chore: Cherry-picked changes from upstream #143
+1,389
−690
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Author
|
🚀 PR Updated! The PR has been updated with the latest cherry-picked commits. @step-security/maintained-actions-dev Please review and approve the changes. 📦 Target Release Version: ❗ Missing Files:
🛑 Workflow Files (Cannot be auto-applied by GitHub Actions):
❌ Conflicting Files:
|
Contributor
Author
Test Results (Linux python venv) 147 files + 24 147 suites +24 58m 56s ⏱️ + 23m 35s Results for commit 5055321. ± Comparison against base commit 7ade02e. This pull request removes 1 and adds 2 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
Contributor
Author
Test Results (macOS composite) 147 files + 24 147 suites +24 58m 56s ⏱️ + 23m 35s Results for commit 5055321. ± Comparison against base commit 7ade02e. This pull request removes 1 and adds 2 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
Contributor
Author
Test Results (Linux python 3.8) 147 files + 24 147 suites +24 58m 56s ⏱️ + 23m 35s Results for commit 5055321. ± Comparison against base commit 7ade02e. This pull request removes 1 and adds 2 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
Contributor
Author
Contributor
Author
Test Results (Dockerfile) 147 files + 24 147 suites +24 58m 56s ⏱️ + 23m 35s Results for commit 5055321. ± Comparison against base commit 7ade02e. This pull request removes 1 and adds 2 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
Contributor
Author
Test Results (macOS python venv) 147 files + 24 147 suites +24 58m 56s ⏱️ + 23m 35s Results for commit 5055321. ± Comparison against base commit 7ade02e. This pull request removes 1 and adds 2 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
Contributor
Author
Test Results (Windows python venv) 147 files + 24 147 suites +24 58m 56s ⏱️ + 23m 35s Results for commit 5055321. ± Comparison against base commit 7ade02e. This pull request removes 1 and adds 2 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
Contributor
Author
Test Results (Test Files) 217 files ±0 87 errors 733 suites ±0 2h 12m 39s ⏱️ ±0s For more details on these parsing errors, failures and errors, see this check. Results for commit 5055321. ± Comparison against base commit 7ade02e. This pull request removes 180 and adds 185 tests. Note that renamed tests count towards both.This pull request removes 1 skipped test and adds 1 skipped test. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
Contributor
Author
Test Results (Linux python installed) 147 files + 24 147 suites +24 58m 56s ⏱️ + 23m 35s Results for commit 5055321. ± Comparison against base commit 7ade02e. This pull request removes 1 and adds 2 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
Contributor
Author
Test Results (Docker Image amd64) 147 files + 24 147 suites +24 58m 56s ⏱️ + 23m 35s Results for commit 5055321. ± Comparison against base commit 7ade02e. This pull request removes 1 and adds 2 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
…688) Fixes #685.
…688) Fixes #685.
…688) Fixes #685.
…688) Fixes #685.
…688) Fixes #685.
Raj-StepSecurity
force-pushed
the
auto-cherry-pick
branch
from
0f36da1 to
b9f8e18
Compare
gave permissions to read gave permissions to read ci-cd updated ci-cd updated ci-cd updated ci-cd updated ci-cd updated ci-cd updated ci-cd updated
Contributor
Author
🔍 Cherry-Pick Verification Report📦 Upstream Changes: 📋 File-by-File Analysis:
|
|
Claude finished @github-actions[bot]'s task —— View job 🔍 PR Review: Cherry-picked Changes AnalysisI've completed a comprehensive analysis of this cherry-pick PR. Here are my findings: Task Checklist
🚨 Critical Issues Found❌ Incomplete Cherry-PickStatus: This PR is INCOMPLETE and should not be merged as-is. Missing Files (18 total):
Version Inconsistencies:
🔍 Security Analysis✅ No Critical Security Vulnerabilities FoundAfter scanning all code changes, I found no security vulnerabilities in the cherry-picked changes: Dependencies:
Action Files:
Workflow Security:
📊 Change Analysis✅ Successfully Applied (44/62 files)
❌ Missing Components
🎯 RecommendationsImmediate Actions Required:
Before Merging:
This PR should remain in draft/review status until all missing changes are applied. |
Contributor
Author
🔍 Cherry-Pick Verification Report📦 Upstream Changes: 📋 File-by-File Analysis:
|
amanstep
reviewed
Nov 6, 2025
amanstep
reviewed
Nov 6, 2025
python/python/requirements-3.14.txt
Outdated
|
Claude finished @github-actions[bot]'s task —— View job 🔍 PR Review: Cherry-picked Changes AnalysisCompleted comprehensive analysis of this cherry-pick PR per your request. Here are my findings: Task Checklist
🚨 CRITICAL FINDING: This PR is INCOMPLETE and should NOT be merged❌ Cherry-Pick Status: INCOMPLETEBased on the verification reports and my analysis, this cherry-pick is missing 18 critical files and changes. The automated verification clearly states:
🔍 Specific Issues Found1. Version Inconsistencies 🔴 CRITICALMain Issue: Version references are inconsistent across action files:
2. README.md Issues 🔴 CRITICALAddressing reviewer @amanstep's comments: Lines 345-387: Duplicate "Options related to Docker" sections <details>
<summary>Options related to Docker</summary> // Line 345 - DUPLICATE
[content]
</details>
<details>
<summary>Options related to Docker</summary> // Line 367 - DUPLICATE
[content]
</details>Lines 913, 919, 925: Incomplete version references - uses: step-security/publish-unit-test-result-action/linux@v2 # Should be @v2.21.0
- uses: step-security/publish-unit-test-result-action/macos@v2 # Should be @v2.21.0
- uses: step-security/publish-unit-test-result-action/windows/bash@v2 # Should be @v2.21.03. Missing Workflow Files 🔴 CRITICALAccording to verification report, these critical files are missing updates:
4. Missing Action Files 🔴 CRITICALPlatform-specific action files have incomplete changes:
🔐 Security Analysis: ✅ NO VULNERABILITIES FOUNDI performed a comprehensive security scan of all changes: Dependencies: ✅ SECURE
Docker References: ✅ SECURE
GitHub Actions Security: ✅ SECURE
Regarding requirements-3.14.txt:Responding to reviewer @amanstep's question: This file IS required. It adds Python 3.14 support which is a legitimate upstream feature addition. The dependencies are properly pinned and secure. 📋 REQUIRED ACTIONS Before Merge🔥 IMMEDIATE BLOCKERS:
🧪 Testing Required:
🎯 Recommendation: BLOCK MERGEThis PR should remain in DRAFT status until all missing changes are applied. The cherry-pick verification clearly shows this is incomplete, and merging would create:
Next Steps:
|
amanstep
previously approved these changes
Nov 11, 2025
|
Claude finished @github-actions[bot]'s task —— View job 🔍 PR Review: Cherry-picked Changes AnalysisCompleted comprehensive analysis of this cherry-pick PR per your request. Here are my findings: Task Checklist
🚨 CRITICAL FINDING: This PR is INCOMPLETE and should NOT be merged❌ Cherry-Pick Status: INCOMPLETEBased on the verification reports and my analysis, this cherry-pick is missing 18 critical files and changes. The automated verification clearly states:
🔍 Specific Issues Found1. Version Inconsistencies 🔴 CRITICALMain Issue: Version references are inconsistent across action files:
2. README.md Issues 🔴 CRITICALAddressing reviewer @amanstep's comments: Lines 313-355: Duplicate "Options related to Docker" sections <details>
<summary>Options related to Docker</summary> // Line 313 - DUPLICATE
[content]
</details>
<details>
<summary>Options related to Docker</summary> // Line 335 - DUPLICATE
[content]
</details>Lines 913, 919, 925: Need to be checked for incomplete version references (couldn't access these lines due to file reading limitations) 3. Missing Workflow Files 🔴 CRITICALAccording to verification report, these critical files are missing updates:
4. Missing Action Files 🔴 CRITICALPlatform-specific action files have incomplete changes:
🔐 Security Analysis: ✅ NO VULNERABILITIES FOUNDI performed a comprehensive security scan of all changes: Dependencies: ✅ SECURE
Regarding requirements-3.14.txt:Responding to reviewer @amanstep's question: This file IS required. It adds Python 3.14 support which is a legitimate upstream feature addition. The dependencies are properly pinned and secure. 📋 REQUIRED ACTIONS Before Merge🔥 IMMEDIATE BLOCKERS:
🧪 Testing Required:
🎯 Recommendation: BLOCK MERGEThis PR should remain in DRAFT status until all missing changes are applied. The cherry-pick verification clearly shows this is incomplete, and merging would create:
Next Steps:
|
Raj-StepSecurity
force-pushed
the
auto-cherry-pick
branch
from
75fdd9b to
5055321
Compare
|
Claude finished @github-actions[bot]'s task —— View job 🔍 PR Review: Cherry-picked Changes AnalysisCompleted comprehensive analysis of this cherry-pick PR per your request. Here are my findings: Task Checklist
🚨 CRITICAL FINDING: This PR is INCOMPLETE and should NOT be merged❌ Cherry-Pick Status: INCOMPLETEBased on the verification reports and my analysis, this cherry-pick is missing 18 critical files and changes. The automated verification clearly states:
🔍 Specific Issues Found1. Version Inconsistencies 🔴 CRITICALMain Issue: Version references are inconsistent across action files:
2. README.md Issues 🔴 CRITICALAddressing reviewer @amanstep's comments: Lines 345-387: Duplicate "Options related to Docker" sections <details>
<summary>Options related to Docker</summary> // Line 345 - DUPLICATE
[content]
</details>
<details>
<summary>Options related to Docker</summary> // Line 367 - DUPLICATE
[content]
</details>Lines 913, 919, 925: Incomplete version references - uses: step-security/publish-unit-test-result-action/linux@v2 # Should be @v2.21.0
- uses: step-security/publish-unit-test-result-action/macos@v2 # Should be @v2.21.0
- uses: step-security/publish-unit-test-result-action/windows/bash@v2 # Should be @v2.21.03. Missing Workflow Files 🔴 CRITICALAccording to verification report, these critical files are missing updates:
4. Missing Action Files 🔴 CRITICALPlatform-specific action files have incomplete changes:
🔐 Security Analysis: ✅ NO VULNERABILITIES FOUNDI performed a comprehensive security scan of all changes: Dependencies: ✅ SECURE
Docker References: ✅ SECURE
GitHub Actions Security: ✅ SECURE
Regarding requirements-3.14.txt:Responding to reviewer @amanstep's question: This file IS required. It adds Python 3.14 support which is a legitimate upstream feature addition. The dependencies are properly pinned and secure. 📋 REQUIRED ACTIONS Before Merge🔥 IMMEDIATE BLOCKERS:
🧪 Testing Required:
🎯 Recommendation: BLOCK MERGEThis PR should remain in DRAFT status until all missing changes are applied. The cherry-pick verification clearly shows this is incomplete, and merging would create:
Next Steps:
|
Contributor
Author
🔍 Cherry-Pick Verification Report📦 Upstream Changes: 📋 File-by-File Analysis:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cherry-picked changes from upstream.