25441711719

Committed 06 May 2026 02:31PM UTC coverage: 92.915%. Remained the same

Build # 25441711719

Build Type

push

github

Committed by

web-flow

Commit Message

use sha pin (with comment) format for generated actions (#23312)

Per the GitHub Action best practices we recently enabled at #23249, we
should pin each action to a SHA so that the reference is actually
immutable.

This will -- I hope -- knock out a large chunk of the 421 alerts we
currently get from zizmor. The next followup would then be upgrades and
harmonizing the generated and none-generated pins.

Notice: This idea was suggested by Claude while going over pinact output
and I was surprised to see that post processing the yaml wasn't too
gross.

Coverage Stats

92206 of 99237 relevant lines covered (92.91%)

4.04 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

100.0

/src/python/pants/version.py

# Copyright 2017 Pants project contributors (see CONTRIBUTORS.md).
# Licensed under the Apache License, Version 2.0 (see LICENSE).

import os
from typing import Any

from packaging.version import Version as _Version

# pants: infer-dep(/src/python/pants/_version/__init__.py)
# pants: infer-dep(/src/python/pants/_version/VERSION)
import pants._version

# Generate an OG inferable dependency on the `pants._version` package and its associated resources.
from pants.util.resources import read_resource


# Simple derived class to enable comparison with strings in BUILD files.
class Version(_Version):
    def __hash__(self):
        # This is required to be directly implemented because we implement __eq__,
        # see the docs for object.__hash__:
        # https://docs.python.org/3/reference/datamodel.html#object.__hash__
        return super().__hash__()

    def __eq__(self, other: Any):
        if isinstance(other, str):
            other = Version(other)
        return super().__eq__(other)

    def __ne__(self, other: Any):
        if isinstance(other, str):
            other = Version(other)
        return super().__ne__(other)

    def __lt__(self, other: Any):
        if isinstance(other, str):
            other = Version(other)
        return super().__lt__(other)

    def __le__(self, other: Any):
        if isinstance(other, str):
            other = Version(other)
        return super().__le__(other)

    def __gt__(self, other: Any):
        if isinstance(other, str):
            other = Version(other)
        return super().__gt__(other)

    def __ge__(self, other: Any):
        if isinstance(other, str):
            other = Version(other)
        return super().__ge__(other)


# Set this env var to override the version pants reports. Useful for testing.
# Do not change. (see below)
_PANTS_VERSION_OVERRIDE = "_PANTS_VERSION_OVERRIDE"


VERSION: str = (
    # Do not remove/change this env var without coordinating with `pantsbuild/scie-pants` as it is
    # being used when bootstrapping Pants with a released version.
    os.environ.get(_PANTS_VERSION_OVERRIDE)
    or
    # NB: We expect VERSION to always have an entry and want a runtime failure if this is false.
    # NB: Since "pants" is the namespace for multiple packages, we need to put VERSION underneath
    # the tree that only the `pantsbuild.pants` package owns. Hence `pants._version`.
    # Furthermore, we can't outright move the file there from its previous home of pants/VERSION, as
    # (as of the time of writing) the Pants shim expects it at pants/VERSION. So we symlink the new
    # home to the old home, knowing that Pants is symlink oblivious when collecting sources.
    read_resource(pants._version.__name__, "VERSION").decode().strip()
)

PANTS_SEMVER = Version(VERSION)

# E.g. 2.0 or 2.2.
MAJOR_MINOR = f"{PANTS_SEMVER.major}.{PANTS_SEMVER.minor}"

1	# Copyright 2017 Pants project contributors (see CONTRIBUTORS.md).
2	# Licensed under the Apache License, Version 2.0 (see LICENSE).
3
4	import os	12✔
5	from typing import Any	12✔
6
7	from packaging.version import Version as _Version	12✔
8
9	# pants: infer-dep(/src/python/pants/_version/__init__.py)
10	# pants: infer-dep(/src/python/pants/_version/VERSION)
11	import pants._version	12✔
12
13	# Generate an OG inferable dependency on the `pants._version` package and its associated resources.
14	from pants.util.resources import read_resource	12✔
15
16
17	# Simple derived class to enable comparison with strings in BUILD files.
18	class Version(_Version):	12✔
19	def __hash__(self):	12✔
20	# This is required to be directly implemented because we implement __eq__,
21	# see the docs for object.__hash__:
22	# https://docs.python.org/3/reference/datamodel.html#object.__hash__
23	return super().__hash__()	4✔
24
25	def __eq__(self, other: Any):	12✔
26	if isinstance(other, str):	5✔
27	other = Version(other)	1✔
28	return super().__eq__(other)	5✔
29
30	def __ne__(self, other: Any):	12✔
31	if isinstance(other, str):	3✔
32	other = Version(other)	1✔
33	return super().__ne__(other)	3✔
34
35	def __lt__(self, other: Any):	12✔
36	if isinstance(other, str):	4✔
37	other = Version(other)	1✔
38	return super().__lt__(other)	4✔
39
40	def __le__(self, other: Any):	12✔
41	if isinstance(other, str):	12✔
42	other = Version(other)	1✔
43	return super().__le__(other)	12✔
44
45	def __gt__(self, other: Any):	12✔
46	if isinstance(other, str):	1✔
47	other = Version(other)	1✔
48	return super().__gt__(other)	1✔
49
50	def __ge__(self, other: Any):	12✔
51	if isinstance(other, str):	12✔
52	other = Version(other)	1✔
53	return super().__ge__(other)	12✔
54
55
56	# Set this env var to override the version pants reports. Useful for testing.
57	# Do not change. (see below)
58	_PANTS_VERSION_OVERRIDE = "_PANTS_VERSION_OVERRIDE"	12✔
59
60
61	VERSION: str = (	12✔
62	# Do not remove/change this env var without coordinating with `pantsbuild/scie-pants` as it is
63	# being used when bootstrapping Pants with a released version.
64	os.environ.get(_PANTS_VERSION_OVERRIDE)
65	or
66	# NB: We expect VERSION to always have an entry and want a runtime failure if this is false.
67	# NB: Since "pants" is the namespace for multiple packages, we need to put VERSION underneath
68	# the tree that only the `pantsbuild.pants` package owns. Hence `pants._version`.
69	# Furthermore, we can't outright move the file there from its previous home of pants/VERSION, as
70	# (as of the time of writing) the Pants shim expects it at pants/VERSION. So we symlink the new
71	# home to the old home, knowing that Pants is symlink oblivious when collecting sources.
72	read_resource(pants._version.__name__, "VERSION").decode().strip()
73	)
74
75	PANTS_SEMVER = Version(VERSION)	12✔
76
77	# E.g. 2.0 or 2.2.
78	MAJOR_MINOR = f"{PANTS_SEMVER.major}.{PANTS_SEMVER.minor}"	12✔

pantsbuild / pants / 25441711719

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous