chore(deps): bump actions/setup-python from 5 to 7 - #2
Merged
GstMirabal merged 3 commits intoAug 2, 2026
Conversation
dependabot
Bot
added
dependencies
Owner
|
@dependabot rebase |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/setup-python-7
branch
3 times, most recently
from
August 1, 2026 10:30
653a89d to
4772d6d
Compare
GstMirabal
added a commit
that referenced
this pull request
Aug 1, 2026
CodeQL flagged three lines of the new generator as clear-text logging of sensitive data. The finding is correct: those lines put secrets on stdout, which is the entire function. My first attempt aliased `print` to hide the flow from the analyser. That changes nothing about the behaviour and leaves the next reader with a comment claiming a fix that does not exist, so it is reverted. Evading a scanner is not the same as answering it. What the rule actually guards against is the value reaching somewhere durable — a pipeline log, a redirected file, a shell transcript. So the script now exits before generating anything when stdout is not a TTY. Verified in both directions: redirected, it exits 1 and the target file contains no secret. The three alerts are dismissed as "won't fix" with that reasoning attached, which is the mechanism for a true positive with an accepted, mitigated risk. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
GstMirabal
added a commit
that referenced
this pull request
Aug 1, 2026
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
GstMirabal
added a commit
that referenced
this pull request
Aug 1, 2026
* docs: add the CONFIG blueprint, the cache ADR and the secret generator #2 Three items P1 called for and never delivered, found by auditing the plan against what shipped rather than by anything failing. CONFIG_BLUEPRINT.md documents settings.py, which at 718 lines is the largest file here and had no blueprint at all. Written against this repository rather than copied from django-users-app, whose recovered version described a six-module settings package that does not exist here — copying it would have produced a document that reads authoritatively and is wrong. ADR-0005 covers the cache. P1.5 asked for CACHES "with its ADR"; the setting landed and the ADR did not. It records the part worth arguing about: the per-process fallback is deliberate, because a template shipping nothing that needs cross-worker state should not force Redis on every consumer, and it is silent, so an app that does need it has to check for itself. generate_secrets.py was rewritten rather than moved. The original announced itself as the USER-APP-TEMPLATE generator and emitted MASTER_KEY, ENCRYPTION_PEPPER and a JWT signing key — none of which this template consumes. It now prints what this project needs, with the encryption keys in a clearly optional section, and states that MASTER_KEY has no rotation path. Vale ran here for the first time as well. It was P1 criterion 1, never executed; docs/ came back clean, and the four warnings it did raise were in the blueprint written today. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(utils): refuse to generate secrets when stdout is not a terminal #2 CodeQL flagged three lines of the new generator as clear-text logging of sensitive data. The finding is correct: those lines put secrets on stdout, which is the entire function. My first attempt aliased `print` to hide the flow from the analyser. That changes nothing about the behaviour and leaves the next reader with a comment claiming a fix that does not exist, so it is reverted. Evading a scanner is not the same as answering it. What the rule actually guards against is the value reaching somewhere durable — a pipeline log, a redirected file, a shell transcript. So the script now exits before generating anything when stdout is not a TTY. Verified in both directions: redirected, it exits 1 and the target file contains no secret. The three alerts are dismissed as "won't fix" with that reasoning attached, which is the mechanism for a true positive with an accepted, mitigated risk. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore: re-run checks after dismissing the generator alerts #2 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
GstMirabal
added a commit
that referenced
this pull request
Aug 1, 2026
A model edited without its migration passes ruff, passes the system checks and passes the suite. It fails on the first deploy that runs `migrate` against a real database, which is the worst place to find out. Added to the project-mode job only; an app-mode caller has no manage.py. Verified against this repository first: `makemigrations --check --dry-run` reports no changes, so the step goes in green rather than needing a fix alongside it. `ruff format --check` was considered for the same job and left out: this repository's own tree would fail it today, and formatting it is already recorded as deferred work (django-users-app roadmap P2-8). Tradingview2EXCH runs that check in its own pipeline meanwhile, since it does pass there. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
GstMirabal
added a commit
that referenced
this pull request
Aug 2, 2026
The job failed on `No module named 'factory'`. `factory_boy` is a development dependency of django-users-app and only its runtime requirements were installed. It passed when I ran this by hand because my local environment already had the package — which is the same class of mistake this job exists to catch, arriving one layer up. A clean runner is the only place that distinction shows. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
GstMirabal
added a commit
that referenced
this pull request
Aug 2, 2026
* ci: verify that django-users-app installs into this template #2 The claim this template makes is that a Django application can be installed into it. Nothing tested that claim automatically. The app's own suite runs against a test harness, and a harness that is too helpful conceals the very requirements it exists to expose. Two blocking defects reached main that way. Every throttled endpoint returned 500 in a real host because the app assumed a rate its harness happened to declare, and every bearer client got 403 because JWTAuthentication was required and never documented. Both were found by vendoring the app by hand — which is a practice that does not survive a busy week. The job does exactly what that manual run did, with the sharp edges kept deliberately: it does NOT declare DEFAULT_THROTTLE_RATES['sensitive'], because declaring it would restore the blind spot the whole job exists to remove. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * ci: install the app's dev requirements in the integration job #2 The job failed on `No module named 'factory'`. `factory_boy` is a development dependency of django-users-app and only its runtime requirements were installed. It passed when I ran this by hand because my local environment already had the package — which is the same class of mistake this job exists to catch, arriving one layer up. A clean runner is the only place that distinction shows. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions/setup-python-7
branch
from
August 2, 2026 05:53
4772d6d to
8486627
Compare
GstMirabal
added a commit
that referenced
this pull request
Aug 2, 2026
`0_SYSTEM_OVERVIEW.md` is the file `agents.md §0` requires every session to read before anything else. It described a repository that stopped existing two sprints ago. | Claim | Reality | | :--- | :--- | | "Django 5.2 boilerplate" | Django 6.0.7 | | "apps/core — an empty skeleton, models/views/admin are stubs" | 715 lines: the health endpoint, core.E001, the password validator, 20 tests | | "CI: lint + tests + check --deploy" | A reusable workflow other repositories call, plus a missing-migration check, the docs gate, and an integration job | | "active_state.json is git-ignored" | Tracked since Sprint #1 | | "No Sprint folder exists yet" | Two sprints closed | | "see CORE_BLUEPRINT.md" | CONFIG_BLUEPRINT.md exists too, and five ADRs | | Last Audit Sprint #000 | #2 | | Nothing about being the reference scaffold | Two repositories depend on it, one of them verified by CI on every run | Each was checked against the tree before rewriting, not corrected from memory: the Django pin read from requirements.txt, the line count from wc, the test count from a run, the tracked state from git ls-files. This is the same defect found in Tradingview2EXCH's entry point last week and the same one that made a customization guide in django-users-app open with a command against a deleted directory. An entry point goes stale precisely because nothing fails when it does. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
GstMirabal
added a commit
that referenced
this pull request
Aug 2, 2026
The integration job checks that repository out by name. GitHub redirects, so this would have kept working — but a workflow naming a repository that no longer answers to that name is a reference waiting to break, and the job's whole purpose is proving the pairing still holds. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/setup-python from 5 to 7.
Release notes
Sourced from actions/setup-python's releases.
... (truncated)
Commits
5fda3b9Pin SHA commits and update docs with latest versions (#1338)4ab7e95Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-00f3a009Remove the pip-install input (#1336)f8cf429Migrate to ESM and upgrade dependencies (#1330)54baeeaValidate and retry manifest fetch to prevent silent failures (#1332)c709277Annotation code fix (#1335)6849080remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)ece7cb0Fix pip cache error handling on Windows. (#1040)1d18d7aUpdate advanced-usage.md (#811)