25441711719

Committed 06 May 2026 02:31PM UTC coverage: 92.915%. Remained the same

Build # 25441711719

Build Type

push

github

Committed by

web-flow

Commit Message

use sha pin (with comment) format for generated actions (#23312)

Per the GitHub Action best practices we recently enabled at #23249, we
should pin each action to a SHA so that the reference is actually
immutable.

This will -- I hope -- knock out a large chunk of the 421 alerts we
currently get from zizmor. The next followup would then be upgrades and
harmonizing the generated and none-generated pins.

Notice: This idea was suggested by Claude while going over pinact output
and I was surprised to see that post processing the yaml wasn't too
gross.

Coverage Stats

92206 of 99237 relevant lines covered (92.91%)

4.04 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

100.0

/src/python/pants/backend/javascript/run/rules.py

# Copyright 2023 Pants project contributors (see CONTRIBUTORS.md).
# Licensed under the Apache License, Version 2.0 (see LICENSE).
from __future__ import annotations

from collections.abc import Iterable
from dataclasses import dataclass

from pants.backend.javascript import install_node_package
from pants.backend.javascript.install_node_package import (
    InstalledNodePackageRequest,
    add_sources_to_installed_node_package,
)
from pants.backend.javascript.nodejs_project_environment import (
    NodeJsProjectEnvironmentProcess,
    setup_nodejs_project_environment_process,
)
from pants.backend.javascript.package_json import (
    NodeBuildScriptEntryPointField,
    NodeBuildScriptExtraEnvVarsField,
    NodePackageDependenciesField,
    NodeRunScriptEntryPointField,
    NodeRunScriptExtraEnvVarsField,
)
from pants.core.environments.target_types import EnvironmentField
from pants.core.goals.run import RunFieldSet, RunInSandboxBehavior, RunRequest
from pants.core.util_rules.env_vars import environment_vars_subset
from pants.engine.env_vars import EnvironmentVarsRequest
from pants.engine.rules import Rule, collect_rules, implicitly, rule
from pants.engine.unions import UnionRule


@dataclass(frozen=True)
class RunNodeBuildScriptFieldSet(RunFieldSet):
    required_fields = (NodeBuildScriptEntryPointField, NodePackageDependenciesField)
    run_in_sandbox_behavior = RunInSandboxBehavior.RUN_REQUEST_HERMETIC

    entry_point: NodeBuildScriptEntryPointField
    extra_env_vars: NodeBuildScriptExtraEnvVarsField
    environment: EnvironmentField


@dataclass(frozen=True)
class RunNodeScriptFieldSet(RunFieldSet):
    required_fields = (NodeRunScriptEntryPointField, NodePackageDependenciesField)
    run_in_sandbox_behavior = RunInSandboxBehavior.RUN_REQUEST_HERMETIC

    entry_point: NodeRunScriptEntryPointField
    extra_env_vars: NodeRunScriptExtraEnvVarsField
    environment: EnvironmentField


@rule
async def run_node_script(
    field_set: RunNodeScriptFieldSet,
) -> RunRequest:
    installation = await add_sources_to_installed_node_package(
        InstalledNodePackageRequest(field_set.address)
    )
    target_env_vars = await environment_vars_subset(
        EnvironmentVarsRequest(field_set.extra_env_vars.value or ()), **implicitly()
    )
    package_dir = "{chroot}" + "/" + installation.project_env.package_dir()

    process = await setup_nodejs_project_environment_process(
        NodeJsProjectEnvironmentProcess(
            installation.project_env,
            args=(
                *installation.package_manager.current_directory_args,
                package_dir,
                "run",
                str(field_set.entry_point.value),
            ),
            description=f"Running {str(field_set.entry_point.value)}.",
            input_digest=installation.digest,
            extra_env=target_env_vars,
        ),
        **implicitly(),
    )

    return RunRequest(
        digest=process.input_digest,
        args=process.argv,
        extra_env=process.env,
        immutable_input_digests=process.immutable_input_digests,
    )


@rule
async def run_node_build_script(
    field_set: RunNodeBuildScriptFieldSet,
) -> RunRequest:
    installation = await add_sources_to_installed_node_package(
        InstalledNodePackageRequest(field_set.address)
    )
    target_env_vars = await environment_vars_subset(
        EnvironmentVarsRequest(field_set.extra_env_vars.value or ()), **implicitly()
    )
    package_dir = "{chroot}" + "/" + installation.project_env.package_dir()

    process = await setup_nodejs_project_environment_process(
        NodeJsProjectEnvironmentProcess(
            installation.project_env,
            args=(
                *installation.package_manager.current_directory_args,
                package_dir,
                "run",
                str(field_set.entry_point.value),
            ),
            description=f"Running {str(field_set.entry_point.value)}.",
            input_digest=installation.digest,
            extra_env=target_env_vars,
        ),
        **implicitly(),
    )

    return RunRequest(
        digest=process.input_digest,
        args=process.argv,
        extra_env=process.env,
        immutable_input_digests=process.immutable_input_digests,
    )


def rules() -> Iterable[Rule | UnionRule]:
    return [
        *collect_rules(),
        *install_node_package.rules(),
        *RunNodeBuildScriptFieldSet.rules(),
        *RunNodeScriptFieldSet.rules(),
    ]

1	# Copyright 2023 Pants project contributors (see CONTRIBUTORS.md).
2	# Licensed under the Apache License, Version 2.0 (see LICENSE).
3	from __future__ import annotations	1✔
4
5	from collections.abc import Iterable	1✔
6	from dataclasses import dataclass	1✔
7
8	from pants.backend.javascript import install_node_package	1✔
9	from pants.backend.javascript.install_node_package import (	1✔
10	InstalledNodePackageRequest,
11	add_sources_to_installed_node_package,
12	)
13	from pants.backend.javascript.nodejs_project_environment import (	1✔
14	NodeJsProjectEnvironmentProcess,
15	setup_nodejs_project_environment_process,
16	)
17	from pants.backend.javascript.package_json import (	1✔
18	NodeBuildScriptEntryPointField,
19	NodeBuildScriptExtraEnvVarsField,
20	NodePackageDependenciesField,
21	NodeRunScriptEntryPointField,
22	NodeRunScriptExtraEnvVarsField,
23	)
24	from pants.core.environments.target_types import EnvironmentField	1✔
25	from pants.core.goals.run import RunFieldSet, RunInSandboxBehavior, RunRequest	1✔
26	from pants.core.util_rules.env_vars import environment_vars_subset	1✔
27	from pants.engine.env_vars import EnvironmentVarsRequest	1✔
28	from pants.engine.rules import Rule, collect_rules, implicitly, rule	1✔
29	from pants.engine.unions import UnionRule	1✔
30
31
32	@dataclass(frozen=True)	1✔
33	class RunNodeBuildScriptFieldSet(RunFieldSet):	1✔
34	required_fields = (NodeBuildScriptEntryPointField, NodePackageDependenciesField)	1✔
35	run_in_sandbox_behavior = RunInSandboxBehavior.RUN_REQUEST_HERMETIC	1✔
36
37	entry_point: NodeBuildScriptEntryPointField	1✔
38	extra_env_vars: NodeBuildScriptExtraEnvVarsField	1✔
39	environment: EnvironmentField	1✔
40
41
42	@dataclass(frozen=True)	1✔
43	class RunNodeScriptFieldSet(RunFieldSet):	1✔
44	required_fields = (NodeRunScriptEntryPointField, NodePackageDependenciesField)	1✔
45	run_in_sandbox_behavior = RunInSandboxBehavior.RUN_REQUEST_HERMETIC	1✔
46
47	entry_point: NodeRunScriptEntryPointField	1✔
48	extra_env_vars: NodeRunScriptExtraEnvVarsField	1✔
49	environment: EnvironmentField	1✔
50
51
52	@rule	1✔
53	async def run_node_script(	1✔
54	field_set: RunNodeScriptFieldSet,
55	) -> RunRequest:
56	installation = await add_sources_to_installed_node_package(	1✔
57	InstalledNodePackageRequest(field_set.address)
58	)
59	target_env_vars = await environment_vars_subset(	1✔
60	EnvironmentVarsRequest(field_set.extra_env_vars.value or ()), **implicitly()
61	)
62	package_dir = "{chroot}" + "/" + installation.project_env.package_dir()	1✔
63
64	process = await setup_nodejs_project_environment_process(	1✔
65	NodeJsProjectEnvironmentProcess(
66	installation.project_env,
67	args=(
68	*installation.package_manager.current_directory_args,
69	package_dir,
70	"run",
71	str(field_set.entry_point.value),
72	),
73	description=f"Running {str(field_set.entry_point.value)}.",
74	input_digest=installation.digest,
75	extra_env=target_env_vars,
76	),
77	**implicitly(),
78	)
79
80	return RunRequest(	1✔
81	digest=process.input_digest,
82	args=process.argv,
83	extra_env=process.env,
84	immutable_input_digests=process.immutable_input_digests,
85	)
86
87
88	@rule	1✔
89	async def run_node_build_script(	1✔
90	field_set: RunNodeBuildScriptFieldSet,
91	) -> RunRequest:
92	installation = await add_sources_to_installed_node_package(	1✔
93	InstalledNodePackageRequest(field_set.address)
94	)
95	target_env_vars = await environment_vars_subset(	1✔
96	EnvironmentVarsRequest(field_set.extra_env_vars.value or ()), **implicitly()
97	)
98	package_dir = "{chroot}" + "/" + installation.project_env.package_dir()	1✔
99
100	process = await setup_nodejs_project_environment_process(	1✔
101	NodeJsProjectEnvironmentProcess(
102	installation.project_env,
103	args=(
104	*installation.package_manager.current_directory_args,
105	package_dir,
106	"run",
107	str(field_set.entry_point.value),
108	),
109	description=f"Running {str(field_set.entry_point.value)}.",
110	input_digest=installation.digest,
111	extra_env=target_env_vars,
112	),
113	**implicitly(),
114	)
115
116	return RunRequest(	1✔
117	digest=process.input_digest,
118	args=process.argv,
119	extra_env=process.env,
120	immutable_input_digests=process.immutable_input_digests,
121	)
122
123
124	def rules() -> Iterable[Rule \| UnionRule]:	1✔
125	return [	1✔
126	*collect_rules(),
127	*install_node_package.rules(),
128	*RunNodeBuildScriptFieldSet.rules(),
129	*RunNodeScriptFieldSet.rules(),
130	]

pantsbuild / pants / 25441711719

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous