Release v26.6.0

.dockerignore

@@ -12,4 +12,4 @@ docs/
 .cov/
 .venv
 Dockerfile
-.env
+.env

.github/actions/setup-test-image/action.yml

@@ -3,15 +3,15 @@ description: 'Setup docker builder for using github actions cache'
 runs:
   using: "composite"
   steps:
-    - uses: docker/setup-buildx-action@v3
+    - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
     - name: Set metadata
       id: metadata
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
       with:
         images: ibet-wallet-api
         tags: |
           type=sha,format=short
-    - uses: docker/build-push-action@v6
+    - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
       with:
         context: .
         file: ./tests/Dockerfile_unittest

.github/dependabot.yml

@@ -9,6 +9,8 @@ updates:
     allow:
       - dependency-name: "*"
         dependency-type: "direct"
+    cooldown:
+      default-days: 14
     groups:
       all-dependencies:
         patterns:
@@ -21,30 +23,39 @@ updates:
     allow:
       - dependency-name: "*"
         dependency-type: "direct"
+    cooldown:
+      default-days: 14
     groups:
       all-dependencies:
         patterns:
           - "*"
 
-  - package-ecosystem: docker-compose
-    directory: "/"
+  - package-ecosystem: "docker"
+    directories:
+      - "/"
+      - "/tests"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 14
     ignore:
-    - dependency-name: "*"
-      update-types: ["version-update:semver-major"]
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
     groups:
       all-dependencies:
         patterns:
           - "*"
+        group-by: dependency-name
 
-  - package-ecosystem: "npm"
+  - package-ecosystem: "docker-compose"
     directory: "/"
     schedule:
-      interval: "weekly"
-    allow:
+      interval: "monthly"
+    cooldown:
+      default-days: 14
+    ignore:
       - dependency-name: "*"
-        dependency-type: "direct"
+        update-types: ["version-update:semver-major"]
     groups:
       all-dependencies:
         patterns:

.github/workflows/auto-assign.yml

@@ -11,4 +11,4 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: kentaro-m/auto-assign-action@a6d59add3a817df08cafa9b166367768d2c337f8 # v2.0.1
+      - uses: kentaro-m/auto-assign-action@0a2c53d3721e4c5cfcce6afd4014aecc337979f6 # v2.0.2

.github/workflows/build.yml

@@ -11,13 +11,13 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -28,7 +28,7 @@ jobs:
         run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
 
       - name: Build and Push (ibet-wallet)
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: Dockerfile

.github/workflows/codeql-analysis.yml

@@ -24,19 +24,19 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
         with:
           languages: ${{ matrix.language }}
 
       # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/pr.yml

@@ -7,49 +7,88 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/setup-test-image
   lint-ruff:
     name: "Lint check (ruff and pyright)"
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/ruff-action@v3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b # v4.0.0
       - name: Install uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           cache-dependency-glob: |
             **/pyproject.toml
             **/uv.lock
       - name: Restore cache
         id: cache-venv
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: .venv
           key: venv-${{ runner.os }}-${{ hashFiles('**/pyproject.toml', '**/uv.lock') }}
           restore-keys: |
             venv-${{ runner.os }}-
       - name: Install dependencies
         if: steps.cache-venv.outputs.cache-hit != 'true'
+        env:
+          UV_MALWARE_CHECK: "1"
         run: |
           uv sync --frozen --no-install-project
       - name: Run typecheck
         run: |
           make typecheck
+  guardrail-check:
+    name: "Guardrail checks"
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            **/pyproject.toml
+            **/uv.lock
+      - name: Restore cache
+        id: cache-venv
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: .venv
+          key: venv-${{ runner.os }}-${{ hashFiles('**/pyproject.toml', '**/uv.lock') }}
+          restore-keys: |
+            venv-${{ runner.os }}-
+      - name: Install dependencies
+        if: steps.cache-venv.outputs.cache-hit != 'true'
+        env:
+          UV_MALWARE_CHECK: "1"
+        run: |
+          uv sync --frozen --no-install-project
+      - name: Run guardrail checks
+        run: |
+          make test_guardrail_check
   unit-test:
     name: "Unit tests"
     runs-on: ubuntu-latest
     needs: build
     strategy:
       fail-fast: true
       matrix:
-        db: [postgres, mysql]
-        test_target: ["tests/app/", "tests/batch/"]
+        include:
+          - db: postgres
+            test_target: "tests/app/"
+          - db: mysql
+            test_target: "tests/app/"
+          - db: postgres
+            test_target: "tests/batch/"
+          - db: mysql
+            test_target: "tests/batch/"
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/setup-test-image
       - name: build image on compose
         run: docker compose build
@@ -60,14 +99,14 @@ jobs:
       - name: run unit test using ${{ matrix.db }}
         run: docker compose run -e TEST_TARGET="${{ matrix.test_target }}" ibet-wallet-api-${{ matrix.db }}
       - run: mv cov/.coverage cov/.coverage-${{ strategy.job-index }}
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: matrix.db == 'postgres'
         with:
           name: .coverage-${{ strategy.job-index }}
           path: cov/.coverage-${{ strategy.job-index }}
           include-hidden-files: true
       - run: mv cov/pytest.xml cov/pytest-${{ strategy.job-index }}.xml
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: matrix.db == 'postgres'
         with:
           name: pytest-${{ strategy.job-index }}
@@ -82,15 +121,15 @@ jobs:
       pull-requests: write
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/setup-test-image
       - name: build image on compose
         run: docker compose build
       - name: Change owner of output directory
         run: |
           sudo chown runner:docker /home/runner/work/ibet-Wallet-API/ibet-Wallet-API/cov
           sudo chmod 777 /home/runner/work/ibet-Wallet-API/ibet-Wallet-API/cov
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: ".coverage-*"
           path: cov/
@@ -99,21 +138,21 @@ jobs:
         run: docker compose run -w /app/ibet-Wallet-API/cov ibet-wallet-api-postgres bash --login -c 'uv run coverage combine .coverage-*'
       - name: generate coverage xml file
         run: docker compose run -w /app/ibet-Wallet-API ibet-wallet-api-postgres bash --login -c 'uv run coverage xml --data-file=cov/.coverage -o cov/coverage.xml'
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: "pytest-*"
           path: cov/
           merge-multiple: true
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20
+          node-version: 24
       - name: Install junit-report-merger
-        run: npm install -g junit-report-merger
+        run: npm install -g junit-report-merger@9.0.3
       - name: Merge reports
         run: jrm cov/pytest.xml "cov/pytest-*.xml"
       - name: Pytest coverage comment
         id: coverageComment
-        uses: MishaKav/pytest-coverage-comment@287292879eaaff04116f36d3eb1a670f6e5df1a4 # v1.7.1
+        uses: MishaKav/pytest-coverage-comment@dd5b80bde6d16941f336518e92929e89069d8451 # v1.7.2
         with:
           report-only-changed-files: true
           pytest-xml-coverage-path: cov/coverage.xml
@@ -139,7 +178,7 @@ jobs:
         db: [postgres, mysql]
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: ./.github/actions/setup-test-image
       - name: run unit test using ${{ matrix.db }}
         run: docker compose run ibet-wallet-api-${{ matrix.db }} bash --login -c "cd /app/ibet-Wallet-API && uv run pytest -vv --test-alembic -m 'alembic'"

.pre-commit-config.yaml

@@ -5,4 +5,4 @@ repos:
       - id: ruff-format
         name: ruff-format
         entry: make format
-        language_version: python3.13
+        language_version: python3.14

Dockerfile

@@ -1,10 +1,10 @@
-FROM ubuntu:24.04 AS builder
+FROM ghcr.io/astral-sh/uv:0.11.19@sha256:b46b03ddfcfbf8f547af7e9eaefdf8a39c8cebcba7c98858d3162bd28cf536f6 AS uv
 
-ENV PYTHON_VERSION=3.13.11
-ENV UV_VERSION=0.9.16
+FROM ubuntu:24.04@sha256:786a8b558f7be160c6c8c4a54f9a57274f3b4fb1491cf65146521ae77ff1dc54 AS builder
+
+ENV PYTHON_VERSION=3.14.2
 ENV UV_COMPILE_BYTECODE=1
 ENV UV_LINK_MODE=copy
-ENV UV_INSTALL_DIR="/usr/local/bin"
 ENV UV_PROJECT_ENVIRONMENT="/home/apl/.venv"
 
 # make application directory
@@ -34,8 +34,7 @@ RUN apt-get update -q \
  && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 # install uv
-ADD https://astral.sh/uv/$UV_VERSION/install.sh /uv-installer.sh
-RUN INSTALLER_NO_MODIFY_PATH=1 sh /uv-installer.sh && rm /uv-installer.sh
+COPY --from=uv /uv /uvx /usr/local/bin/
 
 # install Python
 RUN uv python install $PYTHON_VERSION
@@ -56,7 +55,7 @@ RUN echo '. $HOME/.venv/bin/activate' >> ~apl/.bashrc
 COPY --chown=apl:apl . /app/ibet-Wallet-API
 RUN cd /app/ibet-Wallet-API \
  && uv venv $UV_PROJECT_ENVIRONMENT \
- && uv sync --frozen --no-install-project --no-dev \
+ && UV_MALWARE_CHECK=1 uv sync --frozen --no-install-project --no-dev \
  && PYTHON_BIN="$(uv python find $PYTHON_VERSION)" \
  && PYTHON_ROOT="$(dirname "$(dirname "$PYTHON_BIN")")" \
  && rm -f "$PYTHON_ROOT"/bin/pip "$PYTHON_ROOT"/bin/pip3 "$PYTHON_ROOT"/bin/pip3.* \
@@ -66,7 +65,7 @@ RUN cd /app/ibet-Wallet-API \
  && rm -f /app/ibet-Wallet-API/uv.lock \
  && rm -rf /app/ibet-Wallet-API/tests/
 
-FROM ubuntu:24.04 AS runner
+FROM ubuntu:24.04@sha256:786a8b558f7be160c6c8c4a54f9a57274f3b4fb1491cf65146521ae77ff1dc54 AS runner
 
 # make application directory
 RUN mkdir -p /app

Makefile

@@ -1,13 +1,11 @@
-.PHONY: format lint typecheck doc test test_migrations run
+.PHONY: format lint typecheck doc test test_guardrail_check test_guardrail test_migrations run
 
 install:
-	uv sync --frozen --no-install-project --all-extras
+	UV_MALWARE_CHECK=1 uv sync --frozen --no-install-project --all-extras
 	uv run pre-commit install
-	npm install
 
 update:
 	uv lock --upgrade
-	npm update
 
 format:
 	uv run ruff format && uv run ruff check --fix --select I
@@ -24,6 +22,11 @@ doc:
 test:
 	uv run pytest tests/ ${ARG}
 
+test_guardrail_check:
+	uv run pytest --override-ini addopts='' --noconftest -v -m "guardrail_check" tests/test_guardrail_check.py
+
+test_guardrail: test_guardrail_check
+
 test_migrations:
 	uv run pytest -vv --test-alembic -m "alembic"