Fix build for python 3.14 - #494
Conversation
…ght come back to that funi does not release cp14t
|
Warning Review limit reached
More reviews will be available in 54 minutes and 26 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe workflow now triggers on ChangesCI Workflow Updates and Housekeeping
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/main.yml (1)
127-141: 🔒 Security & Privacy | 🟠 MajorGate
upload_pypiat the job level. Movegithub.ref == 'refs/heads/main'from the publish step to theupload_pypijob so non-main runs never getid-token: write.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/main.yml around lines 127 - 141, The upload_pypi workflow job is only gated at the publish step, which still grants id-token: write to non-main runs. Move the github.ref == 'refs/heads/main' condition from the Publish wheels to PyPI step to the upload_pypi job itself so the entire job is skipped off main; update the upload_pypi job definition in main.yml and keep the existing actions/download-artifact and pypa/gh-action-pypi-publish steps unchanged otherwise.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/main.yml:
- Around line 66-68: The checkout step in the build jobs leaves GitHub
credentials available to later steps because actions/checkout persists them by
default. Update each affected checkout invocation in the workflow to explicitly
set persist-credentials to false alongside the existing submodules setting, so
the job can still fetch sources without keeping the token around. Use the
checkout step entries in main.yml as the targets for this change.
- Line 5: Add workflow-level concurrency to the main workflow so only the latest
run per ref proceeds and older runs are canceled before artifact publishing.
Update the workflow configuration near the top of the file (around the branches
trigger) by introducing a per-ref concurrency group with cancellation for
superseded runs, so stale builds cannot publish wheels ahead of newer runs.
- Line 20: The workflow still uses mutable GitHub Actions refs, so update the
job in main.yml to pin every action to an immutable commit SHA instead of
version tags or branches. Replace the uses entries for actions/checkout,
actions/upload-artifact, actions/download-artifact, pypa/cibuildwheel, and
pypa/gh-action-pypi-publish with their corresponding commit SHAs so the workflow
is fully pinned.
---
Outside diff comments:
In @.github/workflows/main.yml:
- Around line 127-141: The upload_pypi workflow job is only gated at the publish
step, which still grants id-token: write to non-main runs. Move the github.ref
== 'refs/heads/main' condition from the Publish wheels to PyPI step to the
upload_pypi job itself so the entire job is skipped off main; update the
upload_pypi job definition in main.yml and keep the existing
actions/download-artifact and pypa/gh-action-pypi-publish steps unchanged
otherwise.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 32dade91-1b2f-424f-af53-d0308f45ee88
📒 Files selected for processing (3)
.github/workflows/main.yml.gitignoredocs/source/conf.py
| on: | ||
| push: | ||
| branches: ["main"] | ||
| branches: ["main", "fix-build"] |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n -C2 '^concurrency:|cancel-in-progress' .github/workflows/main.ymlRepository: isosuite/splinepy
Length of output: 155
Add workflow concurrency before publishing artifacts.
Line 5 allows multiple push builds to run at once; with skip-existing, an older main run can publish stale wheels before a newer run finishes. Add per-ref concurrency and cancel superseded runs.
Proposed fix
on:
push:
branches: ["main", "fix-build"]
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| branches: ["main", "fix-build"] | |
| branches: ["main", "fix-build"] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 3-5: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/main.yml at line 5, Add workflow-level concurrency to the
main workflow so only the latest run per ref proceeds and older runs are
canceled before artifact publishing. Update the workflow configuration near the
top of the file (around the branches trigger) by introducing a per-ref
concurrency group with cancellation for superseded runs, so stale builds cannot
publish wheels ahead of newer runs.
Source: Linters/SAST tools
| submodules: recursive | ||
| - name: build wheels | ||
| uses: pypa/cibuildwheel@v2.23.2 | ||
| uses: pypa/cibuildwheel@v4.1.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for spec in \
"https://github.com/actions/checkout.git refs/tags/v7" \
"https://github.com/actions/upload-artifact.git refs/tags/v7" \
"https://github.com/actions/download-artifact.git refs/tags/v7" \
"https://github.com/pypa/cibuildwheel.git refs/tags/v4.1.0" \
"https://github.com/pypa/gh-action-pypi-publish.git refs/heads/release/v1"
do
set -- $spec
git ls-remote "$1" "$2"
doneRepository: isosuite/splinepy
Length of output: 438
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/main.yml"
wc -l "$file"
sed -n '1,170p' "$file" | cat -nRepository: isosuite/splinepy
Length of output: 4828
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/main.yml"
wc -l "$file"
sed -n '1,170p' "$file" | cat -nRepository: isosuite/splinepy
Length of output: 4828
Pin GitHub Actions to immutable SHAs. actions/checkout@v4, actions/upload-artifact@v7, actions/download-artifact@v7, pypa/cibuildwheel@v4.1.0, and pypa/gh-action-pypi-publish@release/v1 are still mutable refs; replace them with commit SHAs to satisfy the pinning policy.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/main.yml at line 20, The workflow still uses mutable
GitHub Actions refs, so update the job in main.yml to pin every action to an
immutable commit SHA instead of version tags or branches. Replace the uses
entries for actions/checkout, actions/upload-artifact,
actions/download-artifact, pypa/cibuildwheel, and pypa/gh-action-pypi-publish
with their corresponding commit SHAs so the workflow is fully pinned.
Source: Linters/SAST tools
| - uses: actions/checkout@v7 | ||
| with: | ||
| submodules: recursive |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not persist checkout credentials in build jobs.
These jobs do not push back to GitHub, so the checkout token should not remain available to later build steps. actions/checkout persists credentials by default and supports persist-credentials: false. (github.com)
Proposed fix
- uses: actions/checkout@v7
with:
submodules: recursive
+ persist-credentials: falseAlso applies to: 92-94, 113-115
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 66-68: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 66-66: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/main.yml around lines 66 - 68, The checkout step in the
build jobs leaves GitHub credentials available to later steps because
actions/checkout persists them by default. Update each affected checkout
invocation in the workflow to explicitly set persist-credentials to false
alongside the existing submodules setting, so the job can still fetch sources
without keeping the token around. Use the checkout step entries in main.yml as
the targets for this change.
Source: Linters/SAST tools
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/main.yml:
- Around line 8-9: The build artifact jobs are relying on default GitHub token
scopes instead of explicit least-privilege permissions. Update the workflow job
definitions for build_wheels and build_sdist to set only the permissions they
need, using the job names and the existing artifact build steps to locate them,
so the token scope is pinned rather than inherited from repository defaults.
- Line 46: The CIBW_BUILD environment assignment is using matrix.build directly
even though it resolves to an array, so the workflow needs to export a string
instead. Update the workflow job in main.yml to convert or join the matrix.build
values before assigning them to CIBW_BUILD, using the matrix.build reference in
the build step environment block.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9f073cf6-649b-4371-a5c0-f14e9f894409
📒 Files selected for processing (1)
.github/workflows/main.yml
| build_wheels: | ||
| strategy: |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Set explicit least-privilege token permissions for artifact build jobs.
build_wheels and build_sdist currently rely on repository defaults. Pin job permissions explicitly to avoid accidental broad scopes.
Proposed fix
build_wheels:
+ permissions:
+ contents: read
strategy:
fail-fast: false
@@
build_sdist:
+ permissions:
+ contents: read
runs-on: ubuntu-latestAlso applies to: 58-60
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 8-56: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[info] 8-8: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/main.yml around lines 8 - 9, The build artifact jobs are
relying on default GitHub token scopes instead of explicit least-privilege
permissions. Update the workflow job definitions for build_wheels and
build_sdist to set only the permissions they need, using the job names and the
existing artifact build steps to locate them, so the token scope is pinned
rather than inherited from repository defaults.
Source: Linters/SAST tools
1 participant
Overview
Fixed building for Python 3.14. Only 3.14t will not be released due to issues in the test pipeline.
Addressed issues
tataratattoisosuiteChecklists
Summary by CodeRabbit
mainandfix-build, consolidating wheel creation into a single multi-platform build matrix and improving artifact handling/retention.mainbranch..gitignoreto ignore theexamples/not_upload/directory.