Skip to content

Commit 66bb769

Browse files
wagoodmanwagoodman
authoredMar 21, 2025··
port to binny and uv management (#784)
Signed-off-by: Alex Goodman <[email protected]>
1 parent d3f09a7 commit 66bb769

23 files changed

+2287
-3010
lines changed
 

‎.binny.yaml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
tools:
2+
# we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
3+
- name: binny
4+
version:
5+
want: v0.9.0
6+
method: github-release
7+
with:
8+
repo: anchore/binny
9+
10+
# used for running all local and CI tasks
11+
- name: task
12+
version:
13+
want: v3.41.0
14+
method: github-release
15+
with:
16+
repo: go-task/task
17+
18+
# used for showing the changelog at release
19+
- name: glow
20+
version:
21+
want: v2.0.0
22+
method: github-release
23+
with:
24+
repo: charmbracelet/glow
25+
26+
# used at release to generate the changelog
27+
- name: chronicle
28+
version:
29+
want: v0.8.0
30+
method: github-release
31+
with:
32+
repo: anchore/chronicle
33+
34+
# used at release to generate the changelog
35+
- name: crane
36+
version:
37+
want: v0.20.3
38+
method: github-release
39+
with:
40+
repo: google/go-containerregistry

‎.github/actions/bootstrap/action.yaml

+12-35
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,10 @@ inputs:
1111
# note: the caller really drives this in a matrix strategy run for unit tests.
1212
# this default value is used for the rest of the workflow.
1313
default: "3.11"
14-
poetry-version:
15-
description: "Poetry version to install"
14+
uv-version:
15+
description: "UV version to install"
1616
required: true
17-
default: "2.0.0"
18-
use-poetry-cache:
19-
description: "Restore poetry cache"
20-
required: true
21-
default: "true"
17+
default: "0.5.16"
2218
go:
2319
description: "Install go"
2420
required: true
@@ -39,41 +35,22 @@ runs:
3935
using: "composite"
4036
steps:
4137

42-
# note: go mod and build is automatically cached on default with v4+
43-
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe #v4.1.0
38+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 #v5.3.0
4439
with:
4540
go-version: ${{ inputs.go-version }}
4641

47-
- uses: actions/setup-python@v4
42+
- uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5.3.1
4843
with:
49-
python-version: ${{ inputs.python-version }}
50-
51-
- name: Install poetry
52-
shell: bash
53-
run: |
54-
python -m pip install poetry==${{ inputs.poetry-version }}
55-
poetry self add "poetry-dynamic-versioning[plugin]"
44+
enable-cache: true
5645

57-
- name: Cache Poetry virtualenv
58-
uses: actions/cache@v3
59-
if: inputs.use-poetry-cache == 'true'
60-
id: cache
46+
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
6147
with:
62-
path: ~/.virtualenvs
63-
key: ${{ inputs.cache-key-prefix }}-python-${{ inputs.python-version }}-poetry-${{ inputs.poetry-version }}-${{ hashFiles('poetry.lock') }}
64-
restore-keys: |
65-
${{ inputs.cache-key-prefix }}-python-${{ inputs.python-version }}-poetry-${{ inputs.poetry-version }}
66-
67-
- name: Setup Poetry config
68-
shell: bash
69-
run: |
70-
poetry config virtualenvs.in-project false
71-
poetry config virtualenvs.path ~/.virtualenvs
48+
python-version: ${{ inputs.python-version }}
7249

7350
- name: Restore tool cache
7451
id: tool-cache
7552
if: inputs.tools == 'true'
76-
uses: actions/cache@v3
53+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
7754
with:
7855
path: ${{ github.workspace }}/.tmp
7956
key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
@@ -89,13 +66,13 @@ runs:
8966
run: |
9067
DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y ${{ inputs.bootstrap-apt-packages }}
9168
92-
- name: Install dependencies and package
69+
- name: Install project + dependencies
9370
shell: bash
94-
run: poetry install
71+
run: uv sync --all-extras --dev
9572

9673
- name: Restore tox cache
9774
id: cache-tox
98-
uses: actions/cache@v3
75+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
9976
with:
10077
path: .tox
10178
key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-${{ inputs.python-version }}-${{ hashFiles('pyproject.toml') }}-${{ hashFiles('tox.ini') }}

‎.github/actions/quality-gate/action.yaml

+6-8
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,17 @@ inputs:
88
runs:
99
using: "composite"
1010
steps:
11-
# assume we have python and poetry installed
11+
# assume we have python and uv installed
1212

1313
- name: Capture vulnerability results
1414
shell: bash
1515
working-directory: tests/quality
16-
run: poetry run make capture provider=${{ inputs.provider }}
17-
16+
run: make capture provider=${{ inputs.provider }}
1817

1918
- name: Validate provider results
2019
shell: bash
2120
working-directory: tests/quality
22-
run: poetry run make validate provider=${{ inputs.provider }}
21+
run: make validate provider=${{ inputs.provider }}
2322

2423
- name: Archive the provider state (${{ inputs.provider }})
2524
if: ${{ failure() }}
@@ -28,7 +27,7 @@ runs:
2827

2928
- name: Upload the provider state archive (${{ inputs.provider }})
3029
if: ${{ failure() }}
31-
uses: actions/upload-artifact@v4
30+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
3231
with:
3332
name: qg-capture-state-${{ inputs.provider }}
3433
path: qg-capture-state-${{ inputs.provider }}.tar.gz
@@ -54,8 +53,7 @@ runs:
5453
5554
Now you can debug the provider with yardstick:
5655
\`\`\`bash
57-
poetry shell
58-
yardstick result list
59-
yardstick label explore
56+
uv run yardstick result list
57+
uv run yardstick label explore
6058
\`\`\`
6159
EOF

‎.github/dependabot.yml

+11-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,18 @@
11
version: 2
22
updates:
3+
34
- package-ecosystem: "github-actions"
4-
directory: "/"
5+
open-pull-requests-limit: 10
6+
directory: "/.github/actions/bootstrap"
57
schedule:
6-
interval: daily
8+
interval: "daily"
9+
10+
- package-ecosystem: "github-actions"
11+
open-pull-requests-limit: 10
12+
directory: "/.github/workflows"
13+
schedule:
14+
interval: "daily"
15+
716
- package-ecosystem: "pip"
817
directory: "/"
918
schedule:

‎.github/scripts/ci-check.sh

-11
This file was deleted.

‎.github/scripts/dev-shell.sh

+12-10
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1+
#!/usr/bin/env bash
12
set -euo pipefail
23

34
DEV_VUNNEL_PROVIDERS=$@
45
GRYPE_CONFIG=$(pwd)/.grype.yaml
56
GRYPE_DB_CONFIG=$(pwd)/.grype-db.yaml
6-
DEV_POETRY_ENV_PATH=$(poetry env info --path)
7+
DEV_PYTHON_ENV_PATH=$(pwd)/.venv
78

89
BOLD="\033[1m"
910
UNDERLINE="\033[4m"
@@ -12,15 +13,15 @@ MAGENTA="\033[35m"
1213
RESET="\033[0m"
1314

1415
function step() {
15-
echo "${MAGENTA}• $*${RESET} ..."
16+
echo -e "${MAGENTA}• $*${RESET} ..."
1617
}
1718

1819
function title() {
19-
echo "${BOLD}$*${RESET}"
20+
echo -e "${BOLD}$*${RESET}"
2021
}
2122

2223
function error() {
23-
echo "${RED}$*${RESET}"
24+
echo -e "${RED}$*${RESET}"
2425
}
2526

2627
if [ -z "$*" ]
@@ -85,8 +86,9 @@ for provider in $DEV_VUNNEL_PROVIDERS; do
8586
done
8687
export GRYPE_DB_CONFIG
8788

88-
step "Activating poetry virtual env: $DEV_POETRY_ENV_PATH"
89-
source "$DEV_POETRY_ENV_PATH/bin/activate"
89+
step "Activating virtual env: $DEV_PYTHON_ENV_PATH"
90+
test -d "$DEV_PYTHON_ENV_PATH" || uv run vunnel --version
91+
source "$DEV_PYTHON_ENV_PATH/bin/activate"
9092

9193
pids=""
9294

@@ -108,10 +110,10 @@ export PATH=${DEV_VUNNEL_BIN_DIR}:$PATH
108110
export DEV_VUNNEL_SHELL=true
109111

110112
echo
111-
echo "Note: development builds ${UNDERLINE}grype${RESET} and ${UNDERLINE}grype-db${RESET} are now available in your path."
112-
echo "To update these builds run '${UNDERLINE}make build-grype${RESET}' and '${UNDERLINE}make build-grype-db${RESET}' respectively."
113-
echo "To run your provider and update the grype database run '${UNDERLINE}make update-db${RESET}'."
114-
echo "Type '${UNDERLINE}exit${RESET}' to exit the development shell."
113+
echo -e "Note: development builds ${UNDERLINE}grype${RESET} and ${UNDERLINE}grype-db${RESET} are now available in your path."
114+
echo -e "To update these builds run '${UNDERLINE}make build-grype${RESET}' and '${UNDERLINE}make build-grype-db${RESET}' respectively."
115+
echo -e "To run your provider and update the grype database run '${UNDERLINE}make update-db${RESET}'."
116+
echo -e "Type '${UNDERLINE}exit${RESET}' to exit the development shell."
115117

116118
# we were able to setup everything, no need to detect failures from this point on...
117119
trap - EXIT

‎.github/scripts/update-dev-db.sh

+5-4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1+
#!/usr/bin/env bash
12
set -euo pipefail
23

3-
BIN_DIR=./bin
4+
BIN_DIR=./.tool
45
GRYPE=${BIN_DIR}/grype
56
GRYPE_DB=${BIN_DIR}/grype-db
67

@@ -10,15 +11,15 @@ MAGENTA="\033[35m"
1011
RESET="\033[0m"
1112

1213
function step() {
13-
echo "${MAGENTA}• $*${RESET} ..."
14+
echo -e "${MAGENTA}• $*${RESET} ..."
1415
}
1516

1617
function title() {
17-
echo "${BOLD}$*${RESET}"
18+
echo -e "${BOLD}$*${RESET}"
1819
}
1920

2021
function error() {
21-
echo "${RED}$*${RESET}"
22+
echo -e "${RED}$*${RESET}"
2223
}
2324

2425
step "Updating vunnel providers"

‎.github/workflows/nightly-quality-gate.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
id: determine-providers
2929
run: |
3030
# select all providers as test subjects (this populates the matrix downstream)
31-
content=`cd tests/quality && poetry run make all-providers`
31+
content=`cd tests/quality && make all-providers`
3232
echo $content
3333
echo "providers=$content" >> $GITHUB_OUTPUT
3434

‎.github/workflows/pr-quality-gate.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,10 @@ jobs:
3131
run: |
3232
# be nice to folks troubleshooting in CI...
3333
cd tests/quality
34-
poetry run make show-changes
34+
make show-changes
3535
3636
# determine which providers to run (to later populate the matrix)
37-
content=`poetry run make select-providers`
37+
content=`make select-providers`
3838
echo $content
3939
echo "providers=$content" >> $GITHUB_OUTPUT
4040

‎.github/workflows/release.yaml

+4-2
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,11 @@ jobs:
9999
needs:
100100
- tag
101101
runs-on: ubuntu-22.04
102+
environment: release
102103
permissions:
103104
contents: read
105+
# required to authenticate with PyPI via OIDC token
106+
id-token: write
104107
steps:
105108
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
106109
with:
@@ -110,10 +113,9 @@ jobs:
110113
- name: Bootstrap environment
111114
uses: ./.github/actions/bootstrap
112115

116+
# note: authentication is via the OIDC token
113117
- name: Publish to PyPI
114118
run: make ci-publish-pypi
115-
env:
116-
POETRY_PYPI_TOKEN_PYPI: ${{ secrets.VUNNEL_PYPI_TOKEN }}
117119

118120
release-docker:
119121
needs:

‎.github/workflows/validations.yaml

+8-14
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,11 @@ jobs:
2626
uses: ./.github/actions/bootstrap
2727

2828
- name: Run static analysis
29-
run: poetry run make static-analysis
29+
run: make static-analysis
3030

31-
# - name: Ensure quality gate tools are properly configured
32-
# run: |
33-
# cd tests/quality && make validate-test-tool-versions
31+
- name: Ensure quality gate tools are properly configured
32+
run: |
33+
cd tests/quality && make validate-test-tool-versions
3434
3535
Test:
3636
runs-on: ubuntu-22.04
@@ -57,10 +57,10 @@ jobs:
5757
python-version: ${{ matrix.python.version }}
5858

5959
- name: Run unit tests
60-
run: poetry run tox -e ${{ matrix.python.toxEnv }}
60+
run: uv run tox -e ${{ matrix.python.toxEnv }}
6161

6262
- name: Build assets
63-
run: poetry run make build
63+
run: make build
6464

6565
# this is to help facilitate ensuring all checks have run with the checks API for release
6666
# see https://github.com/orgs/community/discussions/26822#discussioncomment-3305794
@@ -69,7 +69,7 @@ jobs:
6969
if: ${{ always() }}
7070
runs-on: ubuntu-22.04
7171
name: Test Gate
72-
needs: [test]
72+
needs: [Test]
7373
steps:
7474
- run: |
7575
result="${{ needs.Test.result }}"
@@ -101,13 +101,7 @@ jobs:
101101
echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io --username ${{ github.actor }} --password-stdin
102102
103103
- name: Build assets
104-
run: poetry run make build
104+
run: make build
105105

106106
- name: Publish commit image
107107
run: make ci-publish-commit
108-
109-
- name: Publish to test PyPI
110-
run: make ci-publish-testpypi
111-
env:
112-
# note: "..._TESTPYPI" suffix should match the name of the testpypi repository (see the Makefile target)
113-
POETRY_PYPI_TOKEN_TESTPYPI: ${{ secrets.TEST_PYPI_TOKEN }}

0 commit comments

Comments
 (0)
Please sign in to comment.