ci: Get back to a working state (#1224)

.github/workflows/release.yml

@@ -23,12 +23,12 @@ jobs:
 
       - name: Upgrade pip
         run: |
-          pip install --constraint=.github/workflows/constraints.txt pip
+          pip install --constraint=${{ github.workspace }}/.github/workflows/constraints.txt pip
           pip --version
 
       - name: Install Poetry
         run: |
-          pip install --constraint=.github/workflows/constraints.txt poetry
+          pip install --constraint=${{ github.workspace }}/.github/workflows/constraints.txt poetry
           poetry --version
 
       - name: Check if there is a parent commit

.github/workflows/tests.yml

@@ -45,7 +45,7 @@ jobs:
 
       - name: Upgrade pip
         run: |
-          pip install --constraint=.github/workflows/constraints.txt pip
+          pip install --constraint=${{ github.workspace }}/.github/workflows/constraints.txt pip
           pip --version
 
       - name: Upgrade pip in virtual environments
@@ -59,12 +59,12 @@ jobs:
 
       - name: Install Poetry
         run: |
-          pipx install --pip-args=--constraint=.github/workflows/constraints.txt poetry
+          pipx install --pip-args=--constraint=${{ github.workspace }}/.github/workflows/constraints.txt poetry
           poetry --version
 
       - name: Install Nox
         run: |
-          pipx install --pip-args=--constraint=.github/workflows/constraints.txt nox
+          pipx install --pip-args=--constraint=${{ github.workspace }}/.github/workflows/constraints.txt nox
           nox --version
 
       - name: Install nox-poetry
@@ -127,17 +127,17 @@ jobs:
 
       - name: Upgrade pip
         run: |
-          pip install --constraint=.github/workflows/constraints.txt pip
+          pip install --constraint=${{ github.workspace }}/.github/workflows/constraints.txt pip
           pip --version
 
       - name: Install Poetry
         run: |
-          pipx install --pip-args=--constraint=.github/workflows/constraints.txt poetry
+          pipx install --pip-args=--constraint=${{ github.workspace }}/.github/workflows/constraints.txt poetry
           poetry --version
 
       - name: Install Nox
         run: |
-          pipx install --pip-args=--constraint=.github/workflows/constraints.txt nox
+          pipx install --pip-args=--constraint=${{ github.workspace }}/.github/workflows/constraints.txt nox
           nox --version
 
       - name: Install nox-poetry

docs/conf.py

@@ -1,4 +1,5 @@
 """Sphinx configuration."""
+
 project = "nox-poetry"
 author = "Claudio Jolowicz"
 copyright = "2020, Claudio Jolowicz"

noxfile.py

@@ -1,4 +1,5 @@
 """Nox sessions."""
+
 import os
 import shlex
 import shutil
@@ -133,7 +134,25 @@ def safety(session: Session) -> None:
     """Scan dependencies for insecure packages."""
     requirements = session.poetry.export_requirements()
     session.install("safety")
-    session.run("safety", "check", "--full-report", f"--file={requirements}")
+
+    ignore = [
+        # ADVISORY: In Jinja2, the from_string function is prone to Server
+        # Side Template Injection (SSTI) where it takes the "source" parameter as a
+        # template object, renders it, and then returns it. The attacker can exploit
+        # it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple
+        # third parties believe that this vulnerability isn't valid because users
+        # shouldn't use untrusted templates without sandboxing.
+        # CVE-2019-8341
+        "70612",
+    ]
+
+    session.run(
+        "safety",
+        "check",
+        "--full-report",
+        f"--file={requirements}",
+        f"--ignore={','.join(ignore)}",
+    )
 
 
 @session(python=python_versions)

src/nox_poetry/__init__.py

@@ -26,6 +26,7 @@
 - :const:`WHEEL`
 - :const:`SDIST`
 """
+
 from nox_poetry.poetry import DistributionFormat
 from nox_poetry.sessions import Session
 from nox_poetry.sessions import session

src/nox_poetry/poetry.py

@@ -1,4 +1,5 @@
 """Poetry interface."""
+
 import re
 import sys
 from enum import Enum

src/nox_poetry/sessions.py

@@ -1,4 +1,5 @@
 """Replacements for the ``nox.session`` decorator and the ``nox.Session`` class."""
+
 import functools
 import hashlib
 import re
@@ -66,7 +67,7 @@ def to_constraint(requirement_string: str, line: int) -> Optional[str]:
 
     try:
         requirement = Requirement(requirement_string)
-    except InvalidRequirement as error:
+    except InvalidRequirement as error:  # pragma: no cover
         raise RuntimeError(f"line {line}: {requirement_string!r}: {error}") from error
 
     if not (requirement.name and requirement.specifier):

src/nox_poetry/sessions.pyi

@@ -1,4 +1,5 @@
 """Type stubs for nox_poetry.sessions."""
+
 from pathlib import Path
 from typing import Any
 from typing import Callable

tests/functional/conftest.py

@@ -1,4 +1,5 @@
 """Fixtures for functional tests."""
+
 import inspect
 import os
 import subprocess  # noqa: S404

tests/functional/test_installroot.py

@@ -1,4 +1,5 @@
 """Functional tests for ``installroot``."""
+
 import nox_poetry
 from tests.functional.conftest import Project
 from tests.functional.conftest import list_packages

tests/functional/test_poetry.py

@@ -1,4 +1,5 @@
 """Functional tests for ``session.poetry``."""
+
 import nox_poetry
 from tests.functional.conftest import Project
 from tests.functional.conftest import list_packages

tests/functional/test_session.py

@@ -1,4 +1,5 @@
 """Functional tests for the `@session` decorator."""
+
 import sys
 from pathlib import Path
 

tests/unit/conftest.py

@@ -1,4 +1,5 @@
 """Fixtures."""
+
 import sys
 from pathlib import Path
 from typing import Any

tests/unit/test_nox_poetry.py

@@ -1,4 +1,5 @@
 """Unit tests."""
+
 from typing import Iterable
 
 import pytest

tests/unit/test_poetry.py

@@ -1,4 +1,5 @@
 """Unit tests for the poetry module."""
+
 from pathlib import Path
 from textwrap import dedent
 from typing import Any

tests/unit/test_sessions.py

@@ -1,4 +1,5 @@
 """Unit tests for the sessions module."""
+
 from textwrap import dedent
 from typing import Callable
 from typing import Iterator
@@ -179,6 +180,7 @@ def test_to_constraints(requirements: str, expected: str) -> None:
     assert to_constraints(requirements) == expected
 
 
+@pytest.mark.xfail(reason="This requirement now seems to be valid.")
 def test_invalid_constraint() -> None:
     """It raises an exception."""
     with pytest.raises(RuntimeError):