Repository navigation
chore(deps): bump softprops/action-gh-release from 2 to 3 - #11
Merged
ffroliva merged 2 commits intoMay 19, 2026
Merged
Conversation
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2 to 3. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@v2...v3) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
github-actions
Bot
added
external-contribution
|
Thanks for the contribution. This PR has been marked as an external contribution and routed for maintainer review. Before merge, please make sure:
GitHub Copilot code review may be requested as an advisory first pass, but maintainer approval is still required. |
ffroliva
deleted the
dependabot/github_actions/softprops/action-gh-release-3
branch
May 19, 2026 15:37
15990166686ll-crypto
pushed a commit
to 15990166686ll-crypto/gflow-cli
that referenced
this pull request
Aug 20, 2026
…t retry + coverage Spec C2 mandates that the reCAPTCHA token is minted INSIDE the retry loop body, on the worker's own Page, EVERY attempt. The T3 base commit minted once outside and reused the (single-use, ~2-min-TTL) token across all 3 attempts -- the deviation flagged HIGH by the council audit. Changes: - generate_video, generate_image, generate_images_batch now own their own per-method retry+mint closure; each attempt checks out a Page, mints a fresh token, builds the body, POSTs. _post_json stays as the retry layer for non-reCAPTCHA routes (createProject, uploadImage, checkStatus, download, download_image, archive_workflow). - Extract _drive_image_generation as the per-shot driver shared by generate_image (single-shot) and generate_images_batch (N parallel asyncio.gather tasks, each with its own retry+mint loop on its own Page). - Extract _build_wire_format_discovery helper so the discovery payload is populated uniformly across the JSON-parse-failure and 4xx-fallthrough raise sites (code-rev MEDIUM-3). - Redact body BEFORE truncating to 200 chars in the discovery payload (audit gap ffroliva#11): security defense-in-depth for bodies that echo our request body containing a reCAPTCHA token. - Add playwright.async_api.Error and TimeoutError to the retry predicate so transport-level Playwright failures (TCP reset, DNS hiccup, connect timeout) retry rather than surfacing raw. - Rename post_with_retry kwarg retry_on_5xx -> _retry_on_5xx (LOW: leading underscore signals intentionally unused). - Migrate existing image/video tests off _post_json mocking onto page.request.post interception so they exercise the new code path. - Add 4 retry tests (Playwright error retried, Playwright timeout retried, jittered-exponential default schedule, retry_after cap). - Add 3 spec-C2 / discovery tests (token re-minted every attempt on generate_image + generate_video, WireFormatError full discovery, body prefix redacted excludes tokens). Quality gates: ruff/format/pyright green; 261 tests passing (was 252); _retry.py coverage 76% -> 93%; overall 84%.
15990166686ll-crypto
pushed a commit
to 15990166686ll-crypto/gflow-cli
that referenced
this pull request
Aug 20, 2026
HIGH ffroliva#1: wrap setup() body in try/except BaseException so that partial-setup failures (e.g. ctx.new_page raises) call teardown() before re-raising, preventing playwright/context handle leaks. HIGH ffroliva#2: replace bare `TimeoutError` catch on asyncio.wait_for with builtin `TimeoutError` (project target py311; ruff UP041 prefers builtin over asyncio alias). MEDIUM ffroliva#10: replace non-deterministic `__hash__()` seed with stable `int(sha256(name.encode()).hexdigest(), 16) % 2**31`; import hashlib. MEDIUM ffroliva#11: add class-level docstring warning about single-flight profile_dir exclusivity (spec § 5.4.4). MEDIUM ffroliva#12: extract _is_retry out of the public generate_images() signature into private _generate_images_inner(); public method matches Protocol exactly. LOW (bonus): remove dead `if TYPE_CHECKING: pass` block. Tests: 10 → 12 (added T8 partial-setup leak guard, T9 deterministic seed). pyright: 0 errors. ruff: 0 warnings.
15990166686ll-crypto
pushed a commit
to 15990166686ll-crypto/gflow-cli
that referenced
this pull request
Aug 24, 2026
…t retry + coverage Spec C2 mandates that the reCAPTCHA token is minted INSIDE the retry loop body, on the worker's own Page, EVERY attempt. The T3 base commit minted once outside and reused the (single-use, ~2-min-TTL) token across all 3 attempts -- the deviation flagged HIGH by the council audit. Changes: - generate_video, generate_image, generate_images_batch now own their own per-method retry+mint closure; each attempt checks out a Page, mints a fresh token, builds the body, POSTs. _post_json stays as the retry layer for non-reCAPTCHA routes (createProject, uploadImage, checkStatus, download, download_image, archive_workflow). - Extract _drive_image_generation as the per-shot driver shared by generate_image (single-shot) and generate_images_batch (N parallel asyncio.gather tasks, each with its own retry+mint loop on its own Page). - Extract _build_wire_format_discovery helper so the discovery payload is populated uniformly across the JSON-parse-failure and 4xx-fallthrough raise sites (code-rev MEDIUM-3). - Redact body BEFORE truncating to 200 chars in the discovery payload (audit gap ffroliva#11): security defense-in-depth for bodies that echo our request body containing a reCAPTCHA token. - Add playwright.async_api.Error and TimeoutError to the retry predicate so transport-level Playwright failures (TCP reset, DNS hiccup, connect timeout) retry rather than surfacing raw. - Rename post_with_retry kwarg retry_on_5xx -> _retry_on_5xx (LOW: leading underscore signals intentionally unused). - Migrate existing image/video tests off _post_json mocking onto page.request.post interception so they exercise the new code path. - Add 4 retry tests (Playwright error retried, Playwright timeout retried, jittered-exponential default schedule, retry_after cap). - Add 3 spec-C2 / discovery tests (token re-minted every attempt on generate_image + generate_video, WireFormatError full discovery, body prefix redacted excludes tokens). Quality gates: ruff/format/pyright green; 261 tests passing (was 252); _retry.py coverage 76% -> 93%; overall 84%.
15990166686ll-crypto
pushed a commit
to 15990166686ll-crypto/gflow-cli
that referenced
this pull request
Aug 24, 2026
HIGH ffroliva#1: wrap setup() body in try/except BaseException so that partial-setup failures (e.g. ctx.new_page raises) call teardown() before re-raising, preventing playwright/context handle leaks. HIGH ffroliva#2: replace bare `TimeoutError` catch on asyncio.wait_for with builtin `TimeoutError` (project target py311; ruff UP041 prefers builtin over asyncio alias). MEDIUM ffroliva#10: replace non-deterministic `__hash__()` seed with stable `int(sha256(name.encode()).hexdigest(), 16) % 2**31`; import hashlib. MEDIUM ffroliva#11: add class-level docstring warning about single-flight profile_dir exclusivity (spec § 5.4.4). MEDIUM ffroliva#12: extract _is_retry out of the public generate_images() signature into private _generate_images_inner(); public method matches Protocol exactly. LOW (bonus): remove dead `if TYPE_CHECKING: pass` block. Tests: 10 → 12 (added T8 partial-setup leak guard, T9 deterministic seed). pyright: 0 errors. ruff: 0 warnings.
15990166686ll-crypto
pushed a commit
to 15990166686ll-crypto/gflow-cli
that referenced
this pull request
Aug 24, 2026
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2 to 3. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@v2...v3) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Flavio Oliva <ffroliva@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps softprops/action-gh-release from 2 to 3.
Release notes
Sourced from softprops/action-gh-release's releases.
... (truncated)
Changelog
Sourced from softprops/action-gh-release's changelog.
Commits
b430933release: cut v3.0.0 for Node 24 upgrade (#670)c2e35e0chore(deps): bump the npm group across 1 directory with 7 updates (#783)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)