Merge pull request #75 from salsburj/add_github_actions_to_5

add github actions to 5

Author: ruttenb

.github/workflows/ci.yml

@@ -0,0 +1,71 @@
+permissions:
+  contents: read
+  pull-requests: read
+
+name: CI
+
+on: [push, pull_request]
+
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: 3.11
+
+      - name: Install Checkers
+        run: pip install ruff djlint
+
+      - name: ruff
+        run: ruff check .
+        continue-on-error: true
+
+      - name: djlint-formatting
+        run: djlint --check .
+        continue-on-error: true
+
+      - name: djlint-linting
+        run: djlint --lint .
+        continue-on-error: true
+  test:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: django-dynamic-attachments
+          POSTGRES_PASSWORD: django-dynamic-attachments-secret
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: 3.11
+
+      - name: Install requirements
+        run: pip install "django>=5.2.14,<6" "coverage==7.14.0" "ims-bootstrap>=5.3.2,<6"
+          "python-magic>=0.4.27"
+
+      - name: Run Tests (PostgreSQL)
+        run: python manage.py test
+        continue-on-error: true
+
+      - name: Run Tests (SQLite)
+        run: TEST_ENGINE=sqlite python manage.py test
+        continue-on-error: true

.github/workflows/zizmor.yml

@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read         # Only needed for private repos. Needed to clone the repo.
+      actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6

Dockerfile

@@ -3,5 +3,5 @@
 
 def session(*args, **kwargs):
     # Expose utils.session without importing utils from __init__ at module level.
-    from .utils import session as attachment_session
+    from attachments.utils import session as attachment_session
     return attachment_session(*args, **kwargs)

attachments/__init__.py

@@ -1,8 +1,8 @@
 from django import forms
 from django.contrib import admin
 
-from .models import Attachment, Property, Session, Upload
-from .utils import import_class
+from attachments.models import Attachment, Property, Session, Upload
+from attachments.utils import import_class
 
 
 @admin.register(Attachment)
@@ -40,5 +40,3 @@ class UploadInline (admin.TabularInline):
 class SessionAdmin (admin.ModelAdmin):
     list_display = ('uuid', 'user', 'template', 'context', 'date_created')
     inlines = (UploadInline,)
-
-

attachments/admin.py

@@ -11,7 +11,7 @@ def user_has_access(self, request, attachment):
         # otherwise fall back to checking request.user.is_authenticated by
         # default.
         obj = attachment.content_object
-        
+
         if hasattr(obj, 'can_download'):
             return obj.can_download(request, attachment)
 
@@ -20,4 +20,4 @@ def user_has_access(self, request, attachment):
     def get_attach_view(self):
         from attachments.views import AttachView
 
-        return AttachView
+        return AttachView

attachments/apps.py

@@ -1,4 +1,3 @@
-
 class InvalidExtensionException(Exception):
     """Exception raised for an attachment with an invalid extension"""
     pass

attachments/exceptions.py

@@ -1,6 +1,6 @@
 from django import forms
 
-from .models import Attachment, Property, Upload
+from attachments.models import Attachment, Property, Upload
 
 
 PROPERTY_FIELD_CLASSES = {
@@ -14,7 +14,6 @@
 }
 
 
-
 DEFAULT_FORM_CLASS = forms.CharField
 
 try:
@@ -26,7 +25,7 @@
         'model': widgets.Select,
         'radio': widgets.RadioSelect,
         'boolean': widgets.CheckboxInput,
-        }
+    }
     DEFAULT_WIDGET_CLASS = widgets.TextInput
 except ImportError:
     PROPERTY_WIDGET_CLASSES = {
@@ -36,7 +35,7 @@
         'model': forms.Select,
         'radio': forms.RadioSelect,
         'boolean': forms.CheckboxInput,
-        }
+    }
     DEFAULT_WIDGET_CLASS = forms.TextInput
 
 
@@ -60,7 +59,7 @@ def __init__(self, *args, **kwargs):
 
         is_upload = isinstance(instance, Upload)
         is_attachment = isinstance(instance, Attachment)
-        form_data = kwargs.pop('data', self.get_form_data_from_session_data(instance.session.data) if is_upload else {}) 
+        form_data = kwargs.pop('data', self.get_form_data_from_session_data(instance.session.data) if is_upload else {})
         for prop in qs:
             if is_upload:
                 field_key = 'upload-%d-%s' % (instance.pk, prop.slug)
@@ -93,7 +92,7 @@ def formfield(self, prop, field_class=None, data=None, **kwargs):
         defaults.update(kwargs)
         field = field_class(**defaults)
         return field
-    
+
     @staticmethod
     def get_form_data_from_session_data(session_data):
         """
@@ -109,4 +108,4 @@ def get_form_data_from_session_data(session_data):
                 else:
                     form_val = val
                 form_data[key] = form_val
-        return form_data 
+        return form_data

attachments/forms.py

@@ -149,7 +149,7 @@ def model_queryset(self, **kwargs):
         if hasattr(ModelClass, 'field_model_queryset'):
             try:
                 qs = getattr(ModelClass, 'field_model_queryset')(**kwargs)
-            except:
+            except Exception:
                 qs = getattr(ModelClass, 'field_model_queryset')()
         else:
             qs = ModelClass.objects.all()
@@ -234,7 +234,7 @@ def attach(self, obj, storage=None, path=None, data=None, send_signal=True):
     def is_valid(self):
         if not self.content_type:
             return True
-        from .forms import PropertyForm
+        from attachments.forms import PropertyForm
         valids = []
         for upload in self.uploads.all():
             property_form = PropertyForm(self._request.POST, instance=upload, editable_only=False)
@@ -247,7 +247,7 @@ def is_valid(self):
 
     @property
     def upload_forms(self):
-        from .forms import PropertyForm
+        from attachments.forms import PropertyForm
         for upload in self.uploads.all():
             kwargs = {'instance': upload, 'editable_only': False, }
             is_bound = (self._request is not None and (self._request.method == 'POST' or self._request.GET.get('bind-form-data', False)))
@@ -294,8 +294,10 @@ def validate_upload(self, upload):
             if upload.file_size != 0:
                 file_mime = magic.from_file(upload.file_path, mime=True)
 
-                if (set(mimetypes.guess_all_extensions(file_mime)).isdisjoint(set(allowed_exts)) and
-                    file_mime not in mime_types_overrides.get(ext, [])):
+                if (
+                    set(mimetypes.guess_all_extensions(file_mime)).isdisjoint(set(allowed_exts))
+                    and file_mime not in mime_types_overrides.get(ext, [])
+                ):
                     # In case our check for extensions didn't pass we check if the file type (not mimetype)
                     # is white-listed. If so, we can allow the file to be uploaded.
                     allowed_types = self.allowed_file_types.split('\n')
@@ -311,6 +313,7 @@ def validate_upload(self, upload):
         if max_file_size and upload.file_size > max_file_size:
             raise FileSizeException("File is too large to be uploaded, file cannot be greater than {}".format(sizeof_fmt(max_file_size)))
 
+
 class Upload (models.Model):
     session = models.ForeignKey(Session, related_name='uploads', on_delete=models.CASCADE)
     file_path = models.TextField(unique=True)

attachments/models.py

@@ -1,3 +1,3 @@
 {% load bootstrap %}
-{% bootstrap_form form %}
 
+{% bootstrap_form form %}