25441711719

Committed 06 May 2026 02:31PM UTC coverage: 92.915%. Remained the same

Build # 25441711719

Build Type

push

github

Committed by

web-flow

Commit Message

use sha pin (with comment) format for generated actions (#23312)

Per the GitHub Action best practices we recently enabled at #23249, we
should pin each action to a SHA so that the reference is actually
immutable.

This will -- I hope -- knock out a large chunk of the 421 alerts we
currently get from zizmor. The next followup would then be upgrades and
harmonizing the generated and none-generated pins.

Notice: This idea was suggested by Claude while going over pinact output
and I was surprised to see that post processing the yaml wasn't too
gross.

Coverage Stats

92206 of 99237 relevant lines covered (92.91%)

4.04 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

95.65

/src/python/pants/jvm/util_rules.py

# Copyright 2021 Pants project contributors (see CONTRIBUTORS.md).
# Licensed under the Apache License, Version 2.0 (see LICENSE).

from __future__ import annotations

from dataclasses import dataclass

from pants.engine.fs import Digest, DigestSubset, FileDigest, FileEntry, PathGlobs
from pants.engine.intrinsics import digest_subset_to_digest, get_digest_entries
from pants.engine.rules import collect_rules, rule


@dataclass(frozen=True)
class ExtractFileDigest:
    digest: Digest
    file_path: str


@rule
async def digest_to_file_digest(request: ExtractFileDigest) -> FileDigest:
    digest = await digest_subset_to_digest(
        DigestSubset(request.digest, PathGlobs([request.file_path]))
    )
    digest_entries = await get_digest_entries(digest)

    if len(digest_entries) == 0:
        raise Exception(f"ExtractFileDigest: '{request.file_path}' not found in {request.digest}.")
    elif len(digest_entries) > 1:
        raise Exception(
            f"ExtractFileDigest: Unexpected error: '{request.file_path}' found multiple times in {request.digest}"
        )

    file_info = digest_entries[0]

    if not isinstance(file_info, FileEntry):
        raise AssertionError(
            f"Unexpected error: '{request.file_path}' refers to a directory, not a file."
        )

    return file_info.file_digest


def rules():
    return [*collect_rules()]

1	# Copyright 2021 Pants project contributors (see CONTRIBUTORS.md).
2	# Licensed under the Apache License, Version 2.0 (see LICENSE).
3
4	from __future__ import annotations	12✔
5
6	from dataclasses import dataclass	12✔
7
8	from pants.engine.fs import Digest, DigestSubset, FileDigest, FileEntry, PathGlobs	12✔
9	from pants.engine.intrinsics import digest_subset_to_digest, get_digest_entries	12✔
10	from pants.engine.rules import collect_rules, rule	12✔
11
12
13	@dataclass(frozen=True)	12✔
14	class ExtractFileDigest:	12✔
15	digest: Digest	12✔
16	file_path: str	12✔
17
18
19	@rule	12✔
20	async def digest_to_file_digest(request: ExtractFileDigest) -> FileDigest:	12✔
21	digest = await digest_subset_to_digest(	12✔
22	DigestSubset(request.digest, PathGlobs([request.file_path]))
23	)
24	digest_entries = await get_digest_entries(digest)	12✔
25
26	if len(digest_entries) == 0:	12✔
27	raise Exception(f"ExtractFileDigest: '{request.file_path}' not found in {request.digest}.")	1✔
28	elif len(digest_entries) > 1:	12✔
29	raise Exception(	1✔
30	f"ExtractFileDigest: Unexpected error: '{request.file_path}' found multiple times in {request.digest}"
31	)
32
33	file_info = digest_entries[0]	12✔
34
35	if not isinstance(file_info, FileEntry):	12✔
36	raise AssertionError(	×
37	f"Unexpected error: '{request.file_path}' refers to a directory, not a file."
38	)
39
40	return file_info.file_digest	12✔
41
42
43	def rules():	12✔
44	return [*collect_rules()]	12✔

pantsbuild / pants / 25441711719

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous