From b75f6a33c521b4ae2cb771364320d24c536f7e63 Mon Sep 17 00:00:00 2001 From: Durable Workflow Date: Fri, 23 Oct 2026 03:15:34 +0000 Subject: [PATCH] ci: select verified effective trust for Python dependency requests --- .github/workflows/ci.yml | 26 +++++++++++++++++++------- .github/workflows/docs-pr.yml | 9 ++++++++- .github/workflows/docs.yml | 9 ++++++++- .github/workflows/publish.yml | 4 +++- 4 files changed, 38 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2dd45129..4655fe2f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -50,7 +50,7 @@ jobs: with: python-version: "3.13" - name: Bootstrap patched pip trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10 # patched-pip + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust - name: Install policy dependencies run: python -m pip install PyYAML==6.0.2 - name: Require centrally approved immutable action commits @@ -73,7 +73,9 @@ jobs: with: python-version: "3.12" - name: Bootstrap patched pip trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10 # patched-pip + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + with: + clients: pip,python - name: Install the SDK run: pip install -e . - name: Require durable replay and codec evidence @@ -97,7 +99,9 @@ jobs: with: python-version: "3.12" - name: Bootstrap patched pip trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10 # patched-pip + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + with: + clients: pip,python - run: pip install -e '.[dev]' - run: ruff check src/ tests/ - run: mypy src/durable_workflow/ @@ -114,7 +118,9 @@ jobs: with: python-version: "3.12" - name: Bootstrap patched pip trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10 # patched-pip + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + with: + clients: pip,python - run: pip install -e . - name: Measure the bounded absolute throughput signal continue-on-error: true @@ -143,7 +149,9 @@ jobs: with: python-version: ${{ matrix.python-version }} - name: Bootstrap patched pip trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10 # patched-pip + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + with: + clients: pip,python - run: pip install -e '.[dev]' - name: Run unit tests with stalled-thread diagnostics id: unit_tests @@ -178,7 +186,9 @@ jobs: with: python-version: "3.12" - name: Bootstrap patched pip trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10 # patched-pip + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + with: + clients: pip,python - run: pip install build twine - run: python -m build - name: Compare built release metadata with the exact source commit @@ -229,7 +239,9 @@ jobs: printf 'COMPOSE_FILE=docker-compose.test.yml:docker-compose.native-cancellation.yml\n' >> "$GITHUB_ENV" printf 'DURABLE_WORKFLOW_NATIVE_SOURCE_QUALIFICATION=1\n' >> "$GITHUB_ENV" - name: Bootstrap patched pip trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10 # patched-pip + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + with: + clients: pip,python - run: pip install -e '.[dev]' working-directory: sdk-python - name: Configure isolated Docker project diff --git a/.github/workflows/docs-pr.yml b/.github/workflows/docs-pr.yml index 971220e0..64d22a92 100644 --- a/.github/workflows/docs-pr.yml +++ b/.github/workflows/docs-pr.yml @@ -33,10 +33,17 @@ jobs: with: python-version: "3.12" - name: Bootstrap patched pip trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10 # patched-pip + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + with: + clients: pip,python - name: Install package and documentation dependencies run: pip install -e '.[docs]' - name: Install Chromium + env: + NODE_OPTIONS: --use-openssl-ca + NODE_EXTRA_CA_CERTS: '' + NODE_USE_SYSTEM_CA: '0' + NODE_TLS_REJECT_UNAUTHORIZED: '1' run: python -m playwright install --with-deps chromium - name: Build and check the portal run: | diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index d9ee057c..48bafaf5 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -69,10 +69,17 @@ jobs: fi echo "version=$version" >> "$GITHUB_OUTPUT" - name: Bootstrap patched pip trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10 # patched-pip + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + with: + clients: pip,python - name: Install package and documentation dependencies run: pip install -e '.[docs]' - name: Install Chromium + env: + NODE_OPTIONS: --use-openssl-ca + NODE_EXTRA_CA_CERTS: '' + NODE_USE_SYSTEM_CA: '0' + NODE_TLS_REJECT_UNAUTHORIZED: '1' run: python -m playwright install --with-deps chromium - name: Build and check the portal env: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 567ad7f1..ed9a14d8 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -108,7 +108,9 @@ jobs: python-version: "3.12" - name: Bootstrap patched pip trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@ff93e15dd3d3aa0b5ba8991fe5101a9e1be49c10 # patched-pip + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + with: + clients: pip,python - name: Install build tools run: pip install build twine