Repository navigation
CI checks, CVE monitoring, release gating, and automated security patch releases - #2
Merged
Merged
Conversation
Add a CI workflow that runs on every push and pull request to main: a smoke test (byte-compile, import every module, exercise the sample certificate chain and OCSP request paths) across Python 3.10/3.12/3.14, plus a pip-audit scan of requirements.txt for known CVEs. The same workflow runs on a weekly schedule and opens an issue assigned to the repository owner when it fails, so new advisories surface without anyone watching. Gate releases on those checks: the release workflow now calls CI first and only publishes when everything passes. On failure no release is created; instead an issue is opened and assigned to the owner, who can fix the problem and re-trigger, or consciously override with the new skip_checks input on a manual run. Add Dependabot config for weekly pip and github-actions update PRs, and a .gitignore for Python bytecode caches (removing the tracked .pyc). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0126cb3H46h57uDx2NmeV6b2
Add a daily security-autopatch workflow: it audits requirements.txt, and when a published vulnerability has a fix outside the allowed version range, it raises the range, re-installs, re-audits, and runs the smoke test. Only if every check passes does it commit the bump and publish a patch release automatically, with an informational issue assigned to the owner. If checks fail, or an advisory has no published fix, nothing is committed or released - an issue assigned to the owner asks for a decision instead, matching the release-gating policy. The range-rewriting logic reproduces the manual v1.0.1 fix exactly when run against the old vulnerable pin (verified locally), and leaves a clean requirements file untouched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0126cb3H46h57uDx2NmeV6b2
Python 3.12 rejects class instances as dataclass defaults (ValueError: mutable default ... use default_factory), so importing the app failed on 3.12 and 3.14 - caught by the new CI smoke test on its first run. Use field(default_factory=hashes.SHA1), which behaves identically on all supported versions and avoids sharing one hash instance across specs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0126cb3H46h57uDx2NmeV6b2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds continuous build verification, CVE monitoring, release gating, and automatic security patch releases.
Key changes
CI (
.github/workflows/ci.yml)scripts/smoke_test.py): byte-compiles every file, imports every module (including the GUI app when tkinter is available), verifies the sample CA → leaf chain signature, and round-trips a DER OCSP request.pip-auditscan ofrequirements.txtas it resolves for a fresh install.mainand weekly on a schedule; a scheduled failure opens an issue assigned to the repository owner.Release gating (
.github/workflows/release.yml)skip_checksinput on manual dispatch lets a human explicitly override after review.Security autopatch (
.github/workflows/security-autopatch.yml,scripts/security_autopatch.py)cryptography>=42,<44pin it reproduces the manual v1.0.1 fix (>=49.0.0,<51.0.0) exactly.Housekeeping
.gitignorefor Python bytecode caches; removed the__pycache__/*.pycfile that was tracked in git.Verification
pip-audit -r requirements.txtreturns clean.Generated by Claude Code