build(deps): bump gitpython from 3.1.32 to 3.1.37 - #110
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.32 to 3.1.37. - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES) - [Commits](gitpython-developers/GitPython@3.1.32...3.1.37) --- updated-dependencies: - dependency-name: gitpython dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
mmguero
pushed a commit
to mmguero-dev/Device-Type-Library-Import
that referenced
this pull request
Aug 13, 2026
…netbox-community#117) * ci: gate pull requests into develop (netbox-community#110) Work now lands on develop first and reaches main as one merge. Both gating workflows filtered pull_request on master and main, so a pull request into develop ran only the title check and the bot review, and nothing that executes the code. tests.yml takes develop on push as well, so a merge into develop is covered too. docker.yml takes it on pull_request only: the build step already skips publishing for pull requests, while a push build would tag and publish a :develop image through type=ref,event=branch. The latest tag stays bound to the default branch, and release.yml still triggers on main alone. * refactor: resolve a run's configuration once, into a value (netbox-community#111) * refactor: resolve a run's configuration once, into a value settings.py read the environment while it was being imported, so a value was parsed long before anything could report on it. Seven places decided what a run meant, main mutated the parsed arguments three times after building them, and every consumer read a snapshot taken at import. core/config.py now resolves argv and the environment into one frozen RunConfig. argv is read first, so --help answers before an environment value can fail the run, and env arrives as a parameter, so callers supply their own mapping instead of the resolver reaching for os.environ. Three defects go with it. --help, and every other invocation, died on a raw ValueError from settings.py when GRAPHQL_PAGE_SIZE or PRELOAD_THREADS held a non-number. That happened at import, before LogHandler existed and outside the handler in __main__, so the user saw a traceback. Resolution now raises ConfigError and main renders it. The env check read os.environ while the connection used settings.NETBOX_URL captured at import. The two could disagree. The ConnectionError handler moved from __main__ into main, where it reports against the URL that was used. MANDATORY_ENV_VARS demanded REPO_URL, which the README documents as optional with a default. The default was unreachable, and the documented Docker quick start, an .env holding only NETBOX_URL and NETBOX_TOKEN, failed. Only NETBOX_URL and NETBOX_TOKEN are required now, and a blank value counts as unset everywhere rather than only in some readers. Removed along the way: NETBOX_FEATURES, which nothing read; the eager DEVICE_TYPE_PROPERTIES constant, which only an uncollected integration test used; and two `except (ImportError, AttributeError)` blocks that existed to cover a lazy settings import. Both schema loaders take repo_path instead. Five getattr(args, ..., False) reads became plain attribute access, because a frozen dataclass always has the field. Tests build a real RunConfig through a shared make_config fixture rather than a MagicMock with hand-written attributes, so they exercise the value the CLI produces. * ci: audit the workflows with zizmor, and slow dependabot down zizmor runs as a pre-commit hook, pinned to the same version as the dev dependency so the local run and a manual run agree. It found two things the review of these workflows had missed. docker.yml interpolated ${{ github.event.repository.name }} straight into a run block, where a repository name is attacker-controllable text expanded as shell. It now arrives through env and is read as "$REPO_NAME". packages: write was granted to the whole of docker.yml, including the smoke-test job, which only builds locally. It now sits on the job that pushes. Five checkouts set persist-credentials: false, since nothing after them uses the credential. release.yml keeps it and says why: semantic-release pushes the release commit and tag. Dependabot waits 7 days before proposing a release, matching the other repository, so a version that is pulled shortly after publication never lands here. The smoke test asserted the missing-variable message for REPO_URL, which is no longer required, so it now asserts NETBOX_URL. * fix: apply GRAPHQL_PAGE_SIZE to the export GraphQL client The importer's client got page_size=config.graphql_page_size; the exporter's did not, so export mode always requested 5000 items per page. A server with a lower limit therefore capped the export, while GRAPHQL_PAGE_SIZE was set for exactly that server. The per-thread worker clients in _fetch_component_templates read self.graphql.DEFAULT_PAGE_SIZE, so they inherit the value too. * test: load .env before integration collection, and resolve REPO_PATH once Deleting core/settings.py removed the load_dotenv() call that ran at import time. Nothing replaced it during collection: the CLI now loads .env inside resolve_run_config(), which pytest never calls. Credentials kept only in .env stayed out of os.environ, so pytest_collection_modifyitems() marked every integration test as skipped. The integration conftest now loads .env itself. Its docstring claimed the old behaviour, so it is corrected too. test_graphql_schema() read os.environ["REPO_PATH"] with a "repo" fallback. Production resolves an absent or blank value to <root>/repo, so a blank value made the test read "schema/" and silently fall back to the hardcoded property list, which is the drift this test exists to catch. It now calls resolve_run_config(argv=[]).repo_path. * refactor: give the component cache one owner and a small interface (netbox-community#112) * refactor: give the component cache one owner and a small interface Prefetching component templates was spread across DeviceTypes, ChangeDetector and the vendor loop. The caller built a nine-key job dict, pumped its progress queue, handed it back for consumption, and stopped it in two places. Two call sites in netbox_api read a _global_preload_done flag and re-ran the preload themselves when it was false. ChangeDetector reached into cached_components and indexed it by hand. core/component_cache.py now owns that: begin_prefetch, pump, ensure_ready, get, entries, record, invalidate. Futures, the executor, the progress queue, per-endpoint task state and the readiness flag are internal. 775 lines leave netbox_api. ensure_ready() is idempotent and starts the prefetch itself when none is in flight, which removes the rule the old interface could not express: the vendor loop had to consume the job even for a vendor with no device types, or module-type processing would run against an empty cache. The comment saying so is gone with the code. Progress leaves through an injected display, so the cache no longer imports Rich. RichTaskDisplay absorbs the owns_tasks flag that four functions used to thread through: a display with a shared registry leaves its tasks for the caller to close, one without removes its own. Also removed, both reachable only from tests: preload_module_type_components, which never had a production caller since it was added in netbox-community#64, and _get_filter_kwargs, whose only caller was the lookup that now builds the filter itself. * fix: address component cache review findings * refactor: describe each component type once, in one registry (netbox-community#113) The nine component template types were described in eleven places: the YAML key, the cache name, the pynetbox endpoint attribute, the GraphQL list key, the GraphQL field list, the comparable properties, the serializer field list, the display label, module-type support, and a create method per type and parent kind. Two copies carried a "same as X" comment, so the duplication was known. Drift between copies was silent: a field present in the comparison list but absent from the query reads as missing and is skipped, so the field simply stops being updated and nothing reports it. core/component_registry.py now holds one row per type. Every other table is derived from it: the GraphQL selection and list key, the comparison properties, the export field order, the progress and log labels, and whether module types have the endpoint. tests/test_component_registry.py pins each derived table and the invariants between them, so a row edited without its consumers fails there instead of in production. _create_generic takes a row and derives the endpoint, cache name and label from it. The sixteen per-type create wrappers collapse into create_components, which reads the row to decide which name references have to become NetBox ids. Two behaviour gaps went with the duplication: - A module-type interface declaring "bridge" POSTed the partner's name where NetBox wants an id, because only the device-type wrapper held it back. The device and module paths are now one path. - A new module type declaring "module-bays" created none, although the DTL module-type schema allows the key, NetBox exposes module_type on module_bay_templates, and the update path already created them. 20 module types in the library declare module bays. Also drops the "endpoint is missing from dcim" guards in three methods. pynetbox's App.__getattr__ returns an Endpoint for any name, so the branch was unreachable; the three tests that covered it built a MagicMock(spec=[]) that pynetbox cannot produce. * fix: report the image and parse failures the run used to swallow (netbox-community#114) * fix: report the image and parse failures the run used to swallow One rule, applied to the paths that degrade quietly: a fallback may only be triggered by evidence about the thing being probed, never by evidence about the transport. The GraphQL half of this landed with GraphQLSchemaError; these are the sites that kept the old shape. _check_image_url returned "ok" when the request never completed, so a dropped connection read as "the server holds this image" and --verify-images silently verified nothing. It now returns "present", "missing" or "unknown", and both callers report the unknown case and say they are falling back to the local hash alone. The image-hash cache lost entries without a word. A cache file that will not parse, a file that cannot be hashed after upload, a file that cannot be read during a change check, an uncreatable cache directory and a failed cache write each suppress a later re-upload, so each is now reported; the write warning fires once per run. An absent cache file is still the normal first run and stays quiet. Two broad excepts are narrowed. _load_image_hash_cache caught Exception, which also hid the None path it was relying on, and now catches OSError and ValueError with an explicit guard for a disabled cache. Exporter's module image fetch caught Exception, so a TypeError in our own code read as "NetBox is unavailable"; it now catches GraphQLError and requests.RequestException. repo.parse_files logged an unparseable YAML file at verbose level only, so a device type could go missing from an import without the operator seeing it. It logs the path at normal level. The vendored library currently has 0 unparseable files out of 7165, so this adds no noise to a healthy run. Two test-suite fixes came with it. tests/conftest.py now points XDG_CACHE_HOME at tmp_path: the suite was reading and writing the developer's real ~/.cache/nb-dt-import/image-hashes.json. And a lost class statement, present since netbox-community#74, had left six _upload_module_type_images tests running as extra methods of TestNetBoxImageHelperFunctions with their class docstring orphaned as a bare string; they now have their class back. * fix: require image content type for image checks * test: make transport failures deterministic * refactor: give the pipeline an interface and the logger one job (netbox-community#116) * refactor: split LogHandler into a sink and a fatal-error policy A method named `exception` on an object named `handle` terminated the process, and nothing in its signature said so. Eleven call sites were written as if it returned, and some ran code that production could never reach. The error catalogue was 8 magic strings keyed into a dict literal, where an unknown key raised KeyError inside the error handler. Two exit mechanisms coexisted: netbox_api reached the catalogue once and called system_exit directly five times. Each category is now a typed exception raised by the module that detects the problem: git and repository errors in core/repo.py, TLS and NetBox errors in core/netbox_api.py, configuration errors in core/config.py. core/errors.py holds only what is shared, the FatalError base and UnknownError. main() renders and exits once, and the GraphQL and REST handlers move there from __main__ so one function owns the exit path. Every user-facing message is unchanged. LogHandler now takes a bool, not a namespace. It read exactly one attribute of the object it was given, and change_detector reached through it to that namespace for the same flag; ChangeDetector takes the flag directly. log_device_ports_created and log_module_ports_created merge into log_ports_created, keyed by parent type. The count moves to _create_generic, which already holds the created list, so the sink logs instead of counting. One dependency also had three parameter names (handle, exception_handler, log_handler); it is `handle` everywhere now. One behaviour change: requests.exceptions.SSLError subclasses ConnectionError, so a certificate failure used to render as a generic connection error. The catalogue already carried an SSL message that no caller could reach. It now has a home in verify_compatibility, ahead of the ConnectionError branch. Tests that passed a MagicMock handle now use a real LogHandler. Those tests asserted a call and then ran on down a path production cannot take, because a mocked `exception` returns where the real one exits. * refactor: give the import pipeline an interface nb-dt-import.py ran a 17-stage sequence with nothing naming any stage. _run constructed the repo, constructed NetBox, then set three policy flags on it after construction, resolved three paths, discovered vendors, filtered them, narrowed them, acquired the console, and called a vendor loop that took 12 parameters. The console lifecycle was split: _run acquired it under a with block, and _run_vendor_loop released it in its own finally. Nothing separated deciding what to do for a vendor from doing it, so a test could not inspect the work without performing the import. core/import_run.py owns the sequence. ImportRun(config, repo, netbox, reporter, progress_factory).execute() returns a RunSummary. discover() returns a RunSelection; plan_vendor() parses and returns a VendorPlan; apply() consumes one. execute() acquires and releases the console in the same method, so the vendor loop no longer reaches out to release what it did not take. The 12 parameters become state on the object. NetBox reads force_resolve_conflicts, remove_unmanaged_types and verify_images from the config it is constructed with, so there are no post-construction flag assignments left. The entry point keeps what belongs to the terminal: the Rich column classes, the progress panel, the export-diff pipeline (a different sequence that must short-circuit before the repo and NetBox exist), and the error rendering in main(). It goes from 1095 lines to 200. Behaviour is unchanged. The vendor loop body, the skip-and-advance path, the prefetch condition and the teardown order all match what they replaced. Test changes: six tests whose only assertion was that nothing raised now assert on a returned summary, on captured output, or on the constructor call. Three flag tests asserted a post-construction attribute and now assert the resolved config that reaches the constructor, with a NetBox test covering the other half. One module-change test never reached the behaviour in its name because its setup had no vendors; it now creates module work. The export test now checks that the console it acquires is also released. * refactor: delete the interface members only tests use Four members had no production caller, so coverage was measuring the tests rather than the shipped code. NetBox.get_api and NetBox.get_counter returned self.netbox and self.counter, both already public attributes. NetBox._module_type_has_missing_components was 15 lines with a three-test class. `git log -S` shows it arrived in 2af54a0 already uncalled; it never had a production caller in any commit. REST_ONLY_ENDPOINTS was an empty frozenset guarding two branches, one in _fetch_endpoint and one in the REST count check. The branch could not run in production, and the three tests covering it monkeypatched the module global to reach a state the program cannot enter. One adapter is a hypothetical seam. docs/adr/0001-no-rest-fallback-for-component-fetch.md records the decision, so a future architecture review reads the reasoning instead of re-proposing the hatch, and notes that restoring a REST path costs a few lines if a NetBox version ever drops a field from GraphQL but keeps it in REST. Coverage was checked after each deletion rather than once at the end, because removing covered code moves the ratio in both directions and the gate is 96. Other test-only members were found and left: DeviceTypeChange.has_updates, ComponentCache.ready, has_missing_device_images, _yaml_equal, LogHandler.start_progress_group, LogHandler.end_progress_group, OutcomeRegistry.records, OutcomeRegistry.summary_by_kind and DTLRepo.get_relative_path. * fix: address pipeline review findings * fix: address consolidated review findings * test: assert export config stop condition
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps gitpython from 3.1.32 to 3.1.37.
Release notes
Sourced from gitpython's releases.
... (truncated)
Commits
b27a89ffix makefile to compare commit hashes only0bd2890prepare next release832b6eeremove unnecessary list comprehension to fix CIe98f57bMerge pull request #1672 from trail-of-forks/robust-refname-checks1774f1eMerge pull request #1677 from EliahKagan/no-noeffecta4701a0Remove@NoEffectannotationsd40320bMerge pull request #1675 from EliahKagan/rollbackd1c1f31Merge pull request #1673 from EliahKagan/flake8e480985Tweak rollback logic in log.to_fileff84b26Refactor try-finally cleanup in git/Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)