Use UV #209
Use UV #209
Conversation
We'll do this a little differently soon.
Rasterio wheels don't exist for the full matrix yet.
|
Let's land this after #207. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-22.04 | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up uv | ||
| uses: astral-sh/setup-uv@v4 | ||
| with: | ||
| python-version: "3.10" | ||
|
|
||
| - name: Build package | ||
| run: uv build | ||
|
|
||
| - name: Set up a fresh environment and run tests | ||
| run: | | ||
| uv venv | ||
| uv pip install dist/*.tar.gz | ||
| uv pip install dist/*.whl | ||
| uv pip install pytest | ||
| uv run pytest | ||
| release: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
In general, to fix this issue you must explicitly declare a permissions block either at the workflow root (applies to all jobs) or per job, and grant only the minimal privileges required. When a workflow only checks out code and runs builds/tests and external deployments, the minimal permissions for GITHUB_TOKEN are typically contents: read.
For this specific workflow in .github/workflows/release.yaml, none of the steps perform repository writes or use GitHub APIs that require more than read access. The safest and simplest fix is to add a top‑level permissions: block after the name: (or before jobs:) specifying contents: read. This will apply to both release-test and release jobs, since neither defines its own permissions. No other behavior will change: actions/checkout@v4 works with contents: read, and the PyPI upload uses a separate secret, unaffected by GITHUB_TOKEN permissions.
Concretely:
-
Edit
.github/workflows/release.yaml. -
Insert:
permissions: contents: read
between the
name: releaseline and theon:block.
No imports, methods, or additional definitions are needed; this is purely a YAML configuration change.
| @@ -1,5 +1,8 @@ | ||
| name: release | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: | ||
| tags: |
| runs-on: ubuntu-22.04 | ||
| needs: release-test | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up uv | ||
| uses: astral-sh/setup-uv@v4 | ||
| with: | ||
| python-version: "3.10" | ||
|
|
||
| - name: Compare tags | ||
| run: | | ||
| PKG_VERSION=`grep '__version__' mapbox_tilesets/__init__.py | sed -E "s/^.*['\"](.*)['\"].*$/\1/"` | ||
| echo "Checking that package version [v$PKG_VERSION] matches release tag [${{ github.ref_name }}]" | ||
| [ "${{ github.ref_type }}" = "tag" ] && [ "${{ github.ref_name }}" = "v$PKG_VERSION" ] | ||
| - name: Build package | ||
| run: uv build | ||
|
|
||
| - name: Install Twine | ||
| run: | | ||
| uv venv | ||
| uv pip install twine | ||
| - name: Validate deployment | ||
| run: uv run twine check dist/* | ||
|
|
||
| - name: Run deployment | ||
| run: uv run twine upload dist/* -r pypi -u __token__ -p ${{ secrets.PYPI_PASSWORD }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
In general, the fix is to explicitly declare permissions for the workflow or for individual jobs so that the GITHUB_TOKEN has only the minimal rights needed. Since this workflow does not modify repository contents, issues, or pull requests, it can safely limit contents to read and leave all other scopes at their default of none.
The best, least-intrusive fix is to add a workflow-level permissions block near the top of .github/workflows/release.yaml, so it applies to both release-test and release jobs. Specifically, after the name: release line and before the on: trigger configuration, add:
permissions:
contents: readNo other steps, secrets, or environment variables rely on elevated GITHUB_TOKEN permissions, so this change will not break existing functionality. No imports, methods, or additional definitions are required because this is purely a YAML configuration change within the workflow file.
| @@ -1,4 +1,6 @@ | ||
| name: release | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: |
1 participant
No description provided.