Skip to content

v0.7.2 — pip-audit fix + dev container network diagnostics

Latest
Latest

Choose a tag to compare

View all tags
@AJ-EthereaLogic-ai AJ-EthereaLogic-ai released this 08 May 20:24
· 33 commits to main since this release
v0.7.2
b875ef1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A patch release fixing a CI workflow regression that has been silently breaking every Python / polyglot scaffold since v0.4.0, plus a much friendlier error path when the dev container's outbound network is blocked.

Fixes

  • #100 fix(template): pip-audit pyproject.toml parsing + dev-container network diagnostics.
    • Supply-chain audit workflow now actually runs. pypa/gh-action-pip-audit passes the inputs: parameter to pip-audit's --requirement flag, which only understands requirements.txt format. The workflow was passing pyproject.toml directly, failing on the first [project] TOML header. Fix: export uv's resolved lock via uv export --no-emit-project --no-hashes --format requirements-txt and audit the resulting file. Pre-existing on every project rendered from v0.4.0 through v0.7.1.
    • post-create.sh now diagnoses outbound-network blocks up front. When VS Code's Restricted Network Access, Codespaces' restricted-internet policy, GitHub Copilot Coding Agent's outbound firewall, or a corporate proxy blocks the container, every downstream apt-get, uv, npm, and gh call fails with a tool-specific cryptic error. The new check_outbound_network step probes pypi.org and, on failure, prints the four common 2026 causes plus a pointer to KNOWN-ISSUES.md. Non-fatal — legitimate offline flows keep working.
    • KNOWN-ISSUES.md adds a "Dev container internet access blocked" entry with declarative remediation snippets for each cause (VS Code trust dialog, Codespaces firewall, .github/copilot/firewall.yml, containerEnv proxy passthrough).

Why this matters for adopters

Anyone scaffolding a Python or polyglot project from v0.4.0 through v0.7.1 has a Supply-chain audit workflow that fails on every push. The fix is a one-step CI workflow change; no application code is affected.

Anyone hitting "no internet in the dev container" now gets a single clear diagnostic and a documented remediation path instead of chasing tool-specific symptoms.

Upgrade

For copier-rendered projects:

copier update --trust --skip-answered --vcs-ref v0.7.2

For cookiecutter-rendered projects, no in-place upgrade flow ships; either re-render and merge per docs/UPDATING.md, or cherry-pick the three changed files (.github/workflows/supply-chain.yml, .devcontainer/post-create.sh, KNOWN-ISSUES.md).

Full diff: v0.7.1...v0.7.2

Assets 2
Loading