diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6129bdf0..738746e3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -147,7 +147,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT }} - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" @@ -275,7 +275,7 @@ jobs: - name: Upload coverage core evidence if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: coverage-core-py${{ matrix.python-version }} path: ${{ runner.temp }}/coverage-core-${{ github.run_id }}-${{ github.run_attempt }}-py${{ matrix.python-version }} @@ -284,7 +284,7 @@ jobs: - name: Upload coverage report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: coverage-report-py${{ matrix.python-version }} path: coverage.xml @@ -293,7 +293,7 @@ jobs: - name: Upload test results if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: test-results-py${{ matrix.python-version }} path: test-results.xml @@ -301,7 +301,7 @@ jobs: - name: Upload runner resource samples if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: runner-resources-py${{ matrix.python-version }} path: runner-resources.log @@ -394,7 +394,7 @@ jobs: with: python-version: ${{ env.PYTHON_DEFAULT }} - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" @@ -428,7 +428,7 @@ jobs: - name: Upload accessibility JUnit results if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: accessibility-results path: test-results/accessibility-junit.xml @@ -436,7 +436,7 @@ jobs: - name: Upload accessibility failure artifacts if: failure() || cancelled() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: accessibility-artifacts path: test-results/ @@ -485,7 +485,7 @@ jobs: - name: Setup runner-local venv run: .github/scripts/setup-runner-venv.sh "dev,e2e" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" @@ -523,7 +523,7 @@ jobs: - name: Upload E2E JUnit results if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: e2e-results-${{ matrix.browser }} path: test-results/e2e-junit.xml @@ -531,7 +531,7 @@ jobs: - name: Upload Playwright failure artifacts if: failure() || cancelled() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: playwright-artifacts-${{ matrix.browser }} path: test-results/ diff --git a/.github/workflows/clean-room.yml b/.github/workflows/clean-room.yml index 33a4f4b7..5d161f33 100644 --- a/.github/workflows/clean-room.yml +++ b/.github/workflows/clean-room.yml @@ -30,7 +30,7 @@ jobs: with: python-version: "3.14" - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: "24" diff --git a/.github/workflows/codeql-branch-probe.yml b/.github/workflows/codeql-branch-probe.yml index 98442c27..ae289a85 100644 --- a/.github/workflows/codeql-branch-probe.yml +++ b/.github/workflows/codeql-branch-probe.yml @@ -33,14 +33,14 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: python queries: +security-extended config-file: ./.github/codeql/codeql-config.yml - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: "/language:python" diff --git a/.github/workflows/docker-release-benchmark.yml b/.github/workflows/docker-release-benchmark.yml index 25858732..8664b25b 100644 --- a/.github/workflows/docker-release-benchmark.yml +++ b/.github/workflows/docker-release-benchmark.yml @@ -107,7 +107,7 @@ jobs: run: .github/scripts/preflight-runner.sh base docker - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Validate DHI authentication env: @@ -139,7 +139,7 @@ jobs: - name: Build and push AMD64 by digest id: build - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . file: docker/Dockerfile @@ -180,7 +180,7 @@ jobs: touch "${RUNNER_TEMP}/digests/${DIGEST#sha256:}" - name: Upload AMD64 digest - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: benchmark-digest-amd64 path: ${{ runner.temp }}/digests/* @@ -207,12 +207,12 @@ jobs: run: .github/scripts/preflight-runner.sh base docker - name: Set up QEMU - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 with: platforms: arm64 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Validate DHI authentication env: @@ -248,7 +248,7 @@ jobs: - name: Build and push ARM64 by digest id: build - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . file: docker/Dockerfile @@ -303,7 +303,7 @@ jobs: touch "${RUNNER_TEMP}/digests/${DIGEST#sha256:}" - name: Upload ARM64 digest - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: benchmark-digest-arm64 path: ${{ runner.temp }}/digests/* @@ -430,7 +430,7 @@ jobs: - name: Upload smoke traces if: failure() || cancelled() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: benchmark-smoke-test-traces path: test-results/smoke/ @@ -468,14 +468,14 @@ jobs: total-seconds: ${{ steps.elapsed.outputs.total_seconds }} steps: - name: Download platform digests - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: benchmark-digest-* path: ${{ runner.temp }}/digests merge-multiple: true - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Log in to GHCR uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml index db342658..065ec511 100644 --- a/.github/workflows/docker-release.yml +++ b/.github/workflows/docker-release.yml @@ -187,7 +187,7 @@ jobs: run: .github/scripts/preflight-runner.sh base docker - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Validate DHI authentication env: @@ -231,7 +231,7 @@ jobs: - name: Build and push AMD64 by digest id: build - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . file: docker/Dockerfile @@ -264,7 +264,7 @@ jobs: touch "${RUNNER_TEMP}/digests/${DIGEST#sha256:}" - name: Upload AMD64 digest - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-digest-amd64 path: ${{ runner.temp }}/digests/* @@ -302,12 +302,12 @@ jobs: run: .github/scripts/preflight-runner.sh base docker - name: Set up QEMU - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 with: platforms: arm64 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Validate DHI authentication env: @@ -351,7 +351,7 @@ jobs: - name: Build and push ARM64 by digest id: build - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 with: context: . file: docker/Dockerfile @@ -397,7 +397,7 @@ jobs: touch "${RUNNER_TEMP}/digests/${DIGEST#sha256:}" - name: Upload ARM64 digest - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-digest-arm64 path: ${{ runner.temp }}/digests/* @@ -459,7 +459,7 @@ jobs: - name: Upload SARIF to GitHub Security if: always() continue-on-error: true - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: ${{ steps.scan.outputs.sarif }} category: container-scan @@ -532,7 +532,7 @@ jobs: - name: Upload smoke traces if: failure() || cancelled() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: smoke-test-traces path: test-results/smoke/ @@ -568,17 +568,17 @@ jobs: ref: ${{ needs.build.outputs.build-sha }} - name: Download platform digests - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: release-digest-* path: ${{ runner.temp }}/digests merge-multiple: true - name: Set up Docker Buildx - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Set up QEMU - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 with: platforms: arm64 @@ -786,7 +786,7 @@ jobs: - name: Set up Docker Buildx if: github.event_name == 'workflow_dispatch' - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Log in to GHCR uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 @@ -924,7 +924,7 @@ jobs: printf '%s\n' "${TAG}" > "${RUNNER_TEMP}/release-image-digest/tag.txt" - name: Upload release image digest artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-image-digest path: ${{ runner.temp }}/release-image-digest/ diff --git a/.github/workflows/docker-validate.yml b/.github/workflows/docker-validate.yml index 7b1c2ee4..31c87f04 100644 --- a/.github/workflows/docker-validate.yml +++ b/.github/workflows/docker-validate.yml @@ -242,7 +242,7 @@ jobs: - name: Upload Docker validation failure artifacts if: failure() || cancelled() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: docker-validate-failure-artifacts path: test-results/docker-validate/ diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 165a3a7e..5b8d7214 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -44,7 +44,7 @@ jobs: fetch-tags: true - name: Download release image metadata artifact - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-image-digest path: release-image-digest @@ -256,7 +256,7 @@ jobs: - name: Create GitHub Release if: steps.release.outputs.skip != 'true' - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: tag_name: ${{ steps.release.outputs.tag }} name: "Pullbox ${{ steps.version.outputs.tag }}" diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 795744a8..4ce532e7 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -171,7 +171,7 @@ jobs: - name: Upload gitleaks report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: gitleaks-report path: gitleaks.sarif @@ -211,7 +211,7 @@ jobs: - name: Upload dependency audit report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: dependency-audit-report path: | @@ -250,7 +250,7 @@ jobs: - name: Upload safety report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: safety-report path: safety-report.json @@ -296,7 +296,7 @@ jobs: - name: Upload Bandit report if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: bandit-report path: bandit-report.json @@ -319,14 +319,14 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: python queries: +security-extended config-file: ./.github/codeql/codeql-config.yml - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: "/language:python" diff --git a/tests/e2e/test_import_collection_page.py b/tests/e2e/test_import_collection_page.py index 85552634..dd851631 100644 --- a/tests/e2e/test_import_collection_page.py +++ b/tests/e2e/test_import_collection_page.py @@ -3687,8 +3687,15 @@ def fulfill_create(route) -> None: # type: ignore[no-untyped-def] import_page.file_handling_in_place_ready.wait_for(state="visible", timeout=5000) assert import_page.start_scan_button.is_enabled() - import_page.start_scan_button.click() - authed_page.wait_for_timeout(100) + with authed_page.expect_response( + lambda response: ( + response.url == f"{seeded_server}/api/v1/import" + and response.request.method == "POST" + ), + timeout=5000, + ) as submission: + import_page.start_scan_button.click() + assert submission.value.status == 201 assert created_requests assert created_requests[-1]["file_handling_mode"] == "in_place" diff --git a/tests/e2e/test_settings_page.py b/tests/e2e/test_settings_page.py index f5662f99..fb509edf 100644 --- a/tests/e2e/test_settings_page.py +++ b/tests/e2e/test_settings_page.py @@ -1300,6 +1300,20 @@ def test_media_colon_replacement_dropdown_can_extend_past_card( settings = SettingsPage(authed_page, seeded_server) settings.goto("media") + # Preview rows change the card height after the naming controls enable. + authed_page.wait_for_function( + """() => { + const previews = [...document.querySelectorAll( + '[data-testid="settings-naming-editor"] .settings-media-preview-panel' + )]; + return previews.length === 5 && previews.every( + panel => panel.dataset.previewReady === 'true' + ); + }""", + timeout=5000, + ) + expect(authed_page.locator("#preview-standard")).to_contain_text("Absolute Batman") + naming_card = ( authed_page.locator("[data-testid='settings-panel-media'] .section-card") .filter(has=authed_page.locator(".section-title-plain:text-is('Naming templates')")) @@ -1309,7 +1323,9 @@ def test_media_colon_replacement_dropdown_can_extend_past_card( "[data-testid='settings-media-colon-replacement-select']" ).first trigger = dropdown.locator("[data-dropdown-select-trigger]").first - panel = authed_page.locator("[data-dropdown-select-panel]:visible").first + panel = authed_page.locator( + '[data-dropdown-select-panel][aria-labelledby="naming-colon-dropdown-trigger"]:visible' + ) trigger.click() panel.wait_for(state="visible", timeout=5000)