25441711719

Committed 06 May 2026 02:31PM UTC coverage: 92.915%. Remained the same

Build # 25441711719

Build Type

push

github

Committed by

web-flow

Commit Message

use sha pin (with comment) format for generated actions (#23312)

Per the GitHub Action best practices we recently enabled at #23249, we
should pin each action to a SHA so that the reference is actually
immutable.

This will -- I hope -- knock out a large chunk of the 421 alerts we
currently get from zizmor. The next followup would then be upgrades and
harmonizing the generated and none-generated pins.

Notice: This idea was suggested by Claude while going over pinact output
and I was surprised to see that post processing the yaml wasn't too
gross.

Coverage Stats

92206 of 99237 relevant lines covered (92.91%)

4.04 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

100.0

/src/python/pants/backend/python/util_rules/pex_venv.py

# Copyright 2023 Pants project contributors (see CONTRIBUTORS.md).
# Licensed under the Apache License, Version 2.0 (see LICENSE).
from __future__ import annotations

from dataclasses import dataclass
from enum import Enum
from pathlib import Path

from pants.backend.python.util_rules import pex_cli
from pants.backend.python.util_rules.pex import CompletePlatforms, Pex, PexPlatforms
from pants.backend.python.util_rules.pex_cli import PexCliProcess
from pants.engine.fs import Digest
from pants.engine.internals.native_engine import MergeDigests
from pants.engine.intrinsics import merge_digests
from pants.engine.process import fallible_to_exec_result_or_raise
from pants.engine.rules import collect_rules, implicitly, rule


class PexVenvLayout(Enum):
    VENV = "venv"
    FLAT = "flat"
    FLAT_ZIPPED = "flat-zipped"


@dataclass(frozen=True)
class PexVenvRequest:
    pex: Pex
    layout: PexVenvLayout
    output_path: Path
    description: str

    platforms: PexPlatforms = PexPlatforms()
    complete_platforms: CompletePlatforms = CompletePlatforms()
    prefix: None | str = None
    extra_args: tuple[str, ...] = ()


@dataclass(frozen=True)
class PexVenv:
    digest: Digest
    path: Path


@rule
async def pex_venv(request: PexVenvRequest) -> PexVenv:
    # TODO: create the output with a fixed name and then rename
    # (https://github.com/pantsbuild/pants/issues/15102)
    if request.layout is PexVenvLayout.FLAT_ZIPPED:
        # --layout=flat-zipped takes --dest-dir=foo and zips it up to `foo.zip`, so we cannot
        # directly control the full path until we do a rename
        if request.output_path.suffix != ".zip":
            raise ValueError(
                f"layout=FLAT_ZIPPED requires output_path to end in '.zip', but found output_path='{request.output_path}' ending in {request.output_path.suffix!r}"
            )
        dest_dir = request.output_path.with_suffix("")
        output_files = [str(request.output_path)]
        output_directories = []
    else:
        dest_dir = request.output_path
        output_files = []
        output_directories = [str(request.output_path)]

    input_digest = await merge_digests(
        MergeDigests([request.pex.digest, request.complete_platforms.digest])
    )
    result = await fallible_to_exec_result_or_raise(
        **implicitly(
            PexCliProcess(
                subcommand=("venv", "create"),
                extra_args=(
                    f"--dest-dir={dest_dir}",
                    f"--pex-repository={request.pex.name}",
                    f"--layout={request.layout.value}",
                    *((f"--prefix={request.prefix}",) if request.prefix is not None else ()),
                    # NB. Specifying more than one of these args doesn't make sense for `venv
                    # create`. Incorrect usage will be surfaced as a subprocess failure.
                    *request.platforms.generate_pex_arg_list(),
                    *request.complete_platforms.generate_pex_arg_list(),
                    *request.extra_args,
                ),
                additional_input_digest=input_digest,
                output_files=output_files,
                output_directories=output_directories,
                description=request.description,
            )
        )
    )
    return PexVenv(digest=result.output_digest, path=request.output_path)


def rules():
    return [*collect_rules(), *pex_cli.rules()]

1	# Copyright 2023 Pants project contributors (see CONTRIBUTORS.md).
2	# Licensed under the Apache License, Version 2.0 (see LICENSE).
3	from __future__ import annotations	6✔
4
5	from dataclasses import dataclass	6✔
6	from enum import Enum	6✔
7	from pathlib import Path	6✔
8
9	from pants.backend.python.util_rules import pex_cli	6✔
10	from pants.backend.python.util_rules.pex import CompletePlatforms, Pex, PexPlatforms	6✔
11	from pants.backend.python.util_rules.pex_cli import PexCliProcess	6✔
12	from pants.engine.fs import Digest	6✔
13	from pants.engine.internals.native_engine import MergeDigests	6✔
14	from pants.engine.intrinsics import merge_digests	6✔
15	from pants.engine.process import fallible_to_exec_result_or_raise	6✔
16	from pants.engine.rules import collect_rules, implicitly, rule	6✔
17
18
19	class PexVenvLayout(Enum):	6✔
20	VENV = "venv"	6✔
21	FLAT = "flat"	6✔
22	FLAT_ZIPPED = "flat-zipped"	6✔
23
24
25	@dataclass(frozen=True)	6✔
26	class PexVenvRequest:	6✔
27	pex: Pex	6✔
28	layout: PexVenvLayout	6✔
29	output_path: Path	6✔
30	description: str	6✔
31
32	platforms: PexPlatforms = PexPlatforms()	6✔
33	complete_platforms: CompletePlatforms = CompletePlatforms()	6✔
34	prefix: None \| str = None	6✔
35	extra_args: tuple[str, ...] = ()	6✔
36
37
38	@dataclass(frozen=True)	6✔
39	class PexVenv:	6✔
40	digest: Digest	6✔
41	path: Path	6✔
42
43
44	@rule	6✔
45	async def pex_venv(request: PexVenvRequest) -> PexVenv:	6✔
46	# TODO: create the output with a fixed name and then rename
47	# (https://github.com/pantsbuild/pants/issues/15102)
48	if request.layout is PexVenvLayout.FLAT_ZIPPED:	3✔
49	# --layout=flat-zipped takes --dest-dir=foo and zips it up to `foo.zip`, so we cannot
50	# directly control the full path until we do a rename
51	if request.output_path.suffix != ".zip":	3✔
52	raise ValueError(	1✔
53	f"layout=FLAT_ZIPPED requires output_path to end in '.zip', but found output_path='{request.output_path}' ending in {request.output_path.suffix!r}"
54	)
55	dest_dir = request.output_path.with_suffix("")	3✔
56	output_files = [str(request.output_path)]	3✔
57	output_directories = []	3✔
58	else:
59	dest_dir = request.output_path	1✔
60	output_files = []	1✔
61	output_directories = [str(request.output_path)]	1✔
62
63	input_digest = await merge_digests(	3✔
64	MergeDigests([request.pex.digest, request.complete_platforms.digest])
65	)
66	result = await fallible_to_exec_result_or_raise(	3✔
67	**implicitly(
68	PexCliProcess(
69	subcommand=("venv", "create"),
70	extra_args=(
71	f"--dest-dir={dest_dir}",
72	f"--pex-repository={request.pex.name}",
73	f"--layout={request.layout.value}",
74	*((f"--prefix={request.prefix}",) if request.prefix is not None else ()),
75	# NB. Specifying more than one of these args doesn't make sense for `venv
76	# create`. Incorrect usage will be surfaced as a subprocess failure.
77	*request.platforms.generate_pex_arg_list(),
78	*request.complete_platforms.generate_pex_arg_list(),
79	*request.extra_args,
80	),
81	additional_input_digest=input_digest,
82	output_files=output_files,
83	output_directories=output_directories,
84	description=request.description,
85	)
86	)
87	)
88	return PexVenv(digest=result.output_digest, path=request.output_path)	3✔
89
90
91	def rules():	6✔
92	return [collect_rules(), pex_cli.rules()]	4✔

pantsbuild / pants / 25441711719

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous