-
Notifications
You must be signed in to change notification settings - Fork 53
dev/2.1.0 #50
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
dev/2.1.0 #50
Changes from all commits
Commits
Show all changes
13 commits
Select commit
Hold shift + click to select a range
011630d
feat: add QR login approval and fix file upload proxy
ink-developer 1aca78d
fix: error payload
ink-developer a9e24cd
feat: add new user attributes
m-xim 3292259
feat: implement BotsService and related payloads for bot interactions
ink-developer 4297052
fix: add AuthFlow
m-xim fe8dd7a
feat: add ProfileOptions enum and implement 2FA check in AuthMixin an…
ink-developer 8a2cd84
feat: add join request confirm and decline APIs
ink-developer af49dbc
feat: implement change password functionality for 2FA and update rela…
ink-developer 14671b6
feat: add release notes for version 2.1.0 with new features and fixes
ink-developer 13788a5
Merge pull request #48 from m-xim/main
ink-developer 6aff91d
feat: update release notes for version 2.1.0 and enhance TCP connecti…
ink-developer af2de88
feat: replace lint tooling with ruff and add release checks
ink-developer 09c84ec
fix: harden release checks and connection teardown
ink-developer File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,22 +9,52 @@ permissions: | |
| contents: read | ||
|
|
||
| jobs: | ||
| release-checks: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Set up uv | ||
| uses: astral-sh/setup-uv@v4 | ||
| with: | ||
| python-version: "3.10" | ||
| enable-cache: true | ||
|
|
||
| - name: Check lint | ||
| run: uv run ruff check src tests | ||
|
|
||
| - name: Check formatting | ||
| run: uv run ruff format --check src tests | ||
|
|
||
| - name: Run tests | ||
| run: uv run pytest | ||
|
Comment on lines
+26
to
+33
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Лучше запускать formatting, lint и тесты на любой PR, чтобы не пропускать проблемы до мержа. В отдельный action их перенести. |
||
|
|
||
| - name: Build docs | ||
| run: uv run sphinx-build -b html docs /tmp/pymax-docs | ||
|
|
||
| release-build: | ||
| runs-on: ubuntu-latest | ||
| needs: release-checks | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Set up uv | ||
| uses: astral-sh/setup-uv@v4 | ||
| with: | ||
| python-version: "3.10" | ||
| enable-cache: true | ||
|
|
||
| - name: Build release distributions | ||
| run: uv build | ||
|
|
||
| - name: Check distributions | ||
| run: uvx twine check dist/* | ||
| run: uv run twine check dist/* | ||
|
|
||
| - name: Upload distributions | ||
| uses: actions/upload-artifact@v4 | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| repos: | ||
| - repo: local | ||
| hooks: | ||
| - id: ruff-check | ||
| name: ruff check | ||
| entry: uv run ruff check --fix | ||
| language: system | ||
| types_or: [python, pyi] | ||
|
|
||
| - id: ruff-format | ||
| name: ruff format | ||
| entry: uv run ruff format | ||
| language: system | ||
| types_or: [python, pyi] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| PyMax 2.1.0 | ||
| =========== | ||
|
|
||
| Изменения относительно ``2.0.1``. | ||
|
|
||
| Добавлено | ||
| --------- | ||
|
|
||
| * Заявки на вступление в группы и каналы: ``get_join_requests()``, | ||
| ``confirm_join_request()`` / | ||
| ``confirm_join_requests()`` и отклонить их через ``decline_join_request()`` / | ||
| ``decline_join_requests()``. | ||
| * Доменные типы ``Member`` и ``Presence`` для заявок. | ||
| * 2FA: ``check_2fa()`` и ``change_password()``. | ||
| * QR-вход: ``authorize_qr_login(qr_link)``. | ||
| * Web app-боты: ``get_bot_init_data(bot_id, chat_id, start_param=None)``. | ||
|
|
||
| Исправлено | ||
| ---------- | ||
|
|
||
| * TCP-заголовок приведен к схеме Max: ``ver:1``, ``cmd:1``, ``seq:2``, | ||
| ``opcode:2``, ``len/cof:4``. ``seq`` больше не падает после ``255``. | ||
| * Upload фото, видео и файлов использует ``ExtraConfig.proxy`` для HTTP-отправки | ||
| на upload URL. | ||
| * ``MaxApiError.title`` и ``MaxApiError.localized_message`` могут быть ``None``. | ||
|
|
||
| Изменилось | ||
| ---------- | ||
|
|
||
| * ``check_2fa()`` возвращает ``False``, если профиль еще не загружен или сервер | ||
| не прислал ``profile_options``. | ||
| * При заданном ``ExtraConfig.proxy`` upload-запросы тоже идут через proxy. | ||
| Proxy должен выдерживать большие HTTP POST-запросы. | ||
| * ``Capability`` разделен на ``ProfileOptions`` и ``TwoFactorAction``. | ||
| * ``ApiFacade`` получил ``bots``-сервис. | ||
|
|
||
| Миграция | ||
| -------- | ||
|
|
||
| * Код на ``Client`` и ``WebClient`` обычно менять не нужно. | ||
| * Импорт ``pymax.api.auth.enums.Capability`` замените на ``TwoFactorAction`` или | ||
| ``ProfileOptions``. | ||
| * Если код ждал строку в ``MaxApiError.title``, теперь нужно учитывать ``None``. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| __version__ = "2.0.1" | ||
| __version__ = "2.1.0" | ||
|
|
||
|
|
||
| from .auth import ( | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: MaxApiTeam/PyMax
Length of output: 2134
🌐 Web query:
actions/checkout@v4 persist-credentials default value💡 Result:
The default value for the persist-credentials input in actions/checkout@v4 is true [1][2]. When this option is set to true (the default), the action configures the Git repository with the provided authentication token (such as GITHUB_TOKEN) or SSH key in the local.git/config file [1][3]. This allows subsequent steps in the workflow to perform authenticated Git commands [1]. The token is removed during the post-job cleanup process [1]. To disable this behavior and prevent the credentials from being persisted in the local Git configuration, you must explicitly set the input to false: - uses: actions/checkout@v4 with: persist-credentials: false
Citations:
Harden third-party action usage in publish workflow.
actions/checkout@v4andastral-sh/setup-uv@v4are used unpinned (appears in bothrelease-checksandrelease-buildjobs).actions/checkout@v4credential persistence is not disabled (nopersist-credentials: falsein workflow; default istrue), weakening release supply-chain hardening.🔒 Suggested hardening diff
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 19-19: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): this step
(cache-poisoning)
🤖 Prompt for AI Agents