updates pre-commit and github action versions - #174
Conversation
Bumps the actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `actions/checkout` from 5 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v5...v6) Updates `pypa/gh-action-pypi-publish` from 1.4.2 to 1.14.0 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@27b3170...cef2210) Updates `codecov/codecov-action` from 5 to 6 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v5...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
…s-1d9c9f4d14 Bump the actions group with 3 updates
Assisted-by: OpenCode:BigPickle (glm-5.1)
Update github workflows & precommit to use pinned hashes instead of tags
Assisted-by: ClaudeCode:claude-sonnet-4-6
- Fixed output consistency — all calls use repr(), with the format conversion separated into a clear comment - Added "Parsing and Formatting" section heading (same ~~~~~ level as "Calendars") - Added Gregorian examples — French and Kinyarwanda to illustrate the multilingual support - Added holidays examples — Epiphany (fixed), Easter and Ash Wednesday (movable feasts) Assisted-by: ClaudeCode:claude-sonnet-4-6
Assisted-by: ClaudeCode:claude-sonnet-4-6
Assisted-by: ClaudeCode:claude-sonnet-4-6
Assisted-by: ClaudeCode:claude-sonnet-4-6
Assisted-by: ClaudeCode:claude-sonnet-4-6
Assisted-by: ClaudeCode:claude-sonnet-4-6
Revamp docs and add interactive python examples with sphinx-pyodide
|
Warning Review limit reached
Next review available in: 21 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (18)
WalkthroughThe pull request pins GitHub Actions, updates uv-based CI and publishing, refreshes development hooks, reworks Sphinx documentation with Pyodide support, adds usage documentation, revises the README, and prepares version 0.8.0.dev0 release metadata. ChangesCI and development tooling
Documentation platform and content
Release metadata
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🧹 Nitpick comments (1)
.github/workflows/python-publish.yml (1)
29-31: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPin the actual
uvversion used for releases.Pinning
setup-uvdoes not pin the installed uv binary. With noversioninput and norequired-versioninpyproject.toml, the build tool can drift to a newer release independently of this repository. Add an exact uv version here or in project configuration, and use the same pin in CI. (github.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/python-publish.yml around lines 29 - 31, Add an exact uv version pin to the setup-uv configuration in the release workflow, or define the equivalent required-version in pyproject.toml, so the installed uv binary cannot drift; ensure CI uses that same pinned version.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/python-publish.yml:
- Around line 35-38: Update the publishing job around the PyPI publish action to
restrict execution to releases or an enforced protected environment for manual
workflow_dispatch runs, preventing unrestricted branch-triggered publishing.
Configure the job permissions with id-token: write and migrate
pypa/gh-action-pypi-publish to Trusted Publishing by removing the user and
password inputs, including PYPI_API_TOKEN.
- Around line 29-31: Disable caching for the publishing job by adding the
explicit enable-cache: false setting to the with configuration of
astral-sh/setup-uv, while preserving the existing Python version.
In @.github/workflows/unit_tests.yml:
- Line 16: Update the path filter in the workflow trigger to use src/undate/**
so changes to the packaged source run python-unit, and include pyproject.toml
and uv.lock in the watched paths if dependency or project configuration changes
should also trigger it.
In `@CHANGELOG.md`:
- Around line 3-5: Replace the empty bullet under the “0.8” changelog heading
with the actual release notes for version 0.8, or remove the bullet entirely
until those notes are available. Keep the changelog entry valid and contentful.
In `@docs/conf.py`:
- Line 16: Update the sys.path insertion in docs/conf.py to use Path.cwd()
instead of Path().resolve(), preserving the existing path insertion behavior and
resolving the Ruff FURB177 violation.
In `@docs/example_usage.rst`:
- Line 89: Update the example print statement comparing november7_2020 and
november_2001 so its text label matches the comparison operator: retain the
existing “>” comparison and change “before” to “after”, or equivalently change
the operator to represent “before”.
- Around line 117-118: Update the inline descriptions for the before2000 and
after1900 UndateInterval examples to reflect inclusive boundaries: describe the
first as covering through 2000 and the second as starting from 1900.
- Line 202: Update the example around the y2k variable so its name matches the
parsed year: either change the Undate.parse input from "2001" to "2000" or
rename y2k to represent 2001, preserving the example’s intended behavior.
In `@README.md`:
- Around line 66-70: Update the Quick Start examples in README.md so both
result-producing expressions are wrapped in print(...), and change the displayed
list’s curly quotes to ASCII quotes while preserving the shown values.
---
Nitpick comments:
In @.github/workflows/python-publish.yml:
- Around line 29-31: Add an exact uv version pin to the setup-uv configuration
in the release workflow, or define the equivalent required-version in
pyproject.toml, so the installed uv binary cannot drift; ensure CI uses that
same pinned version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 72205aad-bd6e-4311-8894-03a9b214603e
⛔ Files ignored due to path filters (2)
docs/_static/undate_logo.svgis excluded by!**/*.svgdocs/_static/undate_logo_dark.svgis excluded by!**/*.svg
📒 Files selected for processing (13)
.github/workflows/check.yml.github/workflows/python-publish.yml.github/workflows/unit_tests.yml.pre-commit-config.yamlCHANGELOG.mdREADME.mddocs/_static/custom.cssdocs/conf.pydocs/example_usage.rstdocs/index.rstdocs/readme.mdpyproject.tomlsrc/undate/__init__.py
💤 Files with no reviewable changes (1)
- docs/readme.md
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | ||
| with: | ||
| python-version: "3.12" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
sed -n '1,120p' .github/workflows/python-publish.yml 2>/dev/null || true
echo
echo "== setup-uv references =="
rg -n "astral-sh/setup-uv|enable-cache|cache" .github/workflows -S || true
echo
echo "== setup-uv repo README default snippets from available commit/tag if network ok =="
if command -v gh >/dev/null 2>&1; then
TAG="v9.0.0"
echo "Fetching tag ref for astral-sh/setup-uv @ $TAG"
gh api repos/astral-sh/setup-uv/git/ref "tags/$TAG" 2>/dev/null | jq -r '.object.sha, .object.type' || true
COMMIT=$(gh api repos/astral-sh/setup-uv/git/ref "tags/$TAG" 2>/dev/null | jq -r 'if .object.type=="tag" then .object.sha else .object.object.shasum end' 2>/dev/null || true)
echo "Resolved commit-ish: $COMMIT"
if [ -n "$COMMIT" ]; then
gh api repos/astral-sh/setup-uv/git/trees/"$COMMIT?recursive=1" 2>/dev/null \
| jq -r '.tree[]? | select(.path|test("README\\.md|README.md|dist/index.js|input\\.jsonschema|package\\.json")) | .path, .type, .sha' || true
gh api repos/astral-sh/setup-uv/contents/README.md?ref="$COMMIT" 2>/dev/null \
| jq -r '.content | `@base64d`' | rg -n -C 2 "enable-cache|cache|cache-default|cache" || true
fi
else
echo "gh CLI not available"
fiRepository: dh-tech/undate-python
Length of output: 2189
🌐 Web query:
astral-sh/setup-uv v9.0.0 enable-cache default auto README
💡 Result:
In astral-sh/setup-uv v9.0.0, the enable-cache input retains its default value of "auto" [1][2]. This setting enables caching on GitHub-hosted runners and disables it on self-hosted runners [1][3]. The primary change to caching behavior in v9.0.0 was a breaking change to the prune-cache input, which now defaults to false (previously true) [4][5]. This change was implemented to reduce unnecessary load on PyPI infrastructure by preventing the premature removal of pre-built wheels from the cache [4][6]. Key details regarding caching configuration: - enable-cache: Default is "auto", with options for "true", "false", or "auto" [7][1]. - prune-cache: Default is now "false" [4][2]. - Official documentation provides further details on managing cache dependencies and behavior in the docs/caching.md file [8].
Citations:
- 1: https://github.com/astral-sh/setup-uv/blob/main/README.md
- 2: https://github.com/astral-sh/setup-uv?tab=readme-ov-file
- 3: https://github.com/astral-sh/setup-uv/blob/224c887d/docs/caching.md
- 4: https://github.com/astral-sh/setup-uv/releases/tag/v9.0.0
- 5: https://newreleases.io/project/github/astral-sh/setup-uv/release/v9.0.0
- 6: Default prune-cache: true causes unnecessary PyPI downloads for pre-built wheels astral-sh/setup-uv#745
- 7: https://deepwiki.com/astral-sh/setup-uv/4-configuration-reference
- 8: https://github.com/astral-sh/setup-uv/blob/main/docs/caching.md
🌐 Web query:
GitHub Actions third-party action cached variables poisoned cache trusted workflows
💡 Result:
Cache poisoning in GitHub Actions is a supply-chain attack where an attacker injects malicious content into the shared action cache, which is subsequently executed by a more privileged workflow (such as a release or deployment pipeline) [1][2][3]. Because cache entries are repository-scoped rather than workflow-scoped, they can be read by any workflow triggered on the same branch [1][3]. As of June 26, 2026, GitHub has implemented a significant security mitigation: workflows triggered by untrusted events (e.g., pull_request_target, issue_comment, and fork-PR workflow_run cascades) now receive read-only access to the default-branch cache [4][5]. This prevents these untrusted contexts from overwriting or poisoning cache entries intended for use by trusted workflows like push or schedule [4]. Key security considerations include: 1. Trusted Workflows and Triggers: While the recent read-only change mitigates the most common public-to-private poisoning vectors, trusted workflows themselves remain a risk [5]. If a workflow that has write access to the cache is itself influenced by untrusted inputs (e.g., a workflow on the default branch that checks out untrusted PR code), it can still serve as a vehicle for cache poisoning [6][4][5]. 2. Third-Party Actions: Using third-party actions introduces the risk that a compromised action could manipulate cache writes [7]. All third-party actions should be pinned to a specific commit SHA, not a mutable tag or branch, to prevent attackers from injecting malicious code by re-tagging (e.g., moving a v4 tag) [8][7][9]. 3. Defense-in-Depth: - Segregate Cache Keys: Use distinct prefixes for cache keys based on the trust level of the workflow (e.g., pr- vs. release-) to ensure that PR-triggered workflows cannot overwrite or satisfy the cache keys used by release workflows [5][10][3]. - Disable Caching in Critical Jobs: For highly sensitive jobs like publishing or releases, consider disabling caching entirely or using lookup-only mode to prevent the accidental execution of potentially malicious cached dependencies [5][9][11]. - Audit and Governance: Regularly audit workflows for the use of privileged triggers (pull_request_target) combined with untrusted checkout commands [6][10]. Automated tools and linters (such as CodeQL or custom security policies) can help identify these patterns [10][12][11]. While the June 2026 update addresses the most direct cross-boundary poisoning paths, the fundamental principle remains: treat the cache as an unsigned, potentially untrusted input that should never be implicitly trusted in high-privilege execution contexts [5][9].
Citations:
- 1: https://codeql.github.com/codeql-query-help/actions/actions-cache-poisoning-direct-cache/
- 2: https://safeguard.sh/resources/blog/github-actions-cache-poisoning-attack-class-2025
- 3: https://hivesecurity.gitlab.io/blog/github-actions-cache-poisoning-supply-chain/
- 4: https://github.blog/changelog/2026-06-26-read-only-actions-cache-for-untrusted-triggers/
- 5: https://www.trackr.live/2026/07/17/github-actions-cache-poisoning-tanstack-detection/
- 6: https://sisaku-security.github.io/lint/docs/ghsl/ghsl-2025-082/
- 7: https://github.com/kerberosmansour/hulumi/blob/main/docs/threat-model-examples/github-actions-supply-chain.md
- 8: https://neciudan.dev/github-actions-poisoning
- 9: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
- 10: https://www.trackr.live/2026/06/27/github-actions-cache-poisoning-fork-trust-boundary/
- 11: https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/cicd-github-cache-poisoning/
- 12: https://docs.openrewrite.org/recipes/github/security/cachepoisoning
Disable uv caching in the publishing job.
The release workflow uses astral-sh/setup-uv with its default enable-cache: auto, which enables caching on GitHub-hosted runners. Keep cache-free for release builds by setting enable-cache: false explicitly.
🧰 Tools
🪛 zizmor (1.28.0)
[error] 29-29: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/python-publish.yml around lines 29 - 31, Disable caching
for the publishing job by adding the explicit enable-cache: false setting to the
with configuration of astral-sh/setup-uv, while preserving the existing Python
version.
Sources: MCP tools, Linters/SAST tools
| uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 | ||
| with: | ||
| user: __token__ | ||
| password: ${{ secrets.PYPI_API_TOKEN }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Changed/workflow files:"
git ls-files '.github/workflows/*' || true
echo
echo "python-publish.yml:"
if [ -f .github/workflows/python-publish.yml ]; then
nl -ba .github/workflows/python-publish.yml | sed -n '1,140p'
else
echo "missing .github/workflows/python-publish.yml"
fi
echo
echo "Search for PYPI_API_TOKEN and python-publish reference:"
rg -n "PYPI_API_TOKEN|gh-action-pypi-publish|pypa|workflow_dispatch|environment:" .github workflows 2>/dev/null || true
echo
echo "Tag/sha check if remote available:"
if command -v gh >/dev/null 2>&1; then
set +e
gh api --method GET -H "Accept: application/vnd.github+json" repos/dh-tech/undate-python/git/ref/heads/feature/updates >/tmp/feature_ref.json 2>/tmp/feature_ref.err || true
cat /tmp/feature_ref.err >&2
gh api -H "Accept: application/vnd.github+json" /tmp/feature_ref.json && true
set -e
echo
tag_ref=$(gh api -H "Accept: application/vnd.github+json" repos/dh-tech/undate-python/git/ref/tags/v1.14.2 2>/tmp/tag_ref.err || cat /tmp/tag_ref.err)
echo "tag_ref=$tag_ref"
gh api -H "Accept: application/vnd.github+json" "repos/dh-tech/undate-python/git/ref/tags/v1.14.2" || true
else
echo "gh not available"
fiRepository: dh-tech/undate-python
Length of output: 343
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,180p' .github/workflows/python-publish.yml
echo
echo "Search for publishing inputs/secrets:"
rg -n "PYPI_API_TOKEN|gh-action-pypi-publish|pypa|workflow_dispatch|environment:|permissions:|on:|release|if:" .github/workflows/python-publish.yml .github/workflows 2>/dev/null || trueRepository: dh-tech/undate-python
Length of output: 3631
Gate manual publishing and remove the long-lived PyPI token.
workflow_dispatch can launch this workflow from branches, and PYPI_API_TOKEN is still passed into gh-action-pypi-publish. Only publish on release or enforced workflow_dispatch protection (e.g. protected environment/restriction), and migrate to PyPI Trusted Publishing with id-token: write instead of user/password.
🧰 Tools
🪛 zizmor (1.28.0)
[info] 35-35: prefer trusted publishing for authentication (use-trusted-publishing): this step
(use-trusted-publishing)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/python-publish.yml around lines 35 - 38, Update the
publishing job around the PyPI publish action to restrict execution to releases
or an enforced protected environment for manual workflow_dispatch runs,
preventing unrestricted branch-triggered publishing. Configure the job
permissions with id-token: write and migrate pypa/gh-action-pypi-publish to
Trusted Publishing by removing the user and password inputs, including
PYPI_API_TOKEN.
Source: MCP tools
| ## 0.8 | ||
|
|
||
| - |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Replace the empty placeholder with actual release notes.
Line [5] leaves a malformed, content-free changelog entry. Add the 0.8 changes, or omit the bullet until they are ready.
Suggested fix
## 0.8
--
+- Document the changes included in the 0.8 development cycle.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ## 0.8 | |
| - | |
| ## 0.8 | |
| - Document the changes included in the 0.8 development cycle. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CHANGELOG.md` around lines 3 - 5, Replace the empty bullet under the “0.8”
changelog heading with the actual release notes for version 0.8, or remove the
bullet entirely until those notes are available. Keep the changelog entry valid
and contentful.
| before2000 = UndateInterval(latest=Undate(2000)) # before 2000 | ||
| after1900 = UndateInterval(Undate(1900)) # after 1900 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Correct the open-ended interval descriptions.
These intervals are inclusive, so latest=Undate(2000) includes 2000 and UndateInterval(Undate(1900)) starts at 1900. Use wording such as “through 2000” and “from 1900” instead of “before” and “after”.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/example_usage.rst` around lines 117 - 118, Update the inline
descriptions for the before2000 and after1900 UndateInterval examples to reflect
inclusive boundaries: describe the first as covering through 2000 and the second
as starting from 1900.
|
Check out this pull request on See visual diffs & provide feedback on Jupyter Notebooks. Powered by ReviewNB |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| assert udelt1 != udelt2 | ||
| # equal to self | ||
| assert udelt1 is udelt1 | ||
| assert udelt1 is udelt1 # noqa: PLR0124 |
| # an interval DOES contain itself | ||
| for interval in [century11th, century20th, decade1990s]: | ||
| assert interval in interval | ||
| assert interval in interval # noqa: PLR0124 |
| # NOTE: an interval contains itself or an equivalent interval, | ||
| # but that may not make sense for open intervals... | ||
| assert whenever in whenever | ||
| assert whenever in whenever # noqa: PLR0124 |
1 participant
Summary by CodeRabbit