mirror of
https://github.com/hanzo-ml/trainer.git
synced 2026-09-24 00:31:34 +00:00
4af1d0a81b
* feat(ci): add Python dependency scanning to OSV-Scanner workflow Add lockfiles and scanning for Python dependencies in the initializers and python_api. This extends the nightly OSV-Scanner workflow to cover Python in addition to Go. - Generate requirements-lock.txt files via pip-compile for: - cmd/initializers/dataset/ - cmd/initializers/model/ - api/python_api/ - Add osv-scan-python job with SARIF scanning and auto-fix - Add validate-lockfile.yaml to ensure lockfiles stay in sync on PRs - Handle both direct and transitive dependency upgrades Closes #3528 Signed-off-by: Fiona-Waters <[email protected]> * fix(ci): address review feedback on Python OSV-Scanner workflow - Fix validate-lockfile false positives by stripping header comments before diffing (pip-compile embeds output filename in header) - Regenerate lockfiles in clean Python 3.12 venv with --strip-extras to include all transitive deps and silence pip-tools deprecation warning - Fix PR body table formatting: use Markdown table rows instead of bullet items in both Go and Python auto-fix jobs - Escape dots in package names for grep/sed regex safety Signed-off-by: Fiona-Waters <[email protected]> * fix(ci): address review feedback on OSV-Scanner Python workflow - Replace shell grep/sed with Python helper script using packaging.requirements.Requirement for exact name matching, fixing prefix collision (requests vs requests-oauthlib), constraint dropping, and extras stripping - Skip entry when package not found in lockfile after pip-compile instead of recording a false version - Bump actions/setup-python from v5 to v6 for consistency Signed-off-by: Fiona-Waters <[email protected]> * fix(ci): pin pip-tools version in CI workflows Pin pip-tools to 7.4.1 in osv-scanner and validate-lockfile workflows to mitigate supply-chain risk in workflows with elevated permissions. Signed-off-by: Fiona-Waters <[email protected]> * fix(deps): update lockfiles for certifi 2026.5.20 Signed-off-by: Fiona-Waters <[email protected]> --------- Signed-off-by: Fiona-Waters <[email protected]> Co-authored-by: Hanzo Dev <[email protected]>
Kubeflow Trainer API
Python package containing Kubeflow Trainer API models.