From 0de1a895cc9cf6483f25f1ba2c85933ecbb3ef05 Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 11 Jul 2025 19:44:54 +0000 Subject: [PATCH 1/9] Fixes Create reusable Github action #361 --- .github/actions/dfetch-action.yml | 70 +++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 .github/actions/dfetch-action.yml diff --git a/.github/actions/dfetch-action.yml b/.github/actions/dfetch-action.yml new file mode 100644 index 000000000..1a567b7c1 --- /dev/null +++ b/.github/actions/dfetch-action.yml @@ -0,0 +1,70 @@ + +# Dfetch SARIF Check Action +# ========================= +# +# This action installs dfetch, runs `dfetch check --sarif`, and uploads the SARIF file for code scanning. +# +# ## Usage Example +# +# ```yaml +# jobs: +# dfetch-scan: +# runs-on: ubuntu-latest +# steps: +# - uses: actions/checkout@v4 +# - name: Run Dfetch SARIF Check +# uses: dfetch-org/dfetch/.github/actions/dfetch-action@main +# with: +# dfetch-install: '.' +# working-directory: '.' # optional, defaults to project root +# ``` +# +# ## Inputs +# - `dfetch-install`: pip install argument for dfetch (default: . for local) +# - `working-directory`: Directory to run dfetch in (default: project root) +# +# ## Outputs +# - `sarif-path`: Path to the generated SARIF file (sarif.json) +# +# ## Author +# - Maintained by dfetch-org +name: 'Dfetch SARIF Check' +description: 'Run dfetch check and upload SARIF results.' +author: 'dfetch-org' +branding: + icon: 'check-circle' + color: 'blue' + +inputs: + dfetch-install: + description: 'pip install argument for dfetch (default: . for local)' + required: false + default: '.' + working-directory: + description: 'Directory to run dfetch in (default: project root)' + required: false + default: '.' + +outputs: + sarif-path: + description: 'Path to the generated SARIF file.' + value: sarif.json + +runs: + using: 'composite' + steps: + - name: Setup Python + uses: actions/setup-python@v5 + with: + python-version: '3.13' + - name: Install dfetch + run: pip install ${{ inputs.dfetch-install }} + shell: bash + - name: Run dfetch check (SARIF) + run: dfetch check --sarif sarif.json + shell: bash + working-directory: ${{ inputs.working-directory }} + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: sarif.json From 30a1cd966121c2355ea417769c9dbc4c90c7bf57 Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 11 Jul 2025 19:47:05 +0000 Subject: [PATCH 2/9] Use the action --- .github/actions/dfetch-action.yml | 8 +------- .github/workflows/run.yml | 7 +++---- 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/.github/actions/dfetch-action.yml b/.github/actions/dfetch-action.yml index 1a567b7c1..27f6661cb 100644 --- a/.github/actions/dfetch-action.yml +++ b/.github/actions/dfetch-action.yml @@ -15,12 +15,10 @@ # - name: Run Dfetch SARIF Check # uses: dfetch-org/dfetch/.github/actions/dfetch-action@main # with: -# dfetch-install: '.' # working-directory: '.' # optional, defaults to project root # ``` # # ## Inputs -# - `dfetch-install`: pip install argument for dfetch (default: . for local) # - `working-directory`: Directory to run dfetch in (default: project root) # # ## Outputs @@ -36,10 +34,6 @@ branding: color: 'blue' inputs: - dfetch-install: - description: 'pip install argument for dfetch (default: . for local)' - required: false - default: '.' working-directory: description: 'Directory to run dfetch in (default: project root)' required: false @@ -58,7 +52,7 @@ runs: with: python-version: '3.13' - name: Install dfetch - run: pip install ${{ inputs.dfetch-install }} + run: pip install . shell: bash - name: Run dfetch check (SARIF) run: dfetch check --sarif sarif.json diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml index fc2604010..da0683bf9 100644 --- a/.github/workflows/run.yml +++ b/.github/workflows/run.yml @@ -30,11 +30,10 @@ jobs: - run: dfetch check - run: dfetch update - run: dfetch update - - run: dfetch check --sarif sarif.json - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v3 + - name: Dfetch SARIF Check + uses: ./github/actions/dfetch-action with: - sarif_file: sarif.json + working-directory: '.' - name: Run example working-directory: ./example From 47df9aee5169894193c4170715dd9cd6502881b6 Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 11 Jul 2025 19:55:04 +0000 Subject: [PATCH 3/9] Make sure the repo is checked out --- .github/actions/dfetch-action.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/actions/dfetch-action.yml b/.github/actions/dfetch-action.yml index 27f6661cb..7534d124d 100644 --- a/.github/actions/dfetch-action.yml +++ b/.github/actions/dfetch-action.yml @@ -18,6 +18,8 @@ # working-directory: '.' # optional, defaults to project root # ``` # +# This action can be used as a step in any workflow, including those with other actions or jobs. +# # ## Inputs # - `working-directory`: Directory to run dfetch in (default: project root) # @@ -47,6 +49,8 @@ outputs: runs: using: 'composite' steps: + - name: Checkout repository + uses: actions/checkout@v4 - name: Setup Python uses: actions/setup-python@v5 with: From c579402b030420ce5d039313eda3188430a0e504 Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 11 Jul 2025 20:17:26 +0000 Subject: [PATCH 4/9] Move to action.yml --- .../actions/{dfetch-action.yml => dfetch-action/action.yml} | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) rename .github/actions/{dfetch-action.yml => dfetch-action/action.yml} (94%) diff --git a/.github/actions/dfetch-action.yml b/.github/actions/dfetch-action/action.yml similarity index 94% rename from .github/actions/dfetch-action.yml rename to .github/actions/dfetch-action/action.yml index 7534d124d..625e0357b 100644 --- a/.github/actions/dfetch-action.yml +++ b/.github/actions/dfetch-action/action.yml @@ -1,4 +1,3 @@ - # Dfetch SARIF Check Action # ========================= # @@ -6,6 +5,8 @@ # # ## Usage Example # +# > **Note:** You must use `actions/checkout@v4` before this action to ensure your repository is available. +# # ```yaml # jobs: # dfetch-scan: From 061cb2478a1f61eeb751f814612d69a876245302 Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 11 Jul 2025 20:23:02 +0000 Subject: [PATCH 5/9] Also run sarif check in other platforms --- .github/workflows/run.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml index da0683bf9..d3d756712 100644 --- a/.github/workflows/run.yml +++ b/.github/workflows/run.yml @@ -86,8 +86,8 @@ jobs: - run: dfetch check - run: dfetch update - run: dfetch update - - run: dfetch check --sarif sarif.json - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v3 + - name: Dfetch SARIF Check + uses: ./github/actions/dfetch-action with: - sarif_file: sarif.json + working-directory: '.' + From 2fcce1d6efb0bf6ba40db703784caec5340cbc07 Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 11 Jul 2025 20:25:40 +0000 Subject: [PATCH 6/9] Fix path --- .github/workflows/run.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml index d3d756712..5d0c53b4f 100644 --- a/.github/workflows/run.yml +++ b/.github/workflows/run.yml @@ -31,7 +31,7 @@ jobs: - run: dfetch update - run: dfetch update - name: Dfetch SARIF Check - uses: ./github/actions/dfetch-action + uses: ./.github/actions/dfetch-action with: working-directory: '.' @@ -87,7 +87,7 @@ jobs: - run: dfetch update - run: dfetch update - name: Dfetch SARIF Check - uses: ./github/actions/dfetch-action + uses: ./.github/actions/dfetch-action with: working-directory: '.' From 6917e7db2c05376dbb3518cd61d90438af6adf6d Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 11 Jul 2025 20:44:52 +0000 Subject: [PATCH 7/9] Move action to root and document it in README --- .github/actions/dfetch-action/action.yml | 69 ------------------------ .github/workflows/run.yml | 4 +- README.md | 18 +++++++ action.yml | 38 +++++++++++++ doc/dfetch-action.md | 0 5 files changed, 58 insertions(+), 71 deletions(-) delete mode 100644 .github/actions/dfetch-action/action.yml create mode 100644 action.yml create mode 100644 doc/dfetch-action.md diff --git a/.github/actions/dfetch-action/action.yml b/.github/actions/dfetch-action/action.yml deleted file mode 100644 index 625e0357b..000000000 --- a/.github/actions/dfetch-action/action.yml +++ /dev/null @@ -1,69 +0,0 @@ -# Dfetch SARIF Check Action -# ========================= -# -# This action installs dfetch, runs `dfetch check --sarif`, and uploads the SARIF file for code scanning. -# -# ## Usage Example -# -# > **Note:** You must use `actions/checkout@v4` before this action to ensure your repository is available. -# -# ```yaml -# jobs: -# dfetch-scan: -# runs-on: ubuntu-latest -# steps: -# - uses: actions/checkout@v4 -# - name: Run Dfetch SARIF Check -# uses: dfetch-org/dfetch/.github/actions/dfetch-action@main -# with: -# working-directory: '.' # optional, defaults to project root -# ``` -# -# This action can be used as a step in any workflow, including those with other actions or jobs. -# -# ## Inputs -# - `working-directory`: Directory to run dfetch in (default: project root) -# -# ## Outputs -# - `sarif-path`: Path to the generated SARIF file (sarif.json) -# -# ## Author -# - Maintained by dfetch-org -name: 'Dfetch SARIF Check' -description: 'Run dfetch check and upload SARIF results.' -author: 'dfetch-org' -branding: - icon: 'check-circle' - color: 'blue' - -inputs: - working-directory: - description: 'Directory to run dfetch in (default: project root)' - required: false - default: '.' - -outputs: - sarif-path: - description: 'Path to the generated SARIF file.' - value: sarif.json - -runs: - using: 'composite' - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - name: Setup Python - uses: actions/setup-python@v5 - with: - python-version: '3.13' - - name: Install dfetch - run: pip install . - shell: bash - - name: Run dfetch check (SARIF) - run: dfetch check --sarif sarif.json - shell: bash - working-directory: ${{ inputs.working-directory }} - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: sarif.json diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml index 5d0c53b4f..8f4560add 100644 --- a/.github/workflows/run.yml +++ b/.github/workflows/run.yml @@ -31,7 +31,7 @@ jobs: - run: dfetch update - run: dfetch update - name: Dfetch SARIF Check - uses: ./.github/actions/dfetch-action + uses: . with: working-directory: '.' @@ -87,7 +87,7 @@ jobs: - run: dfetch update - run: dfetch update - name: Dfetch SARIF Check - uses: ./.github/actions/dfetch-action + uses: . with: working-directory: '.' diff --git a/README.md b/README.md index 587f1fa6a..65e361c51 100644 --- a/README.md +++ b/README.md @@ -37,11 +37,29 @@ See [alternatives](https://dfetch.readthedocs.io/en/latest/alternatives.html) fo ## Install ### Stable + ```bash pip install dfetch ``` ### latest version + ```bash pip install https://github.com/dfetch-org/dfetch/archive/main.zip ``` + +## Github Action + +You can use DFetch in your Github Actions workflow to check your dependencies. +The results will be uploaded to Github. Add the following to your workflow file: + +```yaml +jobs: + dfetch-check: + runs-on: ubuntu-latest + steps: + - name: Run Dfetch Check + uses: dfetch-org/dfetch@main + with: + working-directory: '.' # optional, defaults to project root +``` diff --git a/action.yml b/action.yml new file mode 100644 index 000000000..223a4cab5 --- /dev/null +++ b/action.yml @@ -0,0 +1,38 @@ +name: 'Dfetch Check' +description: 'Run dfetch check and upload SARIF results.' +author: 'dfetch-org' +branding: + icon: 'check-circle' + color: 'blue' + +inputs: + working-directory: + description: 'Directory to run dfetch in (default: project root)' + required: false + default: '.' + +outputs: + sarif-path: + description: 'Path to the generated SARIF file.' + value: sarif.json + +runs: + using: 'composite' + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Setup Python + uses: actions/setup-python@v5 + with: + python-version: '3.13' + - name: Install dfetch + run: pip install . + shell: bash + - name: Run dfetch check (SARIF) + run: dfetch check --sarif sarif.json + shell: bash + working-directory: ${{ inputs.working-directory }} + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: sarif.json diff --git a/doc/dfetch-action.md b/doc/dfetch-action.md new file mode 100644 index 000000000..e69de29bb From 356851c6c9cd2384aa8b2d182a4bd8f68bcec9c8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 11 Jul 2025 18:47:59 +0000 Subject: [PATCH 8/9] Bump ruff from 0.12.2 to 0.12.3 Bumps [ruff](https://github.com/astral-sh/ruff) from 0.12.2 to 0.12.3. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ruff/compare/0.12.2...0.12.3) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.12.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 1a295b5ff..bfd81ea78 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -88,7 +88,7 @@ development = [ 'pyright==1.1.403', "tomli; python_version < '3.11'", # Tomllib is default in 3.11, required for letting codespell read the pyproject.toml 'pre-commit==4.2.0', - 'ruff==0.12.2', + 'ruff==0.12.3', ] docs = [ 'sphinx==8.2.3', From 410c216cd9a90c24dde42bb9a1602031676cf2a8 Mon Sep 17 00:00:00 2001 From: Ben Date: Fri, 11 Jul 2025 20:54:24 +0000 Subject: [PATCH 9/9] Use correct path --- .github/workflows/run.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml index 8f4560add..04127b2b6 100644 --- a/.github/workflows/run.yml +++ b/.github/workflows/run.yml @@ -31,7 +31,7 @@ jobs: - run: dfetch update - run: dfetch update - name: Dfetch SARIF Check - uses: . + uses: ./ with: working-directory: '.' @@ -87,7 +87,7 @@ jobs: - run: dfetch update - run: dfetch update - name: Dfetch SARIF Check - uses: . + uses: ./ with: working-directory: '.'