Skip to content

chore(deps): consolidate the safe Dependabot backlog + unbreak lint CI #124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lingzhong wants to merge 6 commits into
base: main
Choose a base branch
from
Open

chore(deps): consolidate the safe Dependabot backlog + unbreak lint CI #124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b021c8f
chore(ci-deps): bump github-actions group (#111)
lingzhong Jun 5, 2026
ba0efa6
chore(deps): batch safe dependency updates for x402_a2a
lingzhong Jun 5, 2026
84d076c
chore(deps): batch safe dependency updates for adk-demo
lingzhong Jun 5, 2026
30445e7
Update python/examples/adk-demo/pyproject.toml
lingzhong Jun 5, 2026
27f3c5d
ci: pin ruff to 0.15.18 in lint workflows
lingzhong Aug 11, 2026
eb42765
chore(deps): refresh consolidated bumps to current Dependabot targets
lingzhong Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/public_pypi_x402_a2a.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,15 +17,15 @@
id-token: write

steps:
- uses: actions/checkout@a44c2b7303e8291c17dec9b43af59ae612a289f7 # 4.1.7

Check warning on line 20 in .github/workflows/public_pypi_x402_a2a.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

ref-version-mismatch 

public_pypi_x402_a2a.yml:20: action's hash pin has mismatched or missing version comment: points to unknown ref

Check failure on line 20 in .github/workflows/public_pypi_x402_a2a.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

impostor-commit 

public_pypi_x402_a2a.yml:20: commit with no history in referenced repository: uses a commit that doesn't belong to the specified org/repo

- name: Set up Python 3.11
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f390daa34 # v4.8.0

Check warning on line 23 in .github/workflows/public_pypi_x402_a2a.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

ref-version-mismatch 

public_pypi_x402_a2a.yml:23: action's hash pin has mismatched or missing version comment: points to commit b64ffcaf5b41

Check failure on line 23 in .github/workflows/public_pypi_x402_a2a.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

impostor-commit 

public_pypi_x402_a2a.yml:23: commit with no history in referenced repository: uses a commit that doesn't belong to the specified org/repo
with:
python-version: "3.11"

- name: Install uv
uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
cache-dependency-glob: "uv.lock"
Expand All @@ -40,6 +40,6 @@
echo "version=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)" >> $GITHUB_OUTPUT

- name: Publish package
uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
with:
packages-dir: python/x402_a2a/dist/
6 changes: 3 additions & 3 deletions .github/workflows/python-examples-adk-demo.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,17 @@
workflow_dispatch:

jobs:
lint:

Check warning on line 10 in .github/workflows/python-examples-adk-demo.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions 

python-examples-adk-demo.yml:10: overly broad permissions: default permissions used due to no permissions: block
runs-on: ubuntu-latest
defaults:
run:
working-directory: python/examples/adk-demo
steps:
- name: Checkout code
uses: actions/checkout@v5

Check failure on line 17 in .github/workflows/python-examples-adk-demo.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses 

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 17 in .github/workflows/python-examples-adk-demo.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses 

python-examples-adk-demo.yml:17: unpinned action reference: action is not pinned to a hash (required by blanket policy)

- name: Install uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@v8.1.0

Check failure on line 20 in .github/workflows/python-examples-adk-demo.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses 

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 20 in .github/workflows/python-examples-adk-demo.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses 

python-examples-adk-demo.yml:20: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
enable-cache: true
cache-dependency-glob: "uv.lock"
Expand All @@ -29,7 +29,7 @@
run: uv sync --group lint

- name: Lint
run: uvx ruff check --output-format=github .
run: uvx ruff@0.15.18 check --output-format=github .

- name: Format
run: uvx ruff format --check .
run: uvx ruff@0.15.18 format --check .
6 changes: 3 additions & 3 deletions .github/workflows/python-x402-a2a.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,17 @@
workflow_dispatch:

jobs:
lint:

Check warning on line 10 in .github/workflows/python-x402-a2a.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions 

python-x402-a2a.yml:10: overly broad permissions: default permissions used due to no permissions: block
runs-on: ubuntu-latest
defaults:
run:
working-directory: python/x402_a2a
steps:
- name: Checkout code
uses: actions/checkout@v5

Check failure on line 17 in .github/workflows/python-x402-a2a.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses 

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 17 in .github/workflows/python-x402-a2a.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses 

python-x402-a2a.yml:17: unpinned action reference: action is not pinned to a hash (required by blanket policy)

- name: Install uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@v8.1.0

Check failure on line 20 in .github/workflows/python-x402-a2a.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses 

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 20 in .github/workflows/python-x402-a2a.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses 

python-x402-a2a.yml:20: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
enable-cache: true
cache-dependency-glob: "uv.lock"
Expand All @@ -29,7 +29,7 @@
run: uv sync --group lint

- name: Lint
run: uvx ruff check --output-format=github .
run: uvx ruff@0.15.18 check --output-format=github .

- name: Format
run: uvx ruff format --check .
run: uvx ruff@0.15.18 format --check .
2 changes: 1 addition & 1 deletion .github/workflows/release-please.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,6 @@
runs-on: ubuntu-latest
if: github.repository_owner == 'google-agentic-commerce'
steps:
- uses: googleapis/release-please-action@v4
- uses: googleapis/release-please-action@v5

Check failure on line 17 in .github/workflows/release-please.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses 

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 17 in .github/workflows/release-please.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses 

release-please.yml:17: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
token: ${{ secrets.BOT_TOKEN }}
12 changes: 6 additions & 6 deletions python/examples/adk-demo/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,14 +5,14 @@ description = "ADK x402 Payment Protocol Demo using refactored x402_a2a package"
requires-python = ">=3.13"
dependencies = [
"a2a-sdk",
"google-adk>=0.5.0",
"google-adk>=1.33.0",
"x402>=0.1.4",
"click>=8.2.0",
"click>=8.4.1",
"eth-account>=0.13.7",
"httpx>=0.28.1",
"uvicorn>=0.34.2",
"web3>=7.10.0",
"cdp-sdk>=1.20.0",
"uvicorn>=0.49.0",
"web3>=7.16.0",
"cdp-sdk>=1.47.1",
"x402-a2a",
]

Expand Down Expand Up @@ -40,5 +40,5 @@ target-version = "py313"

[dependency-groups]
lint = [
"ruff>=0.13.1",
"ruff>=0.15.18",
]
1,065 changes: 772 additions & 293 deletions python/examples/adk-demo/uv.lock
View file
Open in desktop

Large diffs are not rendered by default.

16 changes: 8 additions & 8 deletions python/x402_a2a/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,20 +15,20 @@ dependencies = [
"x402>=0.2.0", # For x402 payment protocol
"eth-account>=0.13.7", # For Ethereum account management
"httpx>=0.28.1", # For async HTTP client
"pydantic>=2.0.0", # For data validation
"pydantic>=2.13.4", # For data validation
]

[dependency-groups]
dev = [
"pytest>=9.0.3",
"pytest-asyncio>=1.1.0",
"pytest-cov>=6.2.1",
"pytest-mock>=3.14.1",
"trio>=0.22.0",
"pytest>=9.1.0",
"pytest-asyncio>=1.4.0",
"pytest-cov>=7.1.0",
"pytest-mock>=3.15.1",
"trio>=0.33.0",
]
lint = [
"ruff>=0.13.1",
"mypy>=1.18.0",
"ruff>=0.15.18",
"mypy>=1.20.2",
]

[project.scripts]
Expand Down
947 changes: 560 additions & 387 deletions python/x402_a2a/uv.lock
View file
Open in desktop

Large diffs are not rendered by default.

Loading