From ac3219e0957986f07fae770675aa98db68ab892a Mon Sep 17 00:00:00 2001 From: Krukon Date: Fri, 21 Aug 2026 13:40:24 +0200 Subject: [PATCH 1/8] chore: migrate CI to mise-action Add mise.toml/mise.lock and replace actions/setup-python with step-security/mise-action in python-package.yml, overriding the tool version per matrix job via mise_toml so the existing 3.7/3.8/3.9/3.10 test matrix is preserved. docker-build.yml has no toolchain install step, so it is untouched. --- .github/actions.lock.yaml | 30 ++++++++++++++------- .github/workflows/python-package.yml | 8 +++--- .gitignore | 2 ++ mise.lock | 40 ++++++++++++++++++++++++++++ mise.toml | 2 ++ 5 files changed, 69 insertions(+), 13 deletions(-) create mode 100644 mise.lock create mode 100644 mise.toml diff --git a/.github/actions.lock.yaml b/.github/actions.lock.yaml index 6a240638b..ffd5a6880 100644 --- a/.github/actions.lock.yaml +++ b/.github/actions.lock.yaml @@ -1,5 +1,5 @@ version: 1 -generated_at: 2026-06-15T13:14:55Z +generated_at: 2026-08-21T11:40:11Z internal: [] trusted: - action: actions/checkout @@ -8,14 +8,7 @@ trusted: occurrences: ee0669bd1cc54295c223e0bb666b733df41de1c5: .github/workflows/docker-build.yml: - - jobs.build.steps.[0].uses - .github/workflows/python-package.yml: - - jobs.build.steps.[0].uses - - action: actions/setup-python - refs: - - d09bd5e6005b175076f227b13d9730d56e9dcfcb - occurrences: - d09bd5e6005b175076f227b13d9730d56e9dcfcb: + - jobs.build.steps.[1].uses .github/workflows/python-package.yml: - jobs.build.steps.[1].uses external: @@ -25,7 +18,24 @@ external: occurrences: 0e68818ea37ba7728f417f03a58e06e68d9d2592: .github/workflows/docker-build.yml: - - jobs.build.steps.[1].uses + - jobs.build.steps.[2].uses + - action: step-security/harden-runner + refs: + - 9af89fc71515a100421586dfdb3dc9c984fbf411 + occurrences: + 9af89fc71515a100421586dfdb3dc9c984fbf411: + .github/workflows/docker-build.yml: + - jobs.build.steps.[0].uses + .github/workflows/python-package.yml: + - jobs.build.steps.[0].uses + - action: step-security/mise-action + refs: + - 2796166110dee826668caddd4bffedae5116e7cd + occurrences: + 2796166110dee826668caddd4bffedae5116e7cd: + .github/workflows/python-package.yml: + - jobs.build.steps.[2].uses local: [] docker: [] dynamic: [] +nested_floating_deps: [] diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index 887c9d6ff..e4ee3b8e8 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -29,10 +29,12 @@ jobs: api-key: ${{ secrets.GH_FRESHAENGINEERING_STEP_SECURITY_API_KEY }} - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@d09bd5e6005b175076f227b13d9730d56e9dcfcb # v4.0.0 + - name: Setup mise + uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 with: - python-version: ${{ matrix.python-version }} + mise_toml: | + [tools] + python = "${{ matrix.python-version }}" - name: Install dependencies run: | diff --git a/.gitignore b/.gitignore index afcc5f967..01a7c6897 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,5 @@ legacy/err.egg-info/ # tox .tox + +.github/actions.lock.yaml diff --git a/mise.lock b/mise.lock new file mode 100644 index 000000000..51de27806 --- /dev/null +++ b/mise.lock @@ -0,0 +1,40 @@ +# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html + +[[tools.python]] +version = "3.10.21" +backend = "core:python" + +[tools.python."platforms.linux-arm64"] +checksum = "sha256:686077ed8d668e3446f03f202bc3c99955d350a0db0ace5f8ce45f1b451b54b7" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz" +provenance = "github-attestations" + +[tools.python."platforms.linux-arm64-musl"] +checksum = "sha256:d0310c4f190680a16bf6ca1dc05211f1455d2b2aa6e1fadc7ea721c9471b9b0c" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-aarch64-unknown-linux-musl-install_only_stripped.tar.gz" +provenance = "github-attestations" + +[tools.python."platforms.linux-x64"] +checksum = "sha256:807bb6746dd8b7a347fe833ee1cc2543457e5c2c98059dc454600468ee7cae7b" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz" +provenance = "github-attestations" + +[tools.python."platforms.linux-x64-musl"] +checksum = "sha256:05bddd8942f4dfec45e37c8cd72c8b6323e2c7015be6e1f509904762430957fc" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-x86_64-unknown-linux-musl-install_only_stripped.tar.gz" +provenance = "github-attestations" + +[tools.python."platforms.macos-arm64"] +checksum = "sha256:caac2a0459052a3f62857fe29809a8fc4a9da87ca5ac860120c7ce710fc43842" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-aarch64-apple-darwin-install_only_stripped.tar.gz" +provenance = "github-attestations" + +[tools.python."platforms.macos-x64"] +checksum = "sha256:735ec45b5315c1255d425582b63a7819d660783ba0f5402793998908d70a7893" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-x86_64-apple-darwin-install_only_stripped.tar.gz" +provenance = "github-attestations" + +[tools.python."platforms.windows-x64"] +checksum = "sha256:35645afc6bac0a8b74f16d36df1a98e36afa71eb8ba64acb7944b3135bcba1c4" +url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz" +provenance = "github-attestations" diff --git a/mise.toml b/mise.toml new file mode 100644 index 000000000..6f3b64ab7 --- /dev/null +++ b/mise.toml @@ -0,0 +1,2 @@ +[tools] +python = "3.10" From 5bac3b83668e11c550625dada09fe645849f6a6f Mon Sep 17 00:00:00 2001 From: Krukon Date: Wed, 26 Aug 2026 11:21:54 +0200 Subject: [PATCH 2/8] chore: refresh mise.lock to lockfile_version=1, pin mise-action to 2026.8.12 Pins step-security/mise-action to v4.2.4 (mise CLI 2026.8.12) and regenerates mise.lock to the versioned lockfile format mise 2026.8.11+ requires. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/python-package.yml | 4 +++- mise.lock | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index e4ee3b8e8..5dd9a99c7 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -30,7 +30,9 @@ jobs: - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: Setup mise - uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 + uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 + with: + version: '2026.8.12' with: mise_toml: | [tools] diff --git a/mise.lock b/mise.lock index 51de27806..0a4be2ce5 100644 --- a/mise.lock +++ b/mise.lock @@ -1,8 +1,11 @@ # @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html +lockfile_version = 1 + [[tools.python]] version = "3.10.21" backend = "core:python" +specifiers = ["3.10"] [tools.python."platforms.linux-arm64"] checksum = "sha256:686077ed8d668e3446f03f202bc3c99955d350a0db0ace5f8ce45f1b451b54b7" From f874c93f926bd48453806c5b0dd40927711e8939 Mon Sep 17 00:00:00 2001 From: Krukon Date: Wed, 26 Aug 2026 15:46:22 +0200 Subject: [PATCH 3/8] fix: merge duplicate with: block in Setup mise step The version pin was added as a second with: mapping instead of being merged into the existing block, which is invalid YAML and made the workflow file fail to parse (CI red on this PR's head SHA). --- .github/workflows/python-package.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index 5dd9a99c7..3a86de0d0 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -33,7 +33,6 @@ jobs: uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 with: version: '2026.8.12' - with: mise_toml: | [tools] python = "${{ matrix.python-version }}" From d8c0b6ef5395b71920dca52ebecfb0d27f72abc3 Mon Sep 17 00:00:00 2001 From: Krukon Date: Wed, 26 Aug 2026 17:10:10 +0200 Subject: [PATCH 4/8] fix: pin werkzeug and disable python attestations for CI matrix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit flask==2.0.2 imports werkzeug.urls.url_quote, which was removed in werkzeug>=2.1 — pin werkzeug==2.0.3 to match. Also mise's default-on GitHub artifact attestation check rejects the python-build-standalone release for 3.8.20, so disable it for this workflow's mise-managed python installs. --- .github/workflows/python-package.yml | 2 ++ setup.py | 1 + 2 files changed, 3 insertions(+) diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index 3a86de0d0..7cc7f4a3b 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -31,6 +31,8 @@ jobs: - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: Setup mise uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 + env: + MISE_PYTHON_GITHUB_ATTESTATIONS: false with: version: '2026.8.12' mise_toml: | diff --git a/setup.py b/setup.py index 2c3055ff8..1cf5a3b03 100755 --- a/setup.py +++ b/setup.py @@ -30,6 +30,7 @@ "webtest==3.0.0", "setuptools==60.5.0", "flask==2.0.2", + "werkzeug==2.0.3", # flask 2.0.2 imports werkzeug.urls.url_quote, removed in werkzeug>=2.1 "requests==2.27.1", "jinja2==3.0.3", "pyOpenSSL==21.0.0", From 08c3a5608e22c9dcab42a275e775bb508ec30763 Mon Sep 17 00:00:00 2001 From: Krukon Date: Wed, 26 Aug 2026 17:18:25 +0200 Subject: [PATCH 5/8] chore: retrigger CI From 43ea42154dc6737c641968e8d86f108db15e8ffe Mon Sep 17 00:00:00 2001 From: Krukon Date: Thu, 27 Aug 2026 17:14:36 +0200 Subject: [PATCH 6/8] chore: retrigger CI (previous run stuck queued 24h) From 3956df1ae89d5bc69e73013ee73aa048b11110a6 Mon Sep 17 00:00:00 2001 From: Krukon Date: Thu, 27 Aug 2026 17:21:39 +0200 Subject: [PATCH 7/8] fix: bump pyOpenSSL to 26.2.0 for cryptography compatibility pyOpenSSL==21.0.0 breaks against the modern `cryptography` release mise's python resolves (AttributeError: module 'lib' has no attribute 'X509_V_FLAG_NOTIFY_POLICY' / 'GEN_EMAIL'), which crashes the Webserver plugin on load and manifests as webhooks_test.py timeouts across the whole matrix. Verified locally (python 3.8 via mise) that pyOpenSSL 26.2.0 works with the resolved cryptography 47.0.0 and that errbot's actual cert-generation call path (X509/PKey/dump_certificate/ dump_privatekey) still works unchanged. --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 1cf5a3b03..9941b1b15 100755 --- a/setup.py +++ b/setup.py @@ -33,7 +33,7 @@ "werkzeug==2.0.3", # flask 2.0.2 imports werkzeug.urls.url_quote, removed in werkzeug>=2.1 "requests==2.27.1", "jinja2==3.0.3", - "pyOpenSSL==21.0.0", + "pyOpenSSL==26.2.0", # 21.0.0 breaks against the cryptography version mise's python resolves (AttributeError: X509_V_FLAG_NOTIFY_POLICY) "colorlog==6.6.0", "markdown==3.3.6", "ansi==0.2.0", From 1e2bf67694bbc0813de00210fbc4bf8be9c925fa Mon Sep 17 00:00:00 2001 From: Krukon Date: Fri, 28 Aug 2026 14:01:11 +0200 Subject: [PATCH 8/8] fix: keep pyOpenSSL resolvable on Python 3.7 26.2.0 requires Python >=3.8, so setup.py became uninstallable on 3.7 even though the classifier and CI matrix still claim 3.7 support. Pin 24.0.0 for <3.8 (last release supporting 3.7, still avoids the unpinned-cryptography AttributeError that motivated the 26.2.0 bump) and keep 26.2.0 for 3.8+. --- setup.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 9941b1b15..f1992f76f 100755 --- a/setup.py +++ b/setup.py @@ -33,7 +33,6 @@ "werkzeug==2.0.3", # flask 2.0.2 imports werkzeug.urls.url_quote, removed in werkzeug>=2.1 "requests==2.27.1", "jinja2==3.0.3", - "pyOpenSSL==26.2.0", # 21.0.0 breaks against the cryptography version mise's python resolves (AttributeError: X509_V_FLAG_NOTIFY_POLICY) "colorlog==6.6.0", "markdown==3.3.6", "ansi==0.2.0", @@ -45,6 +44,11 @@ if py_version < (3, 8): deps.append("importlib-metadata==4.12.0") + # 26.2.0 requires Python >=3.8; 21.0.0 breaks against the latest + # cryptography it resolves unpinned (AttributeError: GEN_EMAIL) + deps.append("pyOpenSSL==24.0.0") +else: + deps.append("pyOpenSSL==26.2.0") if py_version < (3, 9): deps.append("graphlib-backport==1.0.3")