25441711719

Committed 06 May 2026 02:31PM UTC coverage: 92.915%. Remained the same

Build # 25441711719

Build Type

push

github

Committed by

web-flow

Commit Message

use sha pin (with comment) format for generated actions (#23312)

Per the GitHub Action best practices we recently enabled at #23249, we
should pin each action to a SHA so that the reference is actually
immutable.

This will -- I hope -- knock out a large chunk of the 421 alerts we
currently get from zizmor. The next followup would then be upgrades and
harmonizing the generated and none-generated pins.

Notice: This idea was suggested by Claude while going over pinact output
and I was surprised to see that post processing the yaml wasn't too
gross.

Coverage Stats

92206 of 99237 relevant lines covered (92.91%)

4.04 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

100.0

/src/python/pants/backend/python/providers/pyenv/custom_install/rules.py

# Copyright 2023 Pants project contributors (see CONTRIBUTORS.md).
# Licensed under the Apache License, Version 2.0 (see LICENSE).

import dataclasses
from dataclasses import dataclass
from textwrap import dedent  # noqa: PNT20

from pants.backend.python.providers.pyenv.custom_install.target_types import (
    PyenvInstallSentinelField,
)
from pants.backend.python.providers.pyenv.rules import (
    PyenvInstallInfoRequest,
    PyenvPythonProviderSubsystem,
    get_pyenv_install_info,
)
from pants.backend.python.providers.pyenv.rules import rules as pyenv_rules
from pants.core.goals.run import RunFieldSet, RunInSandboxBehavior, RunRequest
from pants.core.util_rules.external_tool import download_external_tool
from pants.core.util_rules.external_tool import rules as external_tools_rules
from pants.engine.fs import CreateDigest, FileContent
from pants.engine.internals.native_engine import MergeDigests
from pants.engine.internals.selectors import concurrently
from pants.engine.internals.synthetic_targets import SyntheticAddressMaps, SyntheticTargetsRequest
from pants.engine.internals.target_adaptor import TargetAdaptor
from pants.engine.intrinsics import create_digest, merge_digests
from pants.engine.platform import Platform
from pants.engine.rules import collect_rules, implicitly, rule
from pants.engine.unions import UnionRule
from pants.util.frozendict import FrozenDict


@dataclass(frozen=True)
class SyntheticPyenvTargetsRequest(SyntheticTargetsRequest):
    path: str = SyntheticTargetsRequest.SINGLE_REQUEST_FOR_ALL_TARGETS


@rule
async def make_synthetic_targets(request: SyntheticPyenvTargetsRequest) -> SyntheticAddressMaps:
    return SyntheticAddressMaps.for_targets_request(
        request,
        [
            (
                "BUILD.pyenv",
                (
                    TargetAdaptor(
                        "_pyenv_install",
                        name="pants-pyenv-install",
                        __description_of_origin__="the `pyenv` provider",
                    ),
                ),
            )
        ],
    )


@dataclass(frozen=True)
class RunPyenvInstallFieldSet(RunFieldSet):
    run_in_sandbox_behavior = RunInSandboxBehavior.NOT_SUPPORTED
    required_fields = (PyenvInstallSentinelField,)

    _sentinel: PyenvInstallSentinelField


@rule
async def run_pyenv_install(
    _: RunPyenvInstallFieldSet,
    platform: Platform,
    pyenv_subsystem: PyenvPythonProviderSubsystem,
) -> RunRequest:
    run_request, pyenv = await concurrently(
        get_pyenv_install_info(PyenvInstallInfoRequest(), **implicitly()),
        download_external_tool(pyenv_subsystem.get_request(platform)),
    )

    wrapper_script_digest = await create_digest(
        CreateDigest(
            [
                FileContent(
                    "run_install_python_shim.sh",
                    dedent(
                        f"""\
                        #!/usr/bin/env bash
                        set -e
                        cd "$CHROOT"
                        SPECIFIC_VERSION=$("{pyenv.exe}" latest --known $1)
                        {" ".join(run_request.args)} $SPECIFIC_VERSION
                        """
                    ).encode(),
                    is_executable=True,
                )
            ]
        )
    )
    digest = await merge_digests(MergeDigests([run_request.digest, wrapper_script_digest]))
    return dataclasses.replace(
        run_request,
        args=("{chroot}/run_install_python_shim.sh",),
        digest=digest,
        extra_env=FrozenDict(
            {
                "CHROOT": "{chroot}",
                **run_request.extra_env,
            }
        ),
    )


def rules():
    return (
        *collect_rules(),
        *external_tools_rules(),
        *pyenv_rules(),
        *RunPyenvInstallFieldSet.rules(),
        UnionRule(SyntheticTargetsRequest, SyntheticPyenvTargetsRequest),
    )

1	# Copyright 2023 Pants project contributors (see CONTRIBUTORS.md).
2	# Licensed under the Apache License, Version 2.0 (see LICENSE).
3
4	import dataclasses	1✔
5	from dataclasses import dataclass	1✔
6	from textwrap import dedent # noqa: PNT20	1✔
7
8	from pants.backend.python.providers.pyenv.custom_install.target_types import (	1✔
9	PyenvInstallSentinelField,
10	)
11	from pants.backend.python.providers.pyenv.rules import (	1✔
12	PyenvInstallInfoRequest,
13	PyenvPythonProviderSubsystem,
14	get_pyenv_install_info,
15	)
16	from pants.backend.python.providers.pyenv.rules import rules as pyenv_rules	1✔
17	from pants.core.goals.run import RunFieldSet, RunInSandboxBehavior, RunRequest	1✔
18	from pants.core.util_rules.external_tool import download_external_tool	1✔
19	from pants.core.util_rules.external_tool import rules as external_tools_rules	1✔
20	from pants.engine.fs import CreateDigest, FileContent	1✔
21	from pants.engine.internals.native_engine import MergeDigests	1✔
22	from pants.engine.internals.selectors import concurrently	1✔
23	from pants.engine.internals.synthetic_targets import SyntheticAddressMaps, SyntheticTargetsRequest	1✔
24	from pants.engine.internals.target_adaptor import TargetAdaptor	1✔
25	from pants.engine.intrinsics import create_digest, merge_digests	1✔
26	from pants.engine.platform import Platform	1✔
27	from pants.engine.rules import collect_rules, implicitly, rule	1✔
28	from pants.engine.unions import UnionRule	1✔
29	from pants.util.frozendict import FrozenDict	1✔
30
31
32	@dataclass(frozen=True)	1✔
33	class SyntheticPyenvTargetsRequest(SyntheticTargetsRequest):	1✔
34	path: str = SyntheticTargetsRequest.SINGLE_REQUEST_FOR_ALL_TARGETS	1✔
35
36
37	@rule	1✔
38	async def make_synthetic_targets(request: SyntheticPyenvTargetsRequest) -> SyntheticAddressMaps:	1✔
39	return SyntheticAddressMaps.for_targets_request(	1✔
40	request,
41	[
42	(
43	"BUILD.pyenv",
44	(
45	TargetAdaptor(
46	"_pyenv_install",
47	name="pants-pyenv-install",
48	__description_of_origin__="the `pyenv` provider",
49	),
50	),
51	)
52	],
53	)
54
55
56	@dataclass(frozen=True)	1✔
57	class RunPyenvInstallFieldSet(RunFieldSet):	1✔
58	run_in_sandbox_behavior = RunInSandboxBehavior.NOT_SUPPORTED	1✔
59	required_fields = (PyenvInstallSentinelField,)	1✔
60
61	_sentinel: PyenvInstallSentinelField
62
63
64	@rule	1✔
65	async def run_pyenv_install(	1✔
66	_: RunPyenvInstallFieldSet,
67	platform: Platform,
68	pyenv_subsystem: PyenvPythonProviderSubsystem,
69	) -> RunRequest:
70	run_request, pyenv = await concurrently(	1✔
71	get_pyenv_install_info(PyenvInstallInfoRequest(), **implicitly()),
72	download_external_tool(pyenv_subsystem.get_request(platform)),
73	)
74
75	wrapper_script_digest = await create_digest(	1✔
76	CreateDigest(
77	[
78	FileContent(
79	"run_install_python_shim.sh",
80	dedent(
81	f"""\
82	#!/usr/bin/env bash
83	set -e
84	cd "$CHROOT"
85	SPECIFIC_VERSION=$("{pyenv.exe}" latest --known $1)
86	{" ".join(run_request.args)} $SPECIFIC_VERSION
87	"""
88	).encode(),
89	is_executable=True,
90	)
91	]
92	)
93	)
94	digest = await merge_digests(MergeDigests([run_request.digest, wrapper_script_digest]))	1✔
95	return dataclasses.replace(	1✔
96	run_request,
97	args=("{chroot}/run_install_python_shim.sh",),
98	digest=digest,
99	extra_env=FrozenDict(
100	{
101	"CHROOT": "{chroot}",
102	**run_request.extra_env,
103	}
104	),
105	)
106
107
108	def rules():	1✔
109	return (	1✔
110	*collect_rules(),
111	*external_tools_rules(),
112	*pyenv_rules(),
113	*RunPyenvInstallFieldSet.rules(),
114	UnionRule(SyntheticTargetsRequest, SyntheticPyenvTargetsRequest),
115	)

pantsbuild / pants / 25441711719

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous