⚠️ CONFLICT! Lineage pull request for: skeleton #70

cisagovbot · 2025-05-20T16:29:50Z

Lineage Pull Request: CONFLICT

Lineage has created this pull request to incorporate new changes found in an
upstream repository:

Upstream repository: https://github.com/cisagov/skeleton-python-library.git
Remote branch: HEAD

Check the changes in this pull request to ensure they won't cause issues with
your project.

The lineage/skeleton branch has one or more unresolved merge conflicts
that you must resolve before merging this pull request!

How to resolve the conflicts

Take ownership of this pull request by removing any other assignees.

Clone the repository locally, and reapply the merge:

git clone [email protected]:cisagov/pca-gophish-composition.git pca-gophish-composition
cd pca-gophish-composition
git remote add skeleton https://github.com/cisagov/skeleton-python-library.git
git remote set-url --push skeleton no_push
git switch develop
git switch --create lineage/skeleton --track origin/develop
git pull skeleton HEAD
git status

Review the changes displayed by the status command. Fix any conflicts and
possibly incorrect auto-merges.
After resolving each of the conflicts, add your changes to the
branch, commit, and push your changes:
```
git add .github/dependabot.yml .github/lineage.yml bump_version.sh src/example/example.py 
git commit
git push --force --set-upstream origin lineage/skeleton
```
Note that you may append to the default merge commit message
that git creates for you, but please do not delete the existing
content. It provides useful information about the merge that is
being performed.
Wait for all the automated tests to pass.
Confirm each item in the "Pre-approval checklist" below.
Remove any of the checklist items that do not apply.
Ensure every remaining checkbox has been checked.
Mark this draft pull request "Ready for review".

✅ Pre-approval checklist

✌️ The conflicts in this pull request have been resolved.
All relevant type-of-change labels have been added.
All new and existing tests pass.

Note

You are seeing this because one of this repository's maintainers has
configured Lineage to open pull requests.

For more information:

🛠 Lineage configurations for this project are stored in .github/lineage.yml

📚 Read more about Lineage

Use a specific number of spaces instead of the default of only caring if the number of spaces used is consistent within a file. Ensure that block sequences inside of mappings are indented.

The use of flow sequences and mappings is not as readable as block collections and so should be discouraged. Since it is a cleaner representation for empty collections we will allow those, but if an application otherwise requires flow collections they can be explicitly enabled by disabling the checks per https://yamllint.readthedocs.io/en/stable/disable_with_comments.html

When running ansible-lint it will throw the following warning with our current configuration: WARNING Found incompatible custom yamllint configuration (.yamllint), please either remove the file or edit it to comply with: - comments.min-spaces-from-content must be 1 - braces.max-spaces-inside must be 1 - octal-values.forbid-implicit-octal must be true - octal-values.forbid-explicit-octal must be true. Thus we implement these configuration rules.

Previously we disabled the `truthy` rule due to Ansible's use of `yes`/`no` for boolean values. That is no longer the case and the default configuration used by ansible-lint now has this rule enabled. The use of `on` as a key in GitHub Actions workflow syntax means we needed to add disable-line comments for the truthy rule.

Add a configuration for the `quoted-strings` rule that matches our best practices. Other files are updated to comply with these new settings.

Also add semver as a dev requirement. I'd like to start versioning descendants of skeleton-ansible-role (in anticipation of pinning Ansible role versions at a future date), and I thought it would make sense to go ahead and implement this at the skeleton-generic level to force us to start versioning all repositories. Repositories that already version can ignore these changes when they flow down via Lineage, since they will already have their own version files and version-bumping script.

This is done automatically with the `pre-commit autoupdate` command.

…n-comment Fix spelling error in comment

Update our yamllint configuration file

This new action simply applies our standard permissions monitoring and runner hardening. Using it allows us to DRY out the GH Actions workflows in our skeleton repositories a bit.

Co-authored-by: Nick M <[email protected]>

GitHubSecurityLab/actions-permissions and step-security/harden-runner are no longer direct dependencies since we are now using cisagov/action-job-preamble. Co-authored-by: Nick M <[email protected]>

Co-authored-by: Nick M <[email protected]>

Flesh out the comment a little so its meaning is clearer. Co-authored-by: Nick M <[email protected]>

Make sure to mention that the permissions monitoring config can be changed by creating a repo-level variable; there is no need to modify the workflow. Co-authored-by: Nick M <[email protected]>

…preamble This action supports this functionality now, so we may as well take advantage of it. Also disable GH permissions monitoring, since that functionality is poorly implemented and has been causing a lot of problems due to the MITM implementation hogging or leaking memory.

Apply our standard job preamble via cisagov/action-job-preamble

CodeQL now supports GitHub Actions as a language, so it makes sense to add such a workflow to this repository. See this link for more details: https://github.blog/changelog/2024-12-17-find-and-fix-actions-workflows-vulnerabilities-with-codeql-public-preview/

Also correctly sort YAML keys. Co-authored-by: Nick <[email protected]>

This aligns with the changes in cisagov/skeleton-generic#201. Co-authored-by: Nick M <[email protected]>

Children of this skeleton repository will require this Dependabot ignore directive.

Use cisagov/action-job-preamble instead of crazy-max/ghaction-github-status and crazy-max/ghaction-dump-context directly.

This action reviews dependency changes for vulnerabilities and license changes.

This aligns with the changes in cisagov/skeleton-generic#201. Co-authored-by: Nick M <[email protected]>

github-advanced-security · 2025-05-20T16:31:32Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

src/example/example.py

coveralls · 2025-05-20T16:32:49Z

Pull Request Test Coverage Report for Build 15218524580

Details

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 0.0%

Totals
Change from base Build 13682232305:	0.0%
Covered Lines:	0
Relevant Lines:	45

💛 - Coveralls

Instead of installing coveralls and running it we will use the Coveralls GitHub action to upload test coverage reports.

…_action Use the `coveralls/github-action` action

This one is (once again) due to the fact that we are stuck on an ancient version of setuptools due gophish/gophish being ancient.

jsf9k and others added 30 commits November 20, 2024 14:40

Fix spelling error in comment

162e2c2

Adjust the indentation rule for yamllint

5a3ac91

Use a specific number of spaces instead of the default of only caring if the number of spaces used is consistent within a file. Ensure that block sequences inside of mappings are indented.

Configure quoted strings rule for yamllint

dc891af

Add a configuration for the `quoted-strings` rule that matches our best practices. Other files are updated to comply with these new settings.

Bump version from 0.0.1 to 0.0.1-rc.1

3401551

Update pre-commit hook versions

5b5a526

This is done automatically with the `pre-commit autoupdate` command.

Merge pull request #198 from cisagov/improvement/fix-spelling-error-i…

e0f5911

…n-comment Fix spelling error in comment

Merge pull request #200 from cisagov/improvement/update_yamllint_rules

b35dec3

Update our yamllint configuration file

Apply our standard job preamble via cisagov/action-job-preamble

da028ea

This new action simply applies our standard permissions monitoring and runner hardening. Using it allows us to DRY out the GH Actions workflows in our skeleton repositories a bit.

Set actions_permissions_config input

0e93632

Add a friendly name to the cisagov/action-job-preamble steps

8b2ac55

Add a Dependabot ignore directive for cisagov/action-job-preamble

864b5af

Co-authored-by: Nick M <[email protected]>

Update input name for cisagov/action-job-preamble

8cdce2a

Remove two Dependabot ignore directives

17b93ec

GitHubSecurityLab/actions-permissions and step-security/harden-runner are no longer direct dependencies since we are now using cisagov/action-job-preamble. Co-authored-by: Nick M <[email protected]>

Use cisagov/action-job-preamble in sync-labels.yml workflow

6a9e331

Co-authored-by: Nick M <[email protected]>

Use v1 tag of cisagov/action-job-preamble

b5b3b9d

Re-add comment explaining where the org var comes from

3ec1b1f

Flesh out the comment a little so its meaning is clearer. Co-authored-by: Nick M <[email protected]>

Flesh out org var comment even more

764df0c

Make sure to mention that the permissions monitoring config can be changed by creating a repo-level variable; there is no need to modify the workflow. Co-authored-by: Nick M <[email protected]>

Merge pull request #201 from cisagov/improvement/use-job-preamble-action

f35dcbc

Apply our standard job preamble via cisagov/action-job-preamble

Update comment to match what is in cisagov/skeleton-docker

0032cc2

Also correctly sort YAML keys. Co-authored-by: Nick <[email protected]>

Use cisagov/action-job-preamble

0534337

This aligns with the changes in cisagov/skeleton-generic#201. Co-authored-by: Nick M <[email protected]>

Add the CodeQL action to the Dependabot configuration

adea10c

Children of this skeleton repository will require this Dependabot ignore directive.

Use cisagov/action-job-preamble instead of separate actions

5dfe5df

Use cisagov/action-job-preamble instead of crazy-max/ghaction-github-status and crazy-max/ghaction-dump-context directly.

Add a workflow to run actions/dependency-review-action

d740ee8

This action reviews dependency changes for vulnerabilities and license changes.

Use cisagov/action-job-preamble

a446dde

This aligns with the changes in cisagov/skeleton-generic#201. Co-authored-by: Nick M <[email protected]>

cisagovbot assigned mcdonnnj May 20, 2025

cisagovbot added the upstream update This issue or pull request pulls in upstream updates label May 20, 2025

github-advanced-security bot found potential problems May 20, 2025

View reviewed changes

src/example/example.py Fixed Show fixed Hide fixed

mcdonnnj and others added 3 commits May 20, 2025 13:01

Use the coveralls/github-action action

b65198e

Instead of installing coveralls and running it we will use the Coveralls GitHub action to upload test coverage reports.

Remove unnecessary quotes around YAML string

0299509

Merge pull request #147 from cisagov/improvement/use_coveralls_github…

d0c1620

…_action Use the `coveralls/github-action` action

jsf9k unassigned felddy, dav3r and mcdonnnj May 23, 2025

jsf9k added dependencies Pull requests that update a dependency file github-actions Pull requests that update GitHub Actions code security This issue or pull request addresses a security issue labels May 23, 2025

jsf9k added 4 commits May 23, 2025 16:15

Merge remote-tracking branch 'skeleton/develop' into lineage/skeleton

750c5ba

Remove unnecessary upstream file

0a77443

Correct location of version file

4f8c354

Ignore another pip-audit vulnerability

71773e1

This one is (once again) due to the fact that we are stuck on an ancient version of setuptools due gophish/gophish being ancient.

jsf9k force-pushed the lineage/skeleton branch from 0b7cbb6 to 71773e1 Compare May 23, 2025 20:20

jsf9k marked this pull request as ready for review May 23, 2025 20:30

jsf9k requested review from dav3r, felddy, jsf9k and mcdonnnj as code owners May 23, 2025 20:30

jsf9k enabled auto-merge May 23, 2025 20:30

jsf9k requested a review from a team May 23, 2025 20:30

dv4harr10 approved these changes May 27, 2025

View reviewed changes

dav3r approved these changes May 27, 2025

View reviewed changes

jsf9k merged commit 358ed79 into develop May 27, 2025
34 checks passed

jsf9k deleted the lineage/skeleton branch May 27, 2025 13:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

⚠️ CONFLICT! Lineage pull request for: skeleton #70

⚠️ CONFLICT! Lineage pull request for: skeleton #70

Uh oh!

cisagovbot commented May 20, 2025 •

edited by jsf9k

Loading

Uh oh!

github-advanced-security bot commented May 20, 2025

Uh oh!

Uh oh!

coveralls commented May 20, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

⚠️ CONFLICT! Lineage pull request for: skeleton #70

⚠️ CONFLICT! Lineage pull request for: skeleton #70

Uh oh!

Conversation

cisagovbot commented May 20, 2025 • edited by jsf9k Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Lineage Pull Request: CONFLICT

How to resolve the conflicts

✅ Pre-approval checklist

Uh oh!

github-advanced-security bot commented May 20, 2025

Uh oh!

Uh oh!

coveralls commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 15218524580

Details

💛 - Coveralls

Uh oh!

Uh oh!

Uh oh!

cisagovbot commented May 20, 2025 •

edited by jsf9k

Loading

coveralls commented May 20, 2025 •

edited

Loading