fix(ci): resolve PEP 668 failure and unsigned downstream commits - #28
Merged
Conversation
…ntu 24.04 Signed-off-by: Division 7 <divisionseven@users.noreply.github.com>
Downstream repo commits were unsigned, triggering GitHub's "unsigned commit" security alerts on homebrew-pkg-defender and pkg-defender-action. Replace manual git clone/commit/push operations with `peter-evans/create-pull-request@v8` and `actions/create-github-app-token@v3` across `sync-homebrew-tap.yml`, `sync-github-action.yml`, and `release.yml`. All downstream commits are now signed by the GitHub App identity. - Removed PAT-based auth - Added GitHub App token generation - Added sign-commits: `true` on all PR creation steps - Removed stale PR cleanup steps (handled by `delete-branch: true`) - Replaced gh pr merge with `enable-pull-request-automerge` Signed-off-by: Division 7 <divisionseven@users.noreply.github.com>
Signed-off-by: Division 7 <divisionseven@users.noreply.github.com>
divisionseven
added
area: ci-cd
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
pascalthedev
approved these changes
Jul 21, 2026
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix two CI issues: (1) GitHub Action CI failing on Ubuntu 24.04 due to PEP 668 blocking system-wide Python package installs, and (2) sync workflows producing unsigned commits that trigger "unverified" alerts on downstream repos.
require('yaml')(already a devDependency)peter-evans/create-pull-request@v8+actions/create-github-app-token@v3Type of Change
Motivation and Context
Two CI issues needed fixing:
Issue 1: PEP 668 CI failure: The GitHub Action CI workflows (
ci.yml,release.yml) ranuv pip install --system pyyamlto install Python for YAML validation. Ubuntu 24.04's Python 3.12 is marked as externally managed (PEP 668), which blocks system-wide package installs with exit code 2. Rather than fixing the Python install, we eliminated Python entirely — theyamlnpm package was already a devDependency, so we replacedpython3 -c "import yaml..."withnode -e "require('yaml')...".Issue 2: Unsigned downstream commits: The sync workflows (
sync-homebrew-tap.yml,sync-github-action.yml,release.yml) used rawgit commitcommands with fine-grained PATs to push changes to downstream repos. PATs authenticate pushes but cannot sign commits, triggering GitHub's "unsigned commit" security alerts onhomebrew-pkg-defenderandpkg-defender-action. We replaced the entire manual git/PR workflow withpeter-evans/create-pull-request@v8+actions/create-github-app-token@v3, the industry standard (2,820+ stars) that handles branch creation, signed commits, PR creation, and stale PR cleanup automatically.Implementation Notes
PEP 668 fix (3 files):
github-action/tests/validate.sh:python3 -c "import yaml..."tonode -e "require('yaml')..."github-action/.github/workflows/ci.yml: removedsetup-uv+uv pip install --system pyyamlstepsgithub-action/.github/workflows/release.yml: same removalSync workflow refactor (3 files):
.github/workflows/sync-homebrew-tap.yml: removed 7 manual git/PR steps, added 3 action-based steps.github/workflows/sync-github-action.yml: same pattern.github/workflows/release.yml: removed 4 manual steps, added 6 action-based steps (includes temp commit undo viagit reset HEAD~1)Key design decisions:
sign-commits: trueon allcreate-pull-requeststeps, commits are API-signed by GitHub, no GPG keys neededdelete-branch: truereplaces manual stale PR cleanup loopspeter-evans/enable-pull-request-automergewithcontinue-on-error: truereplaces manualgh pr merge --autosync/tap,sync/action) instead of date-stamped branches, no stale branches accumulateHOMEBREW_TAP_PAT,ACTION_REPO_PAT) removed from workflows but kept in repo settings until new workflows are verifiedPrerequisites: Required a GitHub App to be created and installed on all 3 repos
Testing
pytest --cov-fail-under=90)pytest tests/integration/test_smoke_e2e.py --tb=short -q)Manual testing performed:
github-action/tests/validate.sh: all 6 validation tests pass with Node.js YAML validationpython3 -c "import yaml; yaml.safe_load(...)"actionlintrun on all workflow files, only non-blocking shellcheck style advisoriesChecklist
ruff check .andruff format --check .)mypy .)pytest --cov-fail-under=90)docs/reference/exit-codes.mdCHANGELOG.mdwith a brief entry under[Unreleased]pyproject.toml.github/workflows/dependency-review.yml) runs automatically on PRsBreaking Changes
None. The sync workflows now require a GitHub App to be created and installed (prerequisites documented in PR). Old PAT secrets are kept as fallback until verification.
Related Issues / PRs
divisionseven/homebrew-pkg-defenderdivisionseven/pkg-defender-action