Skip to content

Conversation

Paillat-dev
Copy link
Member

@Paillat-dev Paillat-dev commented Sep 3, 2025

Summary

Use frozen lockfile to reduce risk of supply chain attacks

Information

  • This PR fixes an issue.
  • This PR adds something new (e.g. new method or parameters).
  • This PR is a breaking change (e.g. methods or parameters removed/renamed).
  • This PR is not a code change (e.g. documentation, README, typehinting,
    examples, ...).

Checklist

  • I have searched the open pull requests for duplicates.
  • If code changes were made then they have been tested.
    • I have updated the documentation to reflect the changes.
  • If type: ignore comments were used, a comment is also left explaining why.
  • I have updated the changelog to include these changes.

@Paillat-dev Paillat-dev changed the title feat(CI): 👷 Create a reusable workflow for UV and make UV l… feat(CI): 👷 Create a reusable workflow for UV and make UV lockfile frozen Sep 3, 2025
@Paillat-dev Paillat-dev marked this pull request as draft September 3, 2025 21:09
@Paillat-dev Paillat-dev marked this pull request as ready for review September 3, 2025 21:26
@Paillat-dev Paillat-dev requested a review from a team as a code owner September 3, 2025 21:26
@Paillat-dev Paillat-dev added the don't-merge DO NOT MERGE label Sep 3, 2025
@Paillat-dev
Copy link
Member Author

image

Paillat-dev and others added 5 commits September 3, 2025 23:48
Signed-off-by: Lala Sabathil <[email protected]>
Replaces local sync-uv.yml workflow references with remote workflow from pycord-development/pycord-next repository in all affected GitHub Actions YAML files. This ensures the latest shared workflow is used for setup steps.
Changed the reference for pycord-next/.github/workflows/sync-uv.yml from 'main' to 'master' in all relevant GitHub workflow files to ensure correct branch usage for setup steps.
Lulalaby and others added 7 commits September 3, 2025 23:58
Replaces the workflow-based sync-uv implementation with a reusable composite action in .github/actions/sync-uv/action.yml. Updates all workflows to use the new action for dependency synchronization, improving maintainability and modularity.
Updates environment variable assignment to explicitly check for 'true' string values in inputs.no_python_downloads and inputs.frozen, ensuring correct behavior when setting UV_NO_PYTHON_DOWNLOADS and UV_FROZEN.
Refactored the scripts for building group and extra arguments to use explicit if statements for non-empty values and added 'set -x' for debugging. Also added '|| exit 0' to the output commands to prevent failures if output writing fails.
@Paillat-dev Paillat-dev removed the don't-merge DO NOT MERGE label Sep 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants