Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unrequire the password input in action metadata #151

Merged
merged 1 commit into from May 2, 2023
Merged

Unrequire the password input in action metadata #151

merged 1 commit into from May 2, 2023

Conversation

asherf
Copy link
Contributor

@asherf asherf commented Apr 27, 2023 •
edited by webknjaz

In #123, with Trusted Publishing being implemented, the missing or empty password started being used as a feature flag implying OIDC flow.

Ref: 2b46bad8

@asherf
password input is no longer required, since not specifying it implies…
e4b9031 
… trusted publishing

Signed-off-by: Asher Foa <1268088+asherf@users.noreply.github.com>
@asherf
Copy link
Contributor Author

asherf commented May 1, 2023

@webknjaz

@webknjaz
Copy link
Member

webknjaz commented May 2, 2023

Oh, interesting... How did you catch that? Did GH complain? I suppose it's not broken in the runtime but emits annoying warnings somewhere, right?

webknjaz
webknjaz approved these changes May 2, 2023
View reviewed changes
Copy link
Member

@webknjaz webknjaz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@asherf
Copy link
Contributor Author

asherf commented May 2, 2023

Oh, interesting... How did you catch that? Did GH complain? I suppose it's not broken in the runtime but emits annoying warnings somewhere, right?

VS code, when editing the workflow file. see screenshot:

Screenshot 2023-05-02 at 12 01 40 PM

(it is not actually preventing things from working properly)....

@webknjaz
Copy link
Member

webknjaz commented May 2, 2023

Ah, cool. That's happening on the jsonschema level...

So integrating https://check-jsonschema.readthedocs.io/en/latest/precommit_usage.html#check-github-actions would help.

@webknjaz webknjaz changed the title password input is no longer required, since not specifying it implies trusted publishing Unrequire the password input in action metadata May 2, 2023
@webknjaz
Copy link
Member

webknjaz commented May 2, 2023

@asherf do you know which schema does your VS Code extension use? Or at least, which extension reports that?

@asherf
Copy link
Contributor Author

asherf commented May 2, 2023 •
edited

I think this extension is the one reporting it: https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-github-actions

@webknjaz
Copy link
Member

webknjaz commented May 2, 2023

Ah, cool, thanks! I think I won't be adding any linting to this PR after all. It's harder to implement than I thought originally. At least, in a way that would catch bugs like this… Maybe, some other time.

@webknjaz webknjaz merged commit a56da0b into pypa:unstable/v1 May 2, 2023
2 checks passed
@asherf asherf deleted the trusted branch May 2, 2023 20:53
@webknjaz
Copy link
Member

webknjaz commented May 2, 2023

I've just tagged this as v1.8.6 🎉

renovate bot added a commit to allenporter/flux-local that referenced this pull request May 5, 2023
@renovate
Update pypa/gh-action-pypi-publish action to v1.8.6 (#179)
f24edf8 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish)
| action | patch | `v1.8.5` -> `v1.8.6` |

---

### Release Notes

<details>
<summary>pypa/gh-action-pypi-publish</summary>

###
[`v1.8.6`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.6)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.5...v1.8.6)

#### What's Updated

- [@&#8203;woodruffw] dropped the references to a “private beta” from
the project docs and runtime in
[pypa/gh-action-pypi-publish#147.
He also clarified that the API tokens are still more secure than
passwords in
[pypa/gh-action-pypi-publish#150.
- [@&#8203;asherf] noticed that the action metadata incorrectly marked
the `password` field as required and contributed a correction in
[pypa/gh-action-pypi-publish#151
- [@&#8203;webknjaz] moved the Trusted Publishing example to the top of
the README in hopes that new users would default to using it via
pypa/gh-action-pypi-publish@f47b347

#### New Contributors

- [@&#8203;asherf] made their first contribution in
[pypa/gh-action-pypi-publish#151

**Full Diff**:
pypa/gh-action-pypi-publish@v1.8.5...v1.8.6

[@&#8203;asherf]: https://togithub.com/sponsors/asherf

[@&#8203;webknjaz]: https://togithub.com/sponsors/webknjaz

[@&#8203;woodruffw]: https://togithub.com/sponsors/woodruffw

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/allenporter/flux-local).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS43MS4wIiwidXBkYXRlZEluVmVyIjoiMzUuNzEuMCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate bot added a commit to allenporter/pyrainbird that referenced this pull request May 5, 2023
@renovate
Update pypa/gh-action-pypi-publish action to v1.8.6 (#169)
16fd86d 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish)
| action | patch | `v1.8.5` -> `v1.8.6` |

---

### Release Notes

<details>
<summary>pypa/gh-action-pypi-publish</summary>

###
[`v1.8.6`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.6)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.5...v1.8.6)

#### What's Updated

- [@&#8203;woodruffw] dropped the references to a “private beta” from
the project docs and runtime in
[pypa/gh-action-pypi-publish#147.
He also clarified that the API tokens are still more secure than
passwords in
[pypa/gh-action-pypi-publish#150.
- [@&#8203;asherf] noticed that the action metadata incorrectly marked
the `password` field as required and contributed a correction in
[pypa/gh-action-pypi-publish#151
- [@&#8203;webknjaz] moved the Trusted Publishing example to the top of
the README in hopes that new users would default to using it via
pypa/gh-action-pypi-publish@f47b347

#### New Contributors

- [@&#8203;asherf] made their first contribution in
[pypa/gh-action-pypi-publish#151

**Full Diff**:
pypa/gh-action-pypi-publish@v1.8.5...v1.8.6

[@&#8203;asherf]: https://togithub.com/sponsors/asherf

[@&#8203;webknjaz]: https://togithub.com/sponsors/webknjaz

[@&#8203;woodruffw]: https://togithub.com/sponsors/woodruffw

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/allenporter/pyrainbird).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS43MS4wIiwidXBkYXRlZEluVmVyIjoiMzUuNzEuMCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
michaelkedar pushed a commit to google/osv.dev that referenced this pull request May 26, 2023
@renovate-bot
Update workflows (#1296)
f82dbf1 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github/codeql-action](https://togithub.com/github/codeql-action) |
action | patch | `v2.3.3` -> `v2.3.5` |
|
[pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish)
| action | patch | `v1.8.5` -> `v1.8.6` |

---

### Release Notes

<details>
<summary>github/codeql-action</summary>

###
[`v2.3.5`](https://togithub.com/github/codeql-action/compare/v2.3.4...v2.3.5)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.3.4...v2.3.5)

###
[`v2.3.4`](https://togithub.com/github/codeql-action/compare/v2.3.3...v2.3.4)

[Compare
Source](https://togithub.com/github/codeql-action/compare/v2.3.3...v2.3.4)

</details>

<details>
<summary>pypa/gh-action-pypi-publish</summary>

###
[`v1.8.6`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.6)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.5...v1.8.6)

#### What's Updated

- [@&#8203;woodruffw] dropped the references to a “private beta” from
the project docs and runtime in
[pypa/gh-action-pypi-publish#147.
He also clarified that the API tokens are still more secure than
passwords in
[pypa/gh-action-pypi-publish#150.
- [@&#8203;asherf] noticed that the action metadata incorrectly marked
the `password` field as required and contributed a correction in
[pypa/gh-action-pypi-publish#151
- [@&#8203;webknjaz] moved the Trusted Publishing example to the top of
the README in hopes that new users would default to using it via
pypa/gh-action-pypi-publish@f47b347

#### New Contributors

- [@&#8203;asherf] made their first contribution in
[pypa/gh-action-pypi-publish#151

**Full Diff**:
pypa/gh-action-pypi-publish@v1.8.5...v1.8.6

[@&#8203;asherf]: https://togithub.com/sponsors/asherf

[@&#8203;webknjaz]: https://togithub.com/sponsors/webknjaz

[@&#8203;woodruffw]: https://togithub.com/sponsors/woodruffw

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 6am on wednesday" in timezone
Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://app.renovatebot.com/dashboard#github/google/osv.dev).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS40OC4yIiwidXBkYXRlZEluVmVyIjoiMzUuOTguMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciJ9-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@webknjaz webknjaz webknjaz approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@asherf @webknjaz