode-org/vulnerablecode/pull/2285)
14+
- fix: ignore conflicts while bulk creating v2 packages (https://github.com/aboutcode-org/vulnerablecode/pull/2289)
15+
- fix: use shared cache backend across WSGI workers (https://github.com/aboutcode-org/vulnerablecode/pull/2290)
16+
- fix: delete AdvisorySet associated with malformed aliases (https://github.com/aboutcode-org/vulnerablecode/pull/2291)
17+
18+
19+
Version v38.5.0
20+
---------------------
21+
22+
- fix: Make package_url field unique for PackageV2
23+
24+
Version v38.4.0
25+
---------------------
26+
27+
- fix: run pipeline scheduling jobs in respective queues (https://github.com/aboutcode-org/vulnerablecode/pull/2263)
28+
- feat: show queue load factors on the pipeline dashboard (https://github.com/aboutcode-org/vulnerablecode/pull/2264)
29+
30+
Version v38.3.0
31+
---------------------
32+
33+
- feat: add high priority queue and run version range unfurling pipeline more frequently (https://github.com/aboutcode-org/vulnerablecode/pull/2256)
34+
35+
Version v38.1.0
36+
---------------------
37+
38+
- Throttle UI to 15 requests per minute to avoid abuse and improve performance.
39+
- Handle errors in unfurl_version_range pipeline.
40+
- Remove Todo pipeline from v1 pipelines.
41+
- Add openAPI documentation for Package and Advisory viewset.
42+
43+
Version v38.0.0
44+
---------------------
45+
46+
- This is a major version, we have changed our V3 API, refer to ``api_v3_usage.rst`` for details.
47+
- We have started grouping advisories which have aliases or identifiers in common and also affect same set of packages together.
48+
449
Version v37.0.0
550
---------------------
651

‎Makefile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ conf: virtualenv
6363

6464
dev: virtualenv
6565
@echo "-> Configure and install development dependencies"
66-
@${ACTIVATE} pip install -e .[dev] -c requirements.txt
66+
@${ACTIVATE} pip install -e .[dev] -c requirements-dev.txt
6767

6868
envfile:
6969
@echo "-> Create the .env file and generate a secret key"
@@ -121,11 +121,11 @@ sqlite:
121121
@$(MAKE) migrate
122122

123123
run:
124-
${MANAGE} runserver 8001 --insecure
124+
DJANGO_RUNSERVER_HIDE_WARNING=true ${MANAGE} runserver 8001 --insecure
125125

126126
test:
127127
@echo "-> Run the test suite"
128-
${ACTIVATE} ${PYTHON_EXE} -m pytest -vvs -m "not webtest"
128+
${ACTIVATE} ${PYTHON_EXE} -m pytest -vvs -m "not webtest" --disable-warnings
129129

130130
webtest:
131131
@echo "-> Run web tests"

‎PIPELINES-AVID.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
* - project-kb-statements_v2
5656
- Vulnerability ID of the record
5757
* - pypa_importer_v2
58-
- ID of the OSV record
58+
- {package_name}/{ID of the OSV record}
5959
* - pysec_importer_v2
6060
- ID of the OSV record
6161
* - redhat_importer_v2

0 commit comments

Comments
 (0)