25441711719

Committed 06 May 2026 02:31PM UTC coverage: 92.915%. Remained the same

Build # 25441711719

Build Type

push

github

Committed by

web-flow

Commit Message

use sha pin (with comment) format for generated actions (#23312)

Per the GitHub Action best practices we recently enabled at #23249, we
should pin each action to a SHA so that the reference is actually
immutable.

This will -- I hope -- knock out a large chunk of the 421 alerts we
currently get from zizmor. The next followup would then be upgrades and
harmonizing the generated and none-generated pins.

Notice: This idea was suggested by Claude while going over pinact output
and I was surprised to see that post processing the yaml wasn't too
gross.

Coverage Stats

92206 of 99237 relevant lines covered (92.91%)

4.04 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.74

/src/python/pants/backend/python/goals/run_pex_binary.py

# Copyright 2020 Pants project contributors (see CONTRIBUTORS.md).
# Licensed under the Apache License, Version 2.0 (see LICENSE).

import os

from pants.backend.python.goals.package_pex_binary import (
    PexBinaryFieldSet,
    built_package_for_pex_from_targets_request,
    package_pex_binary,
)
from pants.backend.python.target_types import PexLayout
from pants.backend.python.util_rules.pex import find_interpreter
from pants.core.goals.run import RunRequest
from pants.engine.rules import collect_rules, implicitly, rule
from pants.util.logging import LogLevel


@rule(level=LogLevel.DEBUG)
async def create_pex_binary_run_request(field_set: PexBinaryFieldSet) -> RunRequest:
    pex_request = await package_pex_binary(field_set, **implicitly())
    built_pex = await built_package_for_pex_from_targets_request(field_set, **implicitly())

    # We need a Python executable to fulfil `adhoc_tool`/`runnable_dependency` requests
    # as sandboxed processes will not have a `python` available on the `PATH`.
    python = await find_interpreter(
        **implicitly(pex_request.request.to_interpreter_constraints_request())
    )

    relpath = built_pex.artifacts[0].relpath
    assert relpath is not None
    if field_set.layout.value != PexLayout.ZIPAPP.value:
        relpath = os.path.join(relpath, "__main__.py")

    return RunRequest(
        digest=built_pex.digest,
        args=[python.path, os.path.join("{chroot}", relpath)],
    )


# NB: Technically we could implement RunDebugAdapterRequest by using `debugpy`.
# However it is unclear how the user would be able to debug the code,
# as the client and server will disagree on the code's path.


def rules():
    return [
        *collect_rules(),
        *PexBinaryFieldSet.rules(),
    ]

1	# Copyright 2020 Pants project contributors (see CONTRIBUTORS.md).
2	# Licensed under the Apache License, Version 2.0 (see LICENSE).
3
4	import os	5✔
5
6	from pants.backend.python.goals.package_pex_binary import (	5✔
7	PexBinaryFieldSet,
8	built_package_for_pex_from_targets_request,
9	package_pex_binary,
10	)
11	from pants.backend.python.target_types import PexLayout	5✔
12	from pants.backend.python.util_rules.pex import find_interpreter	5✔
13	from pants.core.goals.run import RunRequest	5✔
14	from pants.engine.rules import collect_rules, implicitly, rule	5✔
15	from pants.util.logging import LogLevel	5✔
16
17
18	@rule(level=LogLevel.DEBUG)	5✔
19	async def create_pex_binary_run_request(field_set: PexBinaryFieldSet) -> RunRequest:	5✔
20	pex_request = await package_pex_binary(field_set, **implicitly())	1✔
21	built_pex = await built_package_for_pex_from_targets_request(field_set, **implicitly())	1✔
22
23	# We need a Python executable to fulfil `adhoc_tool`/`runnable_dependency` requests
24	# as sandboxed processes will not have a `python` available on the `PATH`.
25	python = await find_interpreter(	1✔
26	**implicitly(pex_request.request.to_interpreter_constraints_request())
27	)
28
29	relpath = built_pex.artifacts[0].relpath	1✔
30	assert relpath is not None	1✔
31	if field_set.layout.value != PexLayout.ZIPAPP.value:	1✔
32	relpath = os.path.join(relpath, "__main__.py")	×
33
34	return RunRequest(	1✔
35	digest=built_pex.digest,
36	args=[python.path, os.path.join("{chroot}", relpath)],
37	)
38
39
40	# NB: Technically we could implement RunDebugAdapterRequest by using `debugpy`.
41	# However it is unclear how the user would be able to debug the code,
42	# as the client and server will disagree on the code's path.
43
44
45	def rules():	5✔
46	return [	5✔
47	*collect_rules(),
48	*PexBinaryFieldSet.rules(),
49	]

pantsbuild / pants / 25441711719

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous