From 686172429a3746f5f64697c26abf64b3e8fc7e0f Mon Sep 17 00:00:00 2001 From: Cursor Date: Tue, 1 Sep 2026 17:51:09 +0000 Subject: [PATCH 1/2] ci: bump checkout/setup-python and skip Dependabot integration without PROXY_URL Combine Dependabot bumps for actions/checkout 7.0.1 and actions/setup-python 7.0.0. Integration tests skip cleanly on Dependabot PRs when the PROXY_URL secret is unavailable (repository Actions secrets are not injected for Dependabot unless also configured under Dependabot secrets). Co-authored-by: ProxyMesh AI --- ...github_release_on_release_branch_merge.yml | 4 +-- .github/workflows/proxy_integration_tests.yml | 25 +++++++++++++------ .github/workflows/publish.yml | 6 ++--- 3 files changed, 23 insertions(+), 12 deletions(-) diff --git a/.github/workflows/github_release_on_release_branch_merge.yml b/.github/workflows/github_release_on_release_branch_merge.yml index 607834b..fdbad65 100644 --- a/.github/workflows/github_release_on_release_branch_merge.yml +++ b/.github/workflows/github_release_on_release_branch_merge.yml @@ -26,12 +26,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout merge commit - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: ref: ${{ github.event.pull_request.merge_commit_sha }} - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 with: python-version: "3.12" diff --git a/.github/workflows/proxy_integration_tests.yml b/.github/workflows/proxy_integration_tests.yml index 048fd8c..3159b61 100644 --- a/.github/workflows/proxy_integration_tests.yml +++ b/.github/workflows/proxy_integration_tests.yml @@ -15,12 +15,12 @@ jobs: unit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 with: python-version: "3.x" @@ -40,12 +40,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 with: python-version: "3.x" @@ -59,15 +59,26 @@ jobs: pip install urllib3 requests aiohttp httpx cloudscraper autoscraper pycurl - name: Require PROXY_URL Actions secret + id: proxy_url env: PROXY_URL: ${{ secrets.PROXY_URL }} run: | - if [ -z "${PROXY_URL}" ]; then - echo "::error::PROXY_URL is not set. Add a repository (or environment) secret named PROXY_URL under Settings → Secrets and variables → Actions." - exit 1 + if [ -n "${PROXY_URL}" ]; then + echo "available=true" >> "$GITHUB_OUTPUT" + exit 0 fi + # Dependabot PRs do not receive repository Actions secrets unless the same + # values are also configured under Settings → Secrets → Dependabot. + if [ "${{ github.actor }}" = "dependabot[bot]" ]; then + echo "::notice::Skipping integration tests: PROXY_URL is not available to Dependabot. Add it under Settings → Secrets → Dependabot to run these checks on Dependabot PRs." + echo "available=false" >> "$GITHUB_OUTPUT" + exit 0 + fi + echo "::error::PROXY_URL is not set. Add a repository (or environment) secret named PROXY_URL under Settings → Secrets and variables → Actions." + exit 1 - name: Run integration tests + if: steps.proxy_url.outputs.available == 'true' env: PROXY_URL: ${{ secrets.PROXY_URL }} run: python test_proxy_headers.py diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 0f62f3d..6637c44 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -30,7 +30,7 @@ jobs: outputs: publish: ${{ steps.decide.outputs.publish }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 if: github.event_name == 'workflow_run' with: ref: main @@ -64,12 +64,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with: ref: ${{ github.event_name == 'workflow_run' && 'main' || github.event_name == 'release' && github.ref || 'main' }} - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 with: python-version: "3.x" From 30a180124de4e9a156a31946fa9ce6e647031072 Mon Sep 17 00:00:00 2001 From: Cursor Date: Tue, 1 Sep 2026 20:34:01 +0000 Subject: [PATCH 2/2] ci: drop Dependabot PROXY_URL skip; annotate action SHA pins Dependabot now has PROXY_URL configured, so restore the hard require check. Add version comments on all pinned GitHub Actions SHAs. Co-authored-by: ProxyMesh AI --- ...github_release_on_release_branch_merge.yml | 4 +-- .github/workflows/proxy_integration_tests.yml | 25 ++++++------------- .github/workflows/publish.yml | 16 ++++++------ 3 files changed, 17 insertions(+), 28 deletions(-) diff --git a/.github/workflows/github_release_on_release_branch_merge.yml b/.github/workflows/github_release_on_release_branch_merge.yml index fdbad65..89ecf5c 100644 --- a/.github/workflows/github_release_on_release_branch_merge.yml +++ b/.github/workflows/github_release_on_release_branch_merge.yml @@ -26,12 +26,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout merge commit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.merge_commit_sha }} - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.12" diff --git a/.github/workflows/proxy_integration_tests.yml b/.github/workflows/proxy_integration_tests.yml index 3159b61..ab80508 100644 --- a/.github/workflows/proxy_integration_tests.yml +++ b/.github/workflows/proxy_integration_tests.yml @@ -15,12 +15,12 @@ jobs: unit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.x" @@ -40,12 +40,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.x" @@ -59,26 +59,15 @@ jobs: pip install urllib3 requests aiohttp httpx cloudscraper autoscraper pycurl - name: Require PROXY_URL Actions secret - id: proxy_url env: PROXY_URL: ${{ secrets.PROXY_URL }} run: | - if [ -n "${PROXY_URL}" ]; then - echo "available=true" >> "$GITHUB_OUTPUT" - exit 0 + if [ -z "${PROXY_URL}" ]; then + echo "::error::PROXY_URL is not set. Add a repository (or environment) secret named PROXY_URL under Settings → Secrets and variables → Actions." + exit 1 fi - # Dependabot PRs do not receive repository Actions secrets unless the same - # values are also configured under Settings → Secrets → Dependabot. - if [ "${{ github.actor }}" = "dependabot[bot]" ]; then - echo "::notice::Skipping integration tests: PROXY_URL is not available to Dependabot. Add it under Settings → Secrets → Dependabot to run these checks on Dependabot PRs." - echo "available=false" >> "$GITHUB_OUTPUT" - exit 0 - fi - echo "::error::PROXY_URL is not set. Add a repository (or environment) secret named PROXY_URL under Settings → Secrets and variables → Actions." - exit 1 - name: Run integration tests - if: steps.proxy_url.outputs.available == 'true' env: PROXY_URL: ${{ secrets.PROXY_URL }} run: python test_proxy_headers.py diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6637c44..8af19a9 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -30,7 +30,7 @@ jobs: outputs: publish: ${{ steps.decide.outputs.publish }} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 if: github.event_name == 'workflow_run' with: ref: main @@ -64,12 +64,12 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event_name == 'workflow_run' && 'main' || github.event_name == 'release' && github.ref || 'main' }} - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.x" @@ -82,7 +82,7 @@ jobs: run: python -m build - name: Store distribution packages - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: python-package-distributions path: dist/ @@ -102,13 +102,13 @@ jobs: steps: - name: Download distribution packages - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: python-package-distributions path: dist/ - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 publish-to-testpypi: name: Publish to TestPyPI @@ -122,12 +122,12 @@ jobs: steps: - name: Download distribution packages - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: python-package-distributions path: dist/ - name: Publish to TestPyPI - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: repository-url: https://test.pypi.org/legacy/