ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 21:11:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci(api): simplify SDK release pin to a single uv lock --upgrade-package (#11288)

Browse Source 
Co-authored-by: César Arroba <19954079+cesararroba@users.noreply.github.com>
This commit is contained in:
Prowler Bot
2026-05-21 13:59:52 +02:00
committed by GitHub
parent ea34d34876
commit 5487372c99
1 changed files with 7 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/api-container-build-push.yml
+7 -29
View File
@@ -133,37 +133,15 @@ jobs:
with:
persist-credentials: false
- name: Pin prowler SDK to latest master commit and refresh lockfile
if: github.event_name == 'push'
- name: Refresh prowler SDK pin to current branch tip
run: |
set -e
LATEST_SHA=$(git ls-remote https://github.com/prowler-cloud/prowler.git refs/heads/master | cut -f1)
sed -i "s|prowler-cloud/prowler.git@master|prowler-cloud/prowler.git@${LATEST_SHA}|" api/pyproject.toml
# Refresh api/uv.lock so it matches the pinned SHA above; the API
# Dockerfile runs `uv sync --locked`, which aborts on any drift
# between pyproject.toml and uv.lock.
# api/pyproject.toml has `@master` on master and `@v5.X` on release
# branches (set by prepare-release.yml). uv lock --upgrade-package
# re-resolves whichever ref is present against the current branch tip
# and writes the SHA into api/uv.lock. The Dockerfile runs
# `uv sync --locked`, which is what actually drives the install.
pip install --no-cache-dir "uv==0.11.14"
(cd api && uv lock)
- name: Pin prowler SDK to latest release branch (v5.Y) commit and refresh lockfile
if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
run: |
set -e
# RELEASE_TAG looks like "5.14.0"; the SDK release branch is "v5.14".
VERSION="${RELEASE_TAG#v}"
VERSION_BRANCH="v$(echo "${VERSION}" | cut -d. -f1,2)"
LATEST_SHA=$(git ls-remote https://github.com/prowler-cloud/prowler.git "refs/heads/${VERSION_BRANCH}" | cut -f1)
if [ -z "${LATEST_SHA}" ]; then
echo "ERROR: release branch ${VERSION_BRANCH} not found in prowler-cloud/prowler"
exit 1
fi
echo "Pinning SDK to ${VERSION_BRANCH}@${LATEST_SHA}"
sed -i "s|prowler-cloud/prowler.git@master|prowler-cloud/prowler.git@${LATEST_SHA}|" api/pyproject.toml
# Refresh api/uv.lock so it matches the pinned SHA above; the API
# Dockerfile runs `uv sync --locked`, which aborts on any drift
# between pyproject.toml and uv.lock.
pip install --no-cache-dir "uv==0.11.14"
(cd api && uv lock)
(cd api && uv lock --upgrade-package prowler)
- name: Login to DockerHub
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0