Skip to content

2.1.9

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 May 20:02
2.1.9
e3b2b4b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Version 2.1.9

  • Corrected erroneous build configuration that broke version 2.1.8
  • Fixed file path in load_plotly.py
  • Added packaging tests

Summary for yanked version 2.1.8

  • Replaces Poetry with uv for dependency management, locking, and CI sync
  • Hardens GitHub Actions workflows for supply-chain and fork-PR security
  • Adds supply-chain scanning, CodeQL, and zizmor auditing in CI and pre-commit
  • Improves typing across the library and fixes an efficient-frontier plotting bug

Project management

  • Replaced poetry.lock with uv.lock and updated pyproject.toml for uv/pep 621 workflow
  • Updated Makefile, make.ps1, and source_me to use uv sync, uv lock, and uv build instead of Poetry
  • Added make update for upgrading dependencies and make audit for local lockfile + pip-audit checks
  • Updated installation and contributing docs for uv-based setup

CI/CD workflows

  • Migrated all workflows from Poetry to uv (uv sync --locked, uv build, etc.)
  • Pinned all third-party actions to immutable SHAs; added Dependabot config for GitHub Actions and pip (lockfile-only, 7-day cooldown)
  • Added supply-chain.yml: lockfile verification, OSV-Scanner, and pip-audit on push/PR to master
  • Added codeql.yml: Python CodeQL analysis on push/PR, schedule, and manual dispatch
  • Added zizmor.yml: workflow security audit with SARIF upload to GitHub Security tab
  • Split release pipeline into reusable workflows:
    • release-tag.yml: GPG-signed tag + GitHub release
    • release-publish.yml: build dist, TestPyPI → PyPI (OIDC), docs trigger
    • deploy.yml: manual entry point only; requires master branch before proceeding
  • Added pull_request trigger to tests.yml so fork PRs get CI coverage
  • Disabled uv caching in the publish workflow; guarded mypy cache restore and issue creation on fork PRs

Security

  • Expanded SECURITY.md with documented CI controls and an org/repo admin settings checklist
  • Added .github/zizmor.yml policies: hash-pin all actions, allowlisted action set, Dependabot cooldown enforcement
  • zizmor runs with --strict-collection --pedantic in CI and pre-commit
  • OIDC (id-token: write) scoped only to GitHub Pages and PyPI publish jobs
  • No use of pull_request_target; explicit read-only default permissions on workflows

Code and tests

  • Reduced # noqa / # type: ignore usage; tightened type annotations in frame.py, series.py, _common_model.py, portfoliotools.py, and report.py
  • Fixed portfoliotools.py: repeat Plotly colorway to match column count so zip(..., strict=True) does not fail when there are more portfolio points than theme colors
  • Added/updated tests for package metadata, common model internals, frame, series, types, and portfoliotools

Dev tooling

  • Added zizmor pre-commit hook (strict + pedantic, matching CI)
  • Updated pre-commit hooks (uv-lock, ruff, mypy) for the uv-based environment
Assets 2
Loading