inventree/InvenTree
2
0
Fork 0
mirror of https://github.com/inventree/InvenTree.git synced 2026-09-15 00:42:52 +00:00
Code Activity

more hardening of ci steps (#12834)

Browse Source 
* fix rule: zizmor/self-repository

* pin to version

* fix --proto "=https"

* another shell:S6506

* fix shell:S8541

* fix githubactions:S8541

* fix githubactions:S8541

* more sec fixes

* fix psycopg version

* more script disabling on frontend
This commit is contained in:
Matthias Mair
2026-09-11 16:55:04 +10:00
committed by GitHub
parent c26db6a790
commit 7d9443dbf8
10 changed files with 52 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/actions/setup/action.yaml
+3 -3
View File
@@ -65,15 +65,15 @@ runs:
shell: bash
run: |
python3 -m pip install -U pip
pip3 install -U invoke wheel
pip3 install 'uv>=0.9.6'
pip3 install --only-binary :all: -U invoke wheel
pip3 install --only-binary :all: 'uv>=0.9.6'
- name: Allow uv to use the system Python by default
run: echo "UV_SYSTEM_PYTHON=1" >> $GITHUB_ENV
shell: bash
- name: Install Specific Python Dependencies
if: ${{ inputs.pip-dependency }}
shell: bash
run: uv pip install ${PIP_DEPS}
run: "uv pip install ${PIP_DEPS}" # TODO remove building once mysqlclient is available as a wheel
env:
PIP_DEPS: ${{ inputs.pip-dependency }}
.github/workflows/check_translations.yaml
+1 -1
View File
@@ -36,7 +36,7 @@ jobs:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
install: true
apt-dependency: gettext
.github/workflows/frontend.yaml
+15 -15
View File
@@ -73,11 +73,11 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
npm: true
- name: Install dependencies
run: cd src/frontend && yarn install
run: cd src/frontend && yarn install --ignore-scripts
- name: Build frontend
run: cd src/frontend && yarn run compile && yarn run lib && yarn run build
- name: Write version file - SHA
@@ -127,13 +127,13 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
npm: true
install: true
update: true
apt-dependency: gettext postgresql-client libpq-dev
pip-dependency: psycopg2
pip-dependency: psycopg
- name: Set up test data
run: |
invoke dev.setup-test -iv
@@ -148,10 +148,10 @@ jobs:
key: ${{ runner.os }}-playwright-${{ hashFiles('src/frontend/yarn.lock') }}
- name: Install Playwright browsers
if: steps.playwright-cache.outputs.cache-hit != 'true'
run: cd src/frontend && npx playwright install --with-deps
run: cd src/frontend && npx --ignore-scripts playwright install --with-deps
- name: Install Playwright OS dependencies
if: steps.playwright-cache.outputs.cache-hit == 'true'
run: cd src/frontend && npx playwright install-deps
run: cd src/frontend && npx --ignore-scripts playwright install-deps
- name: Install Sample Plugin
run: |
pip install -U inventree-plugin-creator==${{ env.plugin_creator_version }}
@@ -164,7 +164,7 @@ jobs:
cp ./tests/fixtures/playwright_custom_logo.png ../backend/InvenTree/InvenTree/static/img/playwright_custom_logo.png
cp ./tests/fixtures/playwright_custom_splash.png ../backend/InvenTree/InvenTree/static/img/playwright_custom_splash.png
invoke static
env INVENTREE_CUSTOM_SPLASH="img/playwright_custom_splash.png" INVENTREE_CUSTOM_LOGO="img/playwright_custom_logo.png" PLAYWRIGHT_BASE_URL=http://localhost:8000 npx playwright test --project=firefox --shard=${{ matrix.shard }}/2
env INVENTREE_CUSTOM_SPLASH="img/playwright_custom_splash.png" INVENTREE_CUSTOM_LOGO="img/playwright_custom_logo.png" PLAYWRIGHT_BASE_URL=http://localhost:8000 npx --ignore-scripts playwright test --project=firefox --shard=${{ matrix.shard }}/2
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: ${{ !cancelled() && steps.tests.outcome == 'failure' }}
with:
@@ -209,13 +209,13 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
npm: true
install: true
update: true
apt-dependency: gettext postgresql-client libpq-dev
pip-dependency: psycopg2
pip-dependency: psycopg
- name: Set up test data
run: |
invoke dev.setup-test -iv
@@ -230,10 +230,10 @@ jobs:
key: ${{ runner.os }}-playwright-${{ hashFiles('src/frontend/yarn.lock') }}
- name: Install Playwright browsers
if: steps.playwright-cache.outputs.cache-hit != 'true'
run: cd src/frontend && npx playwright install --with-deps
run: cd src/frontend && npx --ignore-scripts playwright install --with-deps
- name: Install Playwright OS dependencies
if: steps.playwright-cache.outputs.cache-hit == 'true'
run: cd src/frontend && npx playwright install-deps
run: cd src/frontend && npx --ignore-scripts playwright install-deps
- name: Install Sample Plugin
run: |
pip install -U inventree-plugin-creator==${{ env.plugin_creator_version }}
@@ -243,7 +243,7 @@ jobs:
id: tests
run: |
cd src/frontend
npx nyc playwright test --project=chromium --shard=${{ matrix.shard }}/4
npx --ignore-scripts nyc playwright test --project=chromium --shard=${{ matrix.shard }}/4
- name: Playwright Report [${{ matrix.shard }} / 4]
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: ${{ !cancelled() && steps.tests.outcome == 'failure' }}
@@ -278,7 +278,7 @@ jobs:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
npm: true
install: false
@@ -295,8 +295,8 @@ jobs:
run: |
mkdir -p .nyc_output
cp all-coverage/*.json .nyc_output/ 2>/dev/null || true
npx nyc merge .nyc_output merged-coverage.json
npx nyc report \
npx --ignore-scripts nyc merge .nyc_output merged-coverage.json
npx --ignore-scripts nyc report \
--tempdir .nyc_output \
--reporter=lcov \
--reporter=text-summary \
.github/workflows/import_export.yaml
+4 -4
View File
@@ -82,7 +82,7 @@ jobs:
fetch-depth: 0
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils libpq-dev
pip-dependency: psycopg
@@ -154,7 +154,7 @@ jobs:
fetch-depth: 0
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils libpq-dev
pip-dependency: psycopg
@@ -218,7 +218,7 @@ jobs:
fetch-depth: 0
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils libpq-dev
pip-dependency: psycopg
@@ -292,7 +292,7 @@ jobs:
fetch-depth: 0
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils libpq-dev
pip-dependency: psycopg
.github/workflows/migration_tests.yaml
+4 -4
View File
@@ -67,7 +67,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils
dev-install: true
@@ -117,7 +117,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils libmysqlclient-dev
pip-dependency: mysqlclient
@@ -164,7 +164,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils libpq-dev
pip-dependency: psycopg
@@ -199,7 +199,7 @@ jobs:
persist-credentials: false
name: Checkout Code
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
install: true
- name: Fetch Database
.github/workflows/qc_checks.yaml
+7 -7
View File
@@ -129,7 +129,7 @@ jobs:
persist-credentials: false
- name: Environment Setup
id: setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils
dev-install: true
@@ -188,7 +188,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils
dev-install: true
@@ -330,7 +330,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils
dev-install: true
@@ -388,7 +388,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils
dev-install: true
@@ -441,7 +441,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils
dev-install: true
@@ -492,7 +492,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils libpq-dev
pip-dependency: psycopg django-redis>=5.0.0
@@ -541,7 +541,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
apt-dependency: gettext poppler-utils libmysqlclient-dev
pip-dependency: mysqlclient
.github/workflows/release.yaml
+10 -10
View File
@@ -25,7 +25,7 @@ jobs:
persist-credentials: false
- name: Version Check
run: |
pip install --require-hashes -r contrib/dev_reqs/requirements.txt
pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt
python3 .github/scripts/version_check.py
- name: Push to Stable Branch
uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1.3.0
@@ -49,7 +49,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
npm: true
- name: Install dependencies
@@ -119,14 +119,14 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
install: true
npm: true
- name: Install dependencies
run: |
pip install --require-hashes -r contrib/dev_reqs/requirements.txt
pip install --require-hashes -r docs/requirements.txt
pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt
pip install --require-hashes --only-binary :all: -r docs/requirements.txt
- name: Build documentation
run: |
invoke build-docs --mkdocs
@@ -213,7 +213,7 @@ jobs:
echo "#!/bin/bash" > contrib/packager.io/before.sh
echo "calculate release channel"
pip install --require-hashes -r contrib/dev_reqs/requirements.txt
pip install --require-hashes --only-binary :all: -r contrib/dev_reqs/requirements.txt
python3 .github/scripts/version_check.py
- name: cleanup
run: |
@@ -222,7 +222,7 @@ jobs:
# remove the whole docs dir - we are not doing anything with them
rm -rf docs
- name: Package - current release channel
uses: pkgr/action/package@c5666febcd31750da6428042193fc5b2fb765435 # main
uses: pkgr/action/package@c5666febcd31750da6428042193fc5b2fb765435 # v1.0.2
id: package
with:
name: inventree
@@ -241,7 +241,7 @@ jobs:
INVENTREE_CONFIG_FILE=/opt/inventree/config.yaml
APP_REPO=inventree/InvenTree
- name: Publish to go.packager.io - current release channel
uses: pkgr/action/publish@c5666febcd31750da6428042193fc5b2fb765435 # main
uses: pkgr/action/publish@c5666febcd31750da6428042193fc5b2fb765435 # v1.0.2
with:
target: ${{ matrix.target }}
token: ${{ secrets.PACKAGER_RELEASE_TOKEN }}
@@ -256,7 +256,7 @@ jobs:
PACKAGE_NAME: ${{ matrix.target }}-${{ steps.setup.outputs.version }}.tar.gz
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Package - stable release channel
uses: pkgr/action/package@c5666febcd31750da6428042193fc5b2fb765435 # main
uses: pkgr/action/package@c5666febcd31750da6428042193fc5b2fb765435 # v1.0.2
id: package-stable
with:
name: inventree
@@ -275,7 +275,7 @@ jobs:
INVENTREE_CONFIG_FILE=/opt/inventree/config.yaml
APP_REPO=inventree/InvenTree
- name: Publish to go.packager.io - stable release channel
uses: pkgr/action/publish@c5666febcd31750da6428042193fc5b2fb765435 # main
uses: pkgr/action/publish@c5666febcd31750da6428042193fc5b2fb765435 # v1.0.2
with:
target: ${{ matrix.target }}
token: ${{ secrets.PACKAGER_RELEASE_TOKEN }}
.github/workflows/translations.yaml
+1 -1
View File
@@ -36,7 +36,7 @@ jobs:
with:
persist-credentials: false
- name: Environment Setup
uses: ./.github/actions/setup
uses: $/.github/actions/setup
with:
install: true
apt-dependency: gettext