Tags: github-community-projects/evergreen
Tags
chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#611) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 9.0.0 to 10.0.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@c771a70...ae62891) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#611) Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 9.0.0 to 10.0.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@c771a70...ae62891) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
chore(deps): bump actions/stale from 10.4.0 to 11.0.0 (#604) Bumps [actions/stale](https://github.com/actions/stale) from 10.4.0 to 11.0.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](actions/stale@1e223db...4391f3d) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
refactor: migrate from github3.py to PyGithub (#587) * refactor: migrate from github3.py to PyGithub ## What/Why Replace github3.py (pinned at 4.0.1) with PyGithub (>=2.6.0) for GitHub API interactions. PyGithub is more actively maintained and provides first-class support for base_url, app auth, and installation tokens. ## Proof it works 176 tests passed, 32 subtests passed, 100% code coverage via `make test`. ## Risk + AI role Medium -- touches all GitHub API interaction code (auth, repo operations, exception handling). All changes AI-generated using Claude Opus 4.6 with human review. ## Review focus 1. Auth flow in auth.py -- AppAuth/installation auth two-step pattern replaces login_as_app_installation 2. dependabot_file.py -- directory_contents (tuples) merged into get_contents (objects with .name), verify the or [] pattern in test mocks handles the combined code path correctly Signed-off-by: jmeridth <jmeridth@gmail.com> * test: add coverage for missing app id/installation id guard Signed-off-by: jmeridth <jmeridth@gmail.com> * docs: fix return type in get_github_app_installation_token docstring Signed-off-by: jmeridth <jmeridth@gmail.com> * fix: narrow exception handling in get_github_app_installation_token ## What/Why Narrow except clause from bare Exception to GithubException so that misconfiguration errors (bad int() cast, JWT construction failures) propagate instead of silently returning None and causing confusing 401s downstream. Addresses PR review feedback from @zkoppert. ## Proof it works All 14 tests in test_auth.py pass. Updated the request_failure test to raise GithubException instead of bare Exception to match the narrowed catch. Pylint clean (no new warnings). ## Risk + AI role Low. AI-generated (Claude Opus 4.6) with human review. ## Review focus Whether GithubException covers all the API/network error cases we want to catch, or if additional specific exceptions should be included. Signed-off-by: jmeridth <jmeridth@gmail.com> * fix: use repo.owner.login for security-updates URLs and handle datetime in created_after filter ## What/Why Fix two bugs exposed by the PyGithub migration: (1) repo.owner is now a NamedUser object, not a string, so security-updates URLs rendered as "repos/NamedUser(login=...)/..." and 404'd silently; (2) repo.created_at is a datetime object but is_repo_created_date_before called fromisoformat() on it, which raises TypeError. ## Proof it works All 180 tests pass including 2 new tests for datetime input to is_repo_created_date_before (both before and after filter date). ## Risk + AI role Medium -- the repo.owner.login fix touches the security-updates code path which is pragma: no cover. AI-generated (Claude Opus 4.6) with human review. ## Review focus Whether repo.owner.login is the correct attribute for all PyGithub Repository objects (org-owned vs user-owned repos). Signed-off-by: jmeridth <jmeridth@gmail.com> --------- Signed-off-by: jmeridth <jmeridth@gmail.com>
ci: adopt consolidated ospo-reusable-workflows release.yaml (#552) * ci: adopt consolidated ospo-reusable-workflows release.yaml ## What Collapse the three legacy `release` / `release_image` / `release_discussion` job calls into a single call to the consolidated `release.yaml` reusable workflow at v1.0.0 (`592067a6...`). Pass `image-name`, `create-attestation: true`, and `create-discussion: true` so the workflow handles GitHub release, container image build/push to GHCR, build provenance attestation, and announcement discussion in one draft-first pipeline. Also add a "💥 Breaking Changes" category to `release-drafter.yml`. ## Why The legacy three-workflow setup forced callers to wire up the same job chain by hand in every repo and made it easy for permissions, secrets, and ordering to drift. v1.0.0 of ospo-reusable-workflows owns the chain internally and exposes a single entry point. The "Breaking Changes" category matches the upstream release-drafter template (github-community-projects/ospo-reusable-workflows#134); the `breaking` label already maps to a major bump in `version-resolver`, so this just surfaces those PRs in their own changelog section. ## Notes - The job-level permission block now lists the union of what the called workflow's internal jobs need (contents/pull-requests/packages/id-token/attestations/discussions). A `uses:` caller can only grant — never expand — what the reusable workflow requests, so missing perms here silently disable features instead of erroring. - `image-registry` and `image-registry-username` moved from `secrets:` to inputs in v1.0.0 (defaults to `ghcr.io` and `github.actor`). Both defaults match the previous explicit values, so they're omitted. - `image-registry-password` stays a secret and continues to use `GITHUB_TOKEN` for ghcr.io pushes. - The reusable workflow's `release_discussion` job validates the discussion secrets at the step level and skips with a notice if they're unset, so the workflow keeps working even if the discussion secrets aren't configured. Signed-off-by: jmeridth <jmeridth@gmail.com> * style: align release.yml comments to prettier formatting Single-space before `#` so prettier (via super-linter) accepts the workflow file. No behavior change. Signed-off-by: jmeridth <jmeridth@gmail.com> --------- Signed-off-by: jmeridth <jmeridth@gmail.com>
chore(deps): bump github-community-projects/contributors (#550) Bumps the dependencies group with 1 update: [github-community-projects/contributors](https://github.com/github-community-projects/contributors). Updates `github-community-projects/contributors` from 2.0.8 to 2.0.9 - [Release notes](https://github.com/github-community-projects/contributors/releases) - [Commits](github-community-projects/contributors@52a3496...9c4c2b6) --- updated-dependencies: - dependency-name: github-community-projects/contributors dependency-version: 2.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
chore(deps): bump cryptography from 46.0.6 to 46.0.7 (#535) Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.6 to 46.0.7. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.6...46.0.7) --- updated-dependencies: - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
PreviousNext