Public Access
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 devx-ci-bot
|
f339df3562 | ||
 emil
|
db38453a54 | ||
|
gitea-actions-bot
|
5d78377152 | ||
|
devx-ci-bot
|
b8b21cccd5 | ||
|
emil
|
326eccfd2f | ||
|
gitea-actions-bot
|
076b470344 | ||
|
devx-ci-bot
|
53b49ec91c | ||
|
emil
|
2cfc0aca10 | ||
|
gitea-actions-bot
|
83ea4496e5 | ||
|
devx-ci-bot
|
adb94bf96f | ||
|
emil
|
32308f2ad8 | ||
|
gitea-actions-bot
|
5468a6f4af |
@@ -2,6 +2,30 @@
|
||||
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## [0.45.1] - 2026-07-14
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- URL-encode package names and versions in clean_images API calls
|
||||
|
||||
## [0.45.0] - 2026-07-14
|
||||
|
||||
### Features
|
||||
|
||||
- Add IO_INTERNAL_CALLS to check_test_isolation
|
||||
|
||||
## [0.44.2] - 2026-07-14
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- Use legacy Docker builder to avoid Gitea registry 403
|
||||
|
||||
## [0.44.1] - 2026-07-14
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- Disable Docker buildx provenance attestation
|
||||
|
||||
## [0.44.0] - 2026-07-13
|
||||
|
||||
### Features
|
||||
|
||||
@@ -16,12 +16,12 @@ quality badges.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Why devx?
|
||||
|
||||
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.44.0",
|
||||
"devx>=0.45.1",
|
||||
]
|
||||
|
||||
[tool.pip]
|
||||
@@ -101,8 +101,8 @@ pip install -e .
|
||||
```
|
||||
|
||||
> **Note:** If your project requires a specific devx version, pin it in
|
||||
> `dependencies` (for example, `"devx==0.44.0"`) or use a version constraint
|
||||
> (for example, `"devx>=0.44.0,<0.45"`).
|
||||
> `dependencies` (for example, `"devx==0.45.1"`) or use a version constraint
|
||||
> (for example, `"devx>=0.45.1,<0.46"`).
|
||||
|
||||
### Optional extras
|
||||
|
||||
|
||||
+8
-8
@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Overview
|
||||
|
||||
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.44.0",
|
||||
"devx>=0.45.1",
|
||||
]
|
||||
|
||||
[tool.pip]
|
||||
extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
|
||||
```
|
||||
|
||||
Pin a specific version if needed: `"devx==0.44.0"` or `"devx>=0.44.0,<0.45"`.
|
||||
Pin a specific version if needed: `"devx==0.45.1"` or `"devx>=0.45.1,<0.46"`.
|
||||
|
||||
### Optional extras
|
||||
|
||||
|
||||
@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.44.0",
|
||||
"devx>=0.45.1",
|
||||
]
|
||||
|
||||
[project.optional-dependencies]
|
||||
dev = [
|
||||
"devx>=0.44.0",
|
||||
"devx>=0.45.1",
|
||||
]
|
||||
```
|
||||
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
"""devx — reusable development and CI/CD tools for oblachno-oss projects."""
|
||||
|
||||
__version__ = "0.44.0"
|
||||
__version__ = "0.45.1"
|
||||
|
||||
@@ -174,9 +174,12 @@ def build_image(
|
||||
return True
|
||||
|
||||
click.echo(f"Building {spec.name} ({len(full_tags)} tag(s))...")
|
||||
# Use legacy builder (DOCKER_BUILDKIT=0) to avoid OCI-format manifest
|
||||
# blobs (attestation, config) that the Gitea registry rejects with 403.
|
||||
result = subprocess.run( # nosec B603
|
||||
cmd,
|
||||
check=False,
|
||||
env={**os.environ, "DOCKER_BUILDKIT": "0"},
|
||||
)
|
||||
if result.returncode != 0:
|
||||
click.echo(_("Build failed for {name}", name=spec.name), err=True)
|
||||
|
||||
@@ -130,6 +130,26 @@ HELPER_INTERNAL_CALLS: dict[str, set[str]] = {
|
||||
"run_cmd": {"subprocess"},
|
||||
}
|
||||
|
||||
# I/O function internal dependencies: if a test patches one of these
|
||||
# internal dependencies, the I/O function call is considered safe.
|
||||
# Maps I/O function name → set of internal function/method names it calls.
|
||||
IO_INTERNAL_CALLS: dict[str, set[str]] = {
|
||||
"get_customer_vm_ip": {"get_tofu_output", "get_tofu_vm_ip", "subprocess"},
|
||||
"get_observability_vm_ip": {"get_tofu_output", "get_tofu_vm_ip", "subprocess"},
|
||||
"get_pat": {
|
||||
"_iter_sources",
|
||||
"_local_pat_path",
|
||||
"_secrets_path",
|
||||
"_read_secrets_pat",
|
||||
"validate_pat",
|
||||
"ZitadelAuth",
|
||||
"load_secrets",
|
||||
"os.environ",
|
||||
},
|
||||
"load_secrets": {"load_vault_yaml", "REPO_ROOT", "open", "yaml", "safe_load"},
|
||||
"get_customer_secret": {"load_customer_secrets", "load_vault_yaml", "load_secrets", "REPO_ROOT", "open"},
|
||||
}
|
||||
|
||||
# subprocess functions that the runtime audit wraps.
|
||||
_SUBPROCESS_FUNCS = ("run", "call", "check_call", "check_output", "Popen")
|
||||
|
||||
@@ -817,6 +837,9 @@ class TestIsolationVisitor(ast.NodeVisitor):
|
||||
or sn in all_patches
|
||||
or any(io_key in p or sn in p for p in all_patches)
|
||||
or any(p.endswith(f".{sn}") for p in all_patches)
|
||||
or any(
|
||||
dep in all_patches or any(dep in p for p in all_patches) for dep in IO_INTERNAL_CALLS.get(io_key, set())
|
||||
)
|
||||
):
|
||||
self.violations.append(
|
||||
Violation(
|
||||
|
||||
@@ -5,6 +5,13 @@ Queries the Gitea API for all versions of a package (container type) and
|
||||
deletes all but the most recent N versions. The ``latest`` tag is always
|
||||
preserved if present.
|
||||
|
||||
.. note::
|
||||
This tool only deletes package versions via the Gitea API. The underlying
|
||||
blob files on the Gitea server's filesystem are NOT removed by this tool
|
||||
(Gitea 1.26.x has no built-in garbage collection). The production VM's
|
||||
daily cleanup script (``cleanup_gitea.py``) handles filesystem blob GC
|
||||
by querying the database for referenced blobs and removing orphaned files.
|
||||
|
||||
Usage::
|
||||
|
||||
# Clean up ci-base images, keep last 2 versions
|
||||
@@ -57,7 +64,10 @@ def list_package_versions(
|
||||
Returns a list of version dicts, each containing at least ``version``
|
||||
and ``created_at`` fields.
|
||||
"""
|
||||
url = f"{api_url}/packages/{owner}?type=container&name={name}"
|
||||
from urllib.parse import quote
|
||||
|
||||
encoded_name = quote(name, safe="")
|
||||
url = f"{api_url}/packages/{owner}?type=container&name={encoded_name}"
|
||||
headers = {"Authorization": f"token {token}"}
|
||||
all_versions: list[dict[str, Any]] = []
|
||||
page = 1
|
||||
@@ -96,7 +106,11 @@ def delete_package_version(
|
||||
|
||||
Returns True on success, False on failure.
|
||||
"""
|
||||
url = f"{api_url}/packages/{owner}/{package_type}/{name}/{version}"
|
||||
from urllib.parse import quote
|
||||
|
||||
encoded_name = quote(name, safe="")
|
||||
encoded_version = quote(version, safe="")
|
||||
url = f"{api_url}/packages/{owner}/{package_type}/{encoded_name}/{encoded_version}"
|
||||
headers = {"Authorization": f"token {token}"}
|
||||
for attempt in range(max_retries):
|
||||
try:
|
||||
|
||||
Reference in New Issue
Block a user