Update Python dependencies and secure GitHub Actions

.github/workflows/build_and_publish.yaml

@@ -4,6 +4,12 @@ on:
     branches:
       - main
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   tag-new-version:
     # This if condition acts as a safeguard against confusing tagging behaviour,
@@ -15,9 +21,10 @@ jobs:
       tag: ${{ steps.tag.outputs.new_tag }}
       version: ${{ steps.tag.outputs.new_version }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Bump version and push tag
         id: tag
         uses: mathieudutour/github-tag-action@a22cf08638b34d5badda920f9daf6e72c477b07b
@@ -35,9 +42,11 @@ jobs:
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
     - name: Set up Python 3.9
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: 3.9
 
@@ -47,14 +56,16 @@ jobs:
 
     - name: Generate correct value for VERSION file
       run: |
-        echo ${{ needs.tag-new-version.outputs.tag }} > osgithub/VERSION
+        echo ${NEEDS_TAG_NEW_VERSION_OUTPUTS_TAG} > osgithub/VERSION
+      env:
+        NEEDS_TAG_NEW_VERSION_OUTPUTS_TAG: ${{ needs.tag-new-version.outputs.tag }}
 
     - name: Build package
       run: |
         python setup.py sdist bdist_wheel
 
     - name: Publish package
-      uses: pypa/gh-action-pypi-publish@master
+      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
       if: needs.tag-new-version.outputs.tag
       with:
         user: __token__
@@ -64,41 +75,8 @@ jobs:
     # Release Assets for use in contexts where we have access to Github but not
     # to PyPI
     - name: Create release
-      id: create_release
-      uses: actions/create-release@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        tag_name: ${{ needs.tag-new-version.outputs.tag }}
-        release_name: ${{ needs.tag-new-version.outputs.tag }}
-        draft: false
-        prerelease: false
-
-    - name: Get release filenames
-      id: get_release_filenames
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        TAG: ${{ needs.tag-new-version.outputs.tag }}
       run: |
-        cd dist
-        whl_filename=$(ls *.whl | head -n 1)
-        sdist_filename=$(ls *.tar.gz | head -n 1)
-        echo "::set-output name=whl_filename::$whl_filename"
-        echo "::set-output name=sdist_filename::$sdist_filename"
-
-    - name: "Upload release asset: wheel"
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ steps.create_release.outputs.upload_url }}
-        asset_path: dist/${{ steps.get_release_filenames.outputs.whl_filename }}
-        asset_name: ${{ steps.get_release_filenames.outputs.whl_filename }}
-        asset_content_type: application/zip
-
-    - name: "Upload release asset: sdist"
-      uses: actions/upload-release-asset@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ steps.create_release.outputs.upload_url }}
-        asset_path: dist/${{ steps.get_release_filenames.outputs.sdist_filename }}
-        asset_name: ${{ steps.get_release_filenames.outputs.sdist_filename }}
-        asset_content_type: application/gzip
+        gh release create "$TAG" dist/*.whl dist/*.tar.gz --title "$TAG" --notes "" --verify-tag

.github/workflows/test.yml

@@ -4,13 +4,21 @@ name: CI
 on:
   push:
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
-      - uses: opensafely-core/setup-action@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: opensafely-core/setup-action@5b3030fbbcf069c94e352b4f0a94100fae4dbd82 # v1.6.1
         with:
           python-version: 3.9
           cache-dependency-path: requirements.*.txt
@@ -26,8 +34,10 @@ jobs:
         python-version: ["3.9", "3.10", "3.11", "3.12"]
 
     steps:
-      - uses: actions/checkout@v5
-      - uses: opensafely-core/setup-action@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: opensafely-core/setup-action@5b3030fbbcf069c94e352b4f0a94100fae4dbd82 # v1.6.1
         with:
           python-version: ${{ matrix.python-version }}
           cache-dependency-path: requirements.*.txt

DEVELOPERS.md

@@ -18,22 +18,24 @@ source <(just --completions bash)
 just #  shortcut for just --list
 ```
 
-
 ## Local development environment
 
-
 Set up a local development environment with:
-```
-just dev_setup
+
+```sh
+just devenv
 ```
 
 ## Tests
+
 Run the tests with:
-```
+
+```sh
 just test <args>
 ```
 
 Run only the non-integration tests (that don't call GitHub):
-```
+
+```sh
 just test '-m "not integration"'
 ```

README.md

@@ -3,109 +3,131 @@
 A thin wrapper around the GitHub API.
 
 ## Environment
+
 Set the following environment variables:
- - `GITHUB_USER_AGENT` - a string to identify your application
- - `GITHUB_TOKEN` - optional; default token to use.
- - `REQUESTS_CACHE_NAME` - optional, defaults to "http_cache"
+
+- `GITHUB_USER_AGENT` - a string to identify your application
+- `GITHUB_TOKEN` - optional; default token to use.
+- `REQUESTS_CACHE_NAME` - optional, defaults to "http_cache"
 
 ## Usage
 
 ### Create a client
-```
+
+```py
 from github_api_cache import GithubClient
 # Use the default token, if one is set in the environment.
 client = GithubClient()
 ```
 
 ### get a repo (returns a GithubRepo)
-```
+
+```py
 repo = client.get_repo("opensafely-core/osgithub")
 ```
 
 #### get a list of branches
-```
+
+```py
 repo.get_branches()
 ```
+
 And branch count:
-```
+
+```py
 repo.branch_count
 ```
 
 #### get a list of pull requests
+
 Provide a `page` argument to get more pages than just the first one (30 result are returned per page).
-```
+
+```py
 repo.get_pull_requests(page=1)
 ```
 
-By default, this fetches open PRs only.  To retrieve other states, pass `state="closed"` or `state="open"`
+By default, this fetches open PRs only. To retrieve other states, pass `state="closed"` or `state="open"`
 
 Pull request counts:
-```
+
+```py
 repo.pull_request_count
 repo.open_pull_request_count
 ```
 
 #### get the contents of the `osgithub` directory on branch `main`
-```
+
+```py
 # returns a list of GithubContentFile objects
 repo.get_contents("osgithub", "main")
 ```
 
 #### get a single file; returns a GithubContentFile
-```
+
+```py
 repo.get_contents("osgithub/__init__.py", "main")
 ```
 
 #### get_commits_for_file(self, path, ref, number_of_commits=1):
+
 Returns a list of commits, just the last one by default
-```
+
+```py
 repo.get_commits_for_file("osgithub", "main")
 ```
+
 To return more commits:
-```
+
+```py
 repo.get_commits_for_file("osgithub", "main", number_of_commits=10)
 ```
 
 Get details for a single commit by sha - returns author and date of the commit
-```
+
+```py
 repo.get_commit("7a6f60e8e74b9c93a9c6322b3151ee437fa4be61")
 ```
 
-
 #### Repo information
 
 Fetch the HTML from the README.md of repo:
-```
+
+```py
 repo.get_readme(tag="main")
 ```
 
 Fetch the About and Name of the repo:
-```
+
+```py
 repo.get_details()
 ```
 
 Fetch tags with name and sha:
-```
+
+```py
 repo.get_tags()
 ```
 
-
 ### Caching
+
 Requests can optionally be cached, using a sqlite backend.
 
 To use caching:
-```
+
+```py
 client = GithubClient(use_cache=True)
 ```
 
 Set a global expiry for the session (never expires by default):
-```
+
+```py
 # expire all cached requests after 300s
 client = GithubClient(expire_after=300)
 ```
 
 Set expiry on specific url patterns (falls back to `expire_after` if no match found)
-```
+
+```py
 urls_expire_after = {
     '*/pulls': 60,  # expire requests to get pull requests after 60 secs
     '*/branches': 60 * 5, # expire requests to get branches after 5 mins
@@ -115,7 +137,8 @@ client = GithubClient(urls_expire_after=urls_expire_after)
 ```
 
 #### Clear the cache for this repo
-```
+
+```py
 repo.clear_cache()
 ```
 

requirements.dev.in

@@ -8,6 +8,7 @@ black
 httpretty
 pip-tools
 pre-commit
+virtualenv<20.36
 pytest
 pytest-cov
 pytest-env