-
Notifications
You must be signed in to change notification settings - Fork 0
Fix tests #10
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix tests #10
Conversation
Reviewer's GuideThis pull request refactors string formatting in the Rust markdown converter to use modern implicit named arguments and updates documentation examples in File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hey @ursisterbtw - I've reviewed your changes - here's some feedback:
- Consider providing a more descriptive title and adding a description to explain the purpose of these changes, as 'Fix tests' doesn't fully capture the scope.
- The usage of
format!macro arguments appears inconsistent; most changes adopt implicit named arguments ({var}), but one uses explicit positional arguments ({0},{1}).
Here's what I looked at during the review
- 🟢 General issues: all looks good
- 🟢 Security: all looks good
- 🟢 Review instructions: all looks good
- 🟢 Testing: all looks good
- 🟢 Complexity: all looks good
- 🟢 Documentation: all looks good
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
…ty scans and automated releases
| name: Rust Benchmarks | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # Full history for accurate benchmark comparison | ||
|
|
||
| - name: Setup Rust toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| toolchain: stable | ||
|
|
||
| - name: Rust Cache | ||
| uses: Swatinem/rust-cache@v2 | ||
| with: | ||
| save-if: ${{ github.ref == 'refs/heads/main' }} | ||
|
|
||
| - name: Run Rust benchmarks | ||
| run: cargo bench --bench RAGnificent_bench -- --output-format bencher | tee bench_output.txt | ||
|
|
||
| - name: Store benchmark results | ||
| uses: benchmark-action/github-action-benchmark@v1 | ||
| with: | ||
| tool: 'cargo' | ||
| output-file-path: bench_output.txt | ||
| auto-push: true | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| comment-on-alert: true | ||
| fail-on-alert: false | ||
| alert-threshold: '150%' | ||
| gh-pages-branch: 'gh-pages' | ||
| benchmark-data-dir-path: 'benchmarks/data' | ||
|
|
||
| python-benchmarks: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block at the root of the workflow to define the minimal permissions required for all jobs. Additionally, we will add job-specific permissions blocks for any jobs that require elevated permissions. Based on the workflow's functionality, the contents: read permission is sufficient for most steps, but the Store benchmark results steps in both jobs require contents: write to push benchmark data to the repository.
-
Copy modified lines R12-R14 -
Copy modified lines R19-R20 -
Copy modified lines R55-R56
| @@ -11,2 +11,5 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| @@ -15,2 +18,4 @@ | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| steps: | ||
| @@ -49,2 +54,4 @@ | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| steps: |
| name: Python Benchmarks | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Set up Python 3.12 | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: '3.12' | ||
|
|
||
| - name: Setup Rust toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| toolchain: stable | ||
|
|
||
| - name: Rust Cache | ||
| uses: Swatinem/rust-cache@v2 | ||
| with: | ||
| save-if: ${{ github.ref == 'refs/heads/main' }} | ||
|
|
||
| - name: Set up uv | ||
| run: | | ||
| pip install uv | ||
| uv --version | ||
|
|
||
| - name: Setup Python environment | ||
| run: | | ||
| uv venv | ||
| source .venv/bin/activate | ||
| uv pip install -e .[dev,test] | ||
| uv pip install maturin pytest-benchmark | ||
|
|
||
| - name: Build Rust extension | ||
| run: | | ||
| source .venv/bin/activate | ||
| maturin build --release | ||
| maturin develop --release | ||
|
|
||
| - name: Run Python benchmarks | ||
| run: | | ||
| source .venv/bin/activate | ||
| python -m pytest tests/test_benchmarks.py -v --benchmark-json=pytest_bench_output.json | ||
|
|
||
| - name: Store benchmark results | ||
| uses: benchmark-action/github-action-benchmark@v1 | ||
| with: | ||
| tool: 'pytest' | ||
| output-file-path: pytest_bench_output.json | ||
| auto-push: true | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| comment-on-alert: true | ||
| fail-on-alert: false | ||
| alert-threshold: '150%' | ||
| gh-pages-branch: 'gh-pages' | ||
| benchmark-data-dir-path: 'benchmarks/data/python' |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block at the root of the workflow to define the minimal permissions required for the jobs. Based on the workflow's operations, the following permissions are necessary:
contents: readfor accessing repository contents.contents: writefor storing benchmark results and pushing updates to thegh-pagesbranch.
The permissions block will be added at the root level to apply to all jobs in the workflow. If any job requires additional permissions, they can be defined specifically within that job.
-
Copy modified lines R3-R5
| @@ -2,2 +2,5 @@ | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
|
||
| on: |
| name: Rust Code Quality | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Rust toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| toolchain: stable | ||
| components: clippy, rustfmt | ||
|
|
||
| - name: Rust Cache | ||
| uses: Swatinem/rust-cache@v2 | ||
| with: | ||
| save-if: ${{ github.ref == 'refs/heads/main' }} | ||
|
|
||
| - name: Check formatting | ||
| run: cargo fmt --all -- --check | ||
|
|
||
| - name: Clippy | ||
| run: cargo clippy --all-targets --all-features -- -D warnings | ||
|
|
||
| - name: Check compilation | ||
| run: cargo check --verbose --all-targets --all-features | ||
|
|
||
| rust-tests: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block at the root level of the workflow file. This block will apply to all jobs in the workflow unless overridden by job-specific permissions blocks. Since the workflow primarily performs read-only operations (e.g., checking code quality, running tests), we will set contents: read as the minimal required permission. If any job requires additional permissions in the future, they can be added explicitly at the job level.
-
Copy modified lines R11-R13
| @@ -10,2 +10,5 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: |
| name: Rust Tests | ||
| needs: rust-checks | ||
| runs-on: ${{ matrix.os }} | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| os: [ubuntu-latest, windows-latest] | ||
| include: | ||
| - os: ubuntu-latest | ||
| target: x86_64-unknown-linux-gnu | ||
| - os: windows-latest | ||
| target: x86_64-pc-windows-msvc | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Rust toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| toolchain: stable | ||
| target: ${{ matrix.target }} | ||
|
|
||
| - name: Rust Cache | ||
| uses: Swatinem/rust-cache@v2 | ||
| with: | ||
| save-if: ${{ github.ref == 'refs/heads/main' }} | ||
|
|
||
| - name: Run tests | ||
| run: cargo test --verbose --all-features | ||
|
|
||
| - name: Run benchmarks | ||
| run: cargo bench --no-run | ||
|
|
||
| python-checks: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block to the Rust Tests job, explicitly setting the permissions to the minimum required. Based on the steps in the job, it only needs contents: read to check out the repository and run tests. This change ensures that the GITHUB_TOKEN used in the job has the least privileges necessary.
-
Copy modified lines R42-R43
| @@ -41,2 +41,4 @@ | ||
| runs-on: ${{ matrix.os }} | ||
| permissions: | ||
| contents: read | ||
| strategy: |
| name: Python Code Quality | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Python 3.12 | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: '3.12' | ||
|
|
||
| - name: Set up uv | ||
| run: | | ||
| pip install uv | ||
| uv --version | ||
|
|
||
| - name: Setup Python environment | ||
| run: | | ||
| uv venv | ||
| source .venv/bin/activate | ||
| uv pip install -e .[dev] | ||
|
|
||
| - name: Lint with ruff | ||
| run: | | ||
| source .venv/bin/activate | ||
| ruff check RAGnificent/ tests/ | ||
|
|
||
| - name: Type check with mypy | ||
| run: | | ||
| source .venv/bin/activate | ||
| mypy RAGnificent/ | ||
|
|
||
| python-tests: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block at the workflow level to explicitly define the minimum required permissions. Based on the workflow's actions, it appears that only contents: read is necessary, as the jobs primarily involve code quality checks, tests, and benchmarks, which do not require write access. This change will ensure that the GITHUB_TOKEN has the least privilege required to execute the workflow.
-
Copy modified lines R11-R13
| @@ -10,2 +10,5 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: |
| name: Build Wheels on ${{ matrix.os }} | ||
| needs: create-release | ||
| runs-on: ${{ matrix.os }} | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| os: [ubuntu-latest, windows-latest] | ||
| python-version: ['3.12'] | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Set up Python ${{ matrix.python-version }} | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: ${{ matrix.python-version }} | ||
|
|
||
| - name: Setup Rust toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| toolchain: stable | ||
|
|
||
| - name: Rust Cache | ||
| uses: Swatinem/rust-cache@v2 | ||
|
|
||
| - name: Install dependencies | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install uv | ||
| pip install maturin build wheel twine | ||
|
|
||
| - name: Build wheels with maturin | ||
| run: | | ||
| maturin build --release --strip --features real_rendering | ||
|
|
||
| - name: Build sdist | ||
| if: matrix.os == 'ubuntu-latest' | ||
| run: | | ||
| pip install build | ||
| python -m build --sdist | ||
|
|
||
| - name: Upload Wheel | ||
| uses: actions/upload-artifact@v3 | ||
| with: | ||
| name: wheels-${{ matrix.os }}-py${{ matrix.python-version }} | ||
| path: | | ||
| target/wheels/*.whl | ||
| dist/*.tar.gz | ||
|
|
||
| - name: Upload to Release | ||
| uses: actions/upload-release-asset@v1 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: | ||
| upload_url: ${{ needs.create-release.outputs.upload_url }} | ||
| asset_path: target/wheels/ | ||
| asset_name: wheels-${{ matrix.os }}-py${{ matrix.python-version }}.zip | ||
| asset_content_type: application/zip | ||
|
|
||
| publish-pypi: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block to the build-wheels job to explicitly define the minimal permissions required. Since this job primarily involves building and uploading artifacts, it does not require write permissions. We will set contents: read as the minimal permission. Additionally, we will add a permissions block at the workflow level to ensure all jobs have minimal permissions by default, and override it only where necessary.
-
Copy modified lines R18-R20 -
Copy modified lines R44-R45
| @@ -17,2 +17,5 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| @@ -40,2 +43,4 @@ | ||
| runs-on: ${{ matrix.os }} | ||
| permissions: | ||
| contents: read | ||
| strategy: |
| name: Publish to PyPI | ||
| needs: [create-release, build-wheels] | ||
| runs-on: ubuntu-latest | ||
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Python 3.12 | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: '3.12' | ||
|
|
||
| - name: Download artifacts | ||
| uses: actions/download-artifact@v3 | ||
| with: | ||
| path: dist | ||
|
|
||
| - name: Prepare distribution files | ||
| run: | | ||
| mkdir -p dist_upload | ||
| find dist -name "*.whl" -o -name "*.tar.gz" | xargs -I {} cp {} dist_upload/ | ||
|
|
||
| - name: Publish to PyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 | ||
| with: | ||
| user: __token__ | ||
| password: ${{ secrets.PYPI_API_TOKEN }} | ||
| packages-dir: dist_upload/ | ||
| skip-existing: true | ||
|
|
||
| build-docs: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block to the workflow. This block will define the minimal permissions required for each job. For example:
- The
create-releasejob requirescontents: writeto create a release. - The
build-wheelsjob does not require any write permissions, so it can usecontents: read. - The
publish-pypijob does not useGITHUB_TOKENdirectly but interacts with PyPI, so it can also usecontents: read. - The
build-docsjob may requirecontents: readfor accessing repository files.
We will add these permissions explicitly to each job to ensure the principle of least privilege is followed.
-
Copy modified lines R22-R23 -
Copy modified lines R42-R43 -
Copy modified lines R105-R106 -
Copy modified lines R138-R139
| @@ -21,2 +21,4 @@ | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| outputs: | ||
| @@ -39,2 +41,4 @@ | ||
| needs: create-release | ||
| permissions: | ||
| contents: read | ||
| runs-on: ${{ matrix.os }} | ||
| @@ -100,2 +104,4 @@ | ||
| needs: [create-release, build-wheels] | ||
| permissions: | ||
| contents: read | ||
| runs-on: ubuntu-latest | ||
| @@ -131,2 +137,4 @@ | ||
| needs: create-release | ||
| permissions: | ||
| contents: read | ||
| runs-on: ubuntu-latest |
| name: Build and Deploy Docs | ||
| needs: create-release | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Python 3.12 | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: '3.12' | ||
|
|
||
| - name: Install dependencies | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install uv | ||
| uv venv | ||
| source .venv/bin/activate | ||
| uv pip install -e .[dev] | ||
| uv pip install mkdocs mkdocs-material mkdocstrings mkdocstrings-python | ||
|
|
||
| - name: Build docs | ||
| run: | | ||
| source .venv/bin/activate | ||
| mkdir -p docs | ||
| # Automatically generate API docs from code | ||
| python -c " | ||
| import os | ||
| from pathlib import Path | ||
|
|
||
| def generate_api_md(module_path, output_dir): | ||
| module_name = module_path.name | ||
| api_md = f'# {module_name.capitalize()} API\n\n' | ||
|
|
||
| for py_file in module_path.glob('*.py'): | ||
| if py_file.name.startswith('__'): | ||
| continue | ||
|
|
||
| rel_path = py_file.relative_to(Path('RAGnificent')) | ||
| module_path = str(rel_path.with_suffix('')).replace('/', '.') | ||
| api_md += f'## {py_file.stem}\n\n' | ||
| api_md += f'::: RAGnificent.{module_path}\n\n' | ||
|
|
||
| with open(output_dir / f'{module_name}.md', 'w') as f: | ||
| f.write(api_md) | ||
|
|
||
| # Create API documentation structure | ||
| api_dir = Path('docs/api') | ||
| api_dir.mkdir(exist_ok=True, parents=True) | ||
|
|
||
| # Generate API docs for each module | ||
| for module in Path('RAGnificent').iterdir(): | ||
| if module.is_dir() and not module.name.startswith('__'): | ||
| generate_api_md(module, api_dir) | ||
|
|
||
| # Create index.md if it doesn't exist | ||
| index_path = Path('docs/index.md') | ||
| if not index_path.exists(): | ||
| with open(index_path, 'w') as f: | ||
| f.write('# RAGnificent Documentation\n\nWelcome to the RAGnificent documentation!\n') | ||
| " | ||
|
|
||
| # Create mkdocs.yml if it doesn't exist | ||
| if [ ! -f "mkdocs.yml" ]; then | ||
| cat > mkdocs.yml << EOF | ||
| site_name: RAGnificent | ||
| site_description: HTML to Markdown converter with support for multiple output formats | ||
| site_author: RAGnificent Team | ||
|
|
||
| theme: | ||
| name: material | ||
| palette: | ||
| primary: indigo | ||
| accent: indigo | ||
| features: | ||
| - navigation.instant | ||
| - navigation.tracking | ||
| - navigation.expand | ||
| - navigation.indexes | ||
| - content.code.copy | ||
|
|
||
| markdown_extensions: | ||
| - pymdownx.highlight | ||
| - pymdownx.superfences | ||
| - pymdownx.inlinehilite | ||
| - pymdownx.tabbed | ||
| - pymdownx.critic | ||
| - admonition | ||
|
|
||
| plugins: | ||
| - search | ||
| - mkdocstrings: | ||
| handlers: | ||
| python: | ||
| selection: | ||
| docstring_style: google | ||
| rendering: | ||
| show_source: true | ||
|
|
||
| nav: | ||
| - Home: index.md | ||
| - Installation: installation.md | ||
| - User Guide: user-guide.md | ||
| - API Reference: | ||
| - Core: api/core.md | ||
| - RAG: api/rag.md | ||
| - Utils: api/utils.md | ||
| - Contributing: contributing.md | ||
| EOF | ||
| fi | ||
|
|
||
| # Create basic pages if they don't exist | ||
| mkdir -p docs | ||
|
|
||
| if [ ! -f "docs/installation.md" ]; then | ||
| cat > docs/installation.md << EOF | ||
| # Installation | ||
|
|
||
| RAGnificent can be installed using pip: | ||
|
|
||
| \`\`\`bash | ||
| pip install RAGnificent | ||
| \`\`\` | ||
|
|
||
| Or with uv: | ||
|
|
||
| \`\`\`bash | ||
| uv pip install RAGnificent | ||
| \`\`\` | ||
|
|
||
| ## From Source | ||
|
|
||
| To install from source: | ||
|
|
||
| \`\`\`bash | ||
| git clone https://github.com/ursisterbtw/RAGnificent.git | ||
| cd RAGnificent | ||
| uv venv | ||
| source .venv/bin/activate # On Windows: .venv\\Scripts\\activate | ||
| uv pip install -e . | ||
| \`\`\` | ||
| EOF | ||
| fi | ||
|
|
||
| if [ ! -f "docs/user-guide.md" ]; then | ||
| cat > docs/user-guide.md << EOF | ||
| # User Guide | ||
|
|
||
| ## Basic Usage | ||
|
|
||
| \`\`\`python | ||
| from RAGnificent import convert_html_to_markdown | ||
|
|
||
| html = "<h1>Hello World</h1><p>This is a test</p>" | ||
| markdown = convert_html_to_markdown(html) | ||
| print(markdown) | ||
| \`\`\` | ||
|
|
||
| ## Advanced Usage | ||
|
|
||
| For more complex scenarios, you can use the advanced API: | ||
|
|
||
| \`\`\`python | ||
| from RAGnificent.core.scraper import HTMLScraper | ||
|
|
||
| scraper = HTMLScraper() | ||
| result = scraper.scrape_url("https://example.com") | ||
| print(result.markdown) | ||
| \`\`\` | ||
| EOF | ||
| fi | ||
|
|
||
| if [ ! -f "docs/contributing.md" ]; then | ||
| cat > docs/contributing.md << EOF | ||
| # Contributing | ||
|
|
||
| We welcome contributions to RAGnificent! | ||
|
|
||
| ## Development Setup | ||
|
|
||
| 1. Clone the repository | ||
| 2. Create a virtual environment with uv | ||
| 3. Install development dependencies | ||
| 4. Build the Rust extension | ||
|
|
||
| \`\`\`bash | ||
| git clone https://github.com/ursisterbtw/RAGnificent.git | ||
| cd RAGnificent | ||
| uv venv | ||
| source .venv/bin/activate # On Windows: .venv\\Scripts\\activate | ||
| uv pip install -e .[dev,test] | ||
| maturin develop --release | ||
| \`\`\` | ||
|
|
||
| ## Running Tests | ||
|
|
||
| To run the tests: | ||
|
|
||
| \`\`\`bash | ||
| pytest | ||
| \`\`\` | ||
|
|
||
| ## Code Style | ||
|
|
||
| We use: | ||
| - Black for Python formatting | ||
| - Ruff for linting | ||
| - Mypy for type checking | ||
| - Rustfmt for Rust formatting | ||
| - Clippy for Rust linting | ||
| EOF | ||
| fi | ||
|
|
||
| # Build the documentation site | ||
| mkdocs build | ||
|
|
||
| - name: Deploy to GitHub Pages | ||
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') | ||
| uses: peaceiris/actions-gh-pages@v3 | ||
| with: | ||
| github_token: ${{ secrets.GITHUB_TOKEN }} | ||
| publish_dir: ./site | ||
| force_orphan: true |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block to the workflow to explicitly define the required permissions for each job. For the Build and Deploy Docs job, we will set contents: write because it needs to deploy to GitHub Pages. For the other jobs, we will analyze their requirements and set the minimal permissions needed. Additionally, we will add a global permissions block at the root of the workflow to set a default of contents: read, ensuring that any job without specific permissions inherits this minimal level.
-
Copy modified lines R2-R3 -
Copy modified lines R135-R136
| @@ -1,2 +1,4 @@ | ||
| name: RAGnificent Release | ||
| permissions: | ||
| contents: read | ||
|
|
||
| @@ -132,2 +134,4 @@ | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: write | ||
| steps: |
| name: Rust Security Audit | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Install Rust | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| toolchain: stable | ||
|
|
||
| - name: Install cargo-audit | ||
| run: cargo install cargo-audit | ||
|
|
||
| - name: Run cargo-audit | ||
| run: cargo audit | ||
| continue-on-error: true # Don't fail the workflow, but report issues | ||
|
|
||
| - name: Run cargo-deny | ||
| uses: EmbarkStudios/cargo-deny-action@v1 | ||
| with: | ||
| arguments: --all-features | ||
|
|
||
| python-security-audit: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block at the root level of the workflow to apply minimal permissions (contents: read) to all jobs. Additionally, we will add job-specific permissions blocks if any job requires additional permissions. This ensures that each job has only the permissions it needs.
-
Copy modified lines R3-R5 -
Copy modified lines R29-R30 -
Copy modified lines R54-R55
| @@ -2,2 +2,5 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| @@ -25,2 +28,4 @@ | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| @@ -48,2 +53,4 @@ | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: |
| name: Python Security Audit | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Python 3.12 | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: '3.12' | ||
|
|
||
| - name: Set up uv | ||
| run: pip install uv | ||
|
|
||
| - name: Install safety | ||
| run: uv pip install safety | ||
|
|
||
| - name: Check dependencies with safety | ||
| run: | | ||
| uv pip freeze > requirements-frozen.txt | ||
| safety check -r requirements-frozen.txt --full-report | ||
| continue-on-error: true # Don't fail the workflow, but report issues | ||
|
|
||
| - name: Install bandit | ||
| run: uv pip install bandit | ||
|
|
||
| - name: Run bandit (Python security linter) | ||
| run: bandit -r RAGnificent/ -f json -o bandit-results.json | ||
| continue-on-error: true | ||
|
|
||
| - name: Upload bandit results | ||
| uses: actions/upload-artifact@v3 | ||
| with: | ||
| name: bandit-results | ||
| path: bandit-results.json |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 months ago
To fix the issue, we will add a permissions block at the root of the workflow file to define the least privileges required for the workflow. Since the workflow only needs to read repository contents and upload artifacts, we will set contents: read and actions: write (for uploading artifacts). This ensures that no unnecessary write permissions are granted.
-
Copy modified lines R3-R6
| @@ -2,2 +2,6 @@ | ||
|
|
||
| permissions: | ||
| contents: read | ||
| actions: write | ||
|
|
||
| on: |
Summary by Sourcery
Modernize Rust code by using newer string formatting and documentation practices
Enhancements:
Chores: