From 4d840548b64a8154dcf8eae36fd3bce55ee6a74b Mon Sep 17 00:00:00 2001 From: Boris Date: Sun, 18 Oct 2026 10:58:09 -0400 Subject: [PATCH 1/3] ci: harden workflows and repo policy for OpenSSF Scorecard - Pin actions/checkout and astral-sh/setup-uv to commit SHAs - Make top-level workflow permissions read-only; grant write per job - Add Dependabot for GitHub Actions to keep pins current - Add CODEOWNERS - Point SECURITY.md at private vulnerability reporting --- .github/CODEOWNERS | 1 + .github/dependabot.yml | 6 ++++++ .github/workflows/publish.yml | 8 +++++--- .github/workflows/release.yml | 10 ++++++---- .github/workflows/test.yml | 4 ++-- SECURITY.md | 12 ++++++++++-- 6 files changed, 30 insertions(+), 11 deletions(-) create mode 100644 .github/CODEOWNERS create mode 100644 .github/dependabot.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..004d8c1 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @btoron diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..3a626c3 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 18aa1e3..77772bc 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -14,15 +14,17 @@ on: permissions: contents: read - id-token: write jobs: publish: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write environment: name: pypi steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: ref: ${{ inputs.ref }} @@ -34,7 +36,7 @@ jobs: echo "Publishing version: $VERSION from ${{ inputs.ref }}" - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0 - name: Set up Python run: uv python install 3.14 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e2c087e..1bacb61 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,8 +5,7 @@ on: types: [closed] permissions: - contents: write - id-token: write + contents: read jobs: release: @@ -16,10 +15,13 @@ jobs: contains(github.event.pull_request.labels.*.name, 'release:minor') || contains(github.event.pull_request.labels.*.name, 'release:major')) runs-on: ubuntu-latest + permissions: + contents: write + id-token: write environment: name: pypi steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 @@ -43,7 +45,7 @@ jobs: fi - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0 - name: Set up Python run: uv python install 3.14 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 39fca91..95633a6 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -16,10 +16,10 @@ jobs: matrix: python-version: ["3.13", "3.14"] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0 - name: Set up Python run: uv python install ${{ matrix.python-version }} diff --git a/SECURITY.md b/SECURITY.md index 35dd1d5..5047332 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,8 +2,16 @@ ## Supported Versions -Currently we are supporting only ofsc v2.X +| Version | Supported | +| ------- | --------- | +| 2.x | Yes | +| < 2.0 | No | ## Reporting a Vulnerability -Please report vulnerabilities by opening an issue. The repository is actively monitored via Dependabot & Snyk +Please do not report security vulnerabilities in public issues. + +Report them privately through GitHub's private vulnerability reporting: +https://github.com/btoron/pyOFSC/security/advisories/new + +Include a description of the issue, the affected versions, and steps to reproduce it. You should receive an initial response within 7 days. Once a fix is available, the advisory will be published along with a new release. From 429ca9be15a1583286afc6509aa841a20757bc8a Mon Sep 17 00:00:00 2001 From: Boris Date: Sun, 18 Oct 2026 11:01:51 -0400 Subject: [PATCH 2/3] chore(deps): bump urllib3 to 2.8.0 and pyjwt to 2.15.0 Resolves open Dependabot alerts #49-#65 and supersedes #201 and #202. --- uv.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/uv.lock b/uv.lock index 3e7a063..9359560 100644 --- a/uv.lock +++ b/uv.lock @@ -630,11 +630,11 @@ wheels = [ [[package]] name = "pyjwt" -version = "2.13.0" +version = "2.15.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" } +sdist = { url = "https://files.pythonhosted.org/packages/02/a5/5197bfd06417837ac079921c66fa6393f1dea3557272a263cebfef69e432/pyjwt-2.15.0.tar.gz", hash = "sha256:b11c5f9791d7bf51c2b39a81ed669f6b2dbbd669df2942f6c60167e9e3d1abe4", size = 120513, upload-time = "2026-09-23T16:56:00.689Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" }, + { url = "https://files.pythonhosted.org/packages/e8/55/40e45bf052ee8ee12a4dfd785519660f8effa7b065442b91646ec6828619/pyjwt-2.15.0-py3-none-any.whl", hash = "sha256:7a3742debf6b879e912dbb9819ceec1594be812452b78c5f2e2dfc56564954f8", size = 33680, upload-time = "2026-09-23T16:55:59.241Z" }, ] [[package]] @@ -897,9 +897,9 @@ wheels = [ [[package]] name = "urllib3" -version = "2.7.0" +version = "2.8.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" }, + { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" }, ] From eb5372bf8a1a5e4cf9560b60aaefa528bef48819 Mon Sep 17 00:00:00 2001 From: Boris Date: Sun, 18 Oct 2026 11:03:44 -0400 Subject: [PATCH 3/3] chore: bump version to 2.27.1 --- pyproject.toml | 2 +- uv.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index ab1d274..2fa42fc 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "ofsc" -version = "2.27.0" +version = "2.27.1" description = "Python wrapper for Oracle Field Service API" authors = [{ name = "Borja Toron", email = "borja.toron@gmail.com" }] requires-python = ">=3.13" diff --git a/uv.lock b/uv.lock index 9359560..1fa3cb2 100644 --- a/uv.lock +++ b/uv.lock @@ -435,7 +435,7 @@ wheels = [ [[package]] name = "ofsc" -version = "2.27.0" +version = "2.27.1" source = { editable = "." } dependencies = [ { name = "cachetools" },