Skip to content

ci: fix main SonarCloud quality gate findings #316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
krowvin wants to merge 4 commits into
base: main
Choose a base branch
from
Open

ci: fix main SonarCloud quality gate findings #316

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c1eac10
ci: fix main SonarCloud reliability and workflow findings
krowvin Sep 10, 2026
10401f2
test: verify dated level deletion with effective-date fallback
krowvin Sep 11, 2026
1409b63
Merge branch 'main' into fix/main-quality-gate
krowvin Sep 15, 2026
defcbaf
Merge branch 'main' into fix/main-quality-gate
krowvin Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/CDA-testing.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ jobs:

# Use actions-poetry to handle installation
- name: Install Poetry and Dependencies
uses: abatilo/actions-poetry@v4
uses: abatilo/actions-poetry@0dd19c9498c3dc8728967849d0d2eae428a8a3d8 # v4

@Enovotny Enovotny Sep 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand this change. Why is simply the version as before not applicable? when we update are we going to have to look for the tag instead of just going @v5?

@krowvin krowvin Sep 22, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sonar flagged this

We could remove that check but it's because of

https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions
And

We could use dependabot to enable this so we don't have to be looking up the hash each time

https://docs.github.com/en/actions/reference/security/secure-use#keeping-the-actions-in-your-workflows-secure-and-up-to-date

We probably aren't pinning hashes in other repo but I've started with all the supply chain stuff going on.

@Enovotny Enovotny Sep 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

alright. sounds good. as long as dependabot is able to update it.


# Set Poetry to use an in-project virtual environment
- name: Configure Poetry for in-project venv
Expand All @@ -85,15 +85,15 @@ jobs:
run: poetry run pytest tests/cda/ --doctest-modules --cov --cov-report=xml:out/coverage.xml

- name: Generate Coverage Report
uses: irongut/CodeCoverageSummary@v1.3.0
uses: irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95 # v1.3.0
with:
filename: out/coverage.xml
format: markdown
output: both
badge: true

- name: Generate Job Summary
uses: x-color/github-actions-job-summary@v0.1.1
uses: x-color/github-actions-job-summary@91bbfe6fb3ba53c9d0304991601cf2508e8098a2 # v0.1.1
with:
file: ./code-coverage-results.md
vars: |-
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/code-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,8 @@ jobs:
# below simply check the source code and fail if they find any files that need to be
# formatted. The code is not automatically reformatted like it is when running the
# pre-commit hooks.
- uses: psf/black@stable
- uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e # stable
with:
# Specify the desired Black version
version: "24.10.0"
- uses: isort/isort-action@v1
- uses: isort/isort-action@24d8a7a51d33ca7f36c3f23598dafa33f7071326 # v1
4 changes: 2 additions & 2 deletions .github/workflows/pypi-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ jobs:
with:
python-version: '3.x'
- name: Install Poetry
uses: abatilo/actions-poetry@v4
uses: abatilo/actions-poetry@0dd19c9498c3dc8728967849d0d2eae428a8a3d8 # v4
- name: Install Dependencies
env:
POETRY_INSTALLER_ONLY_BINARY: ':all:'
Expand Down Expand Up @@ -91,7 +91,7 @@ jobs:
name: package-dist
path: dist/
- name: Publish Distribution To PyPI
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
- name: Sign Distribution
uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0
with:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/testing.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
# Unlike the code-check workflow, this job requires the dev dependencies to be
# installed to make sure we have the necessary, tools, stub files, etc.
- name: Install Poetry
uses: abatilo/actions-poetry@v4
uses: abatilo/actions-poetry@0dd19c9498c3dc8728967849d0d2eae428a8a3d8 # v4

- name: Cache Virtual Environment
uses: actions/cache@v6
Expand All @@ -57,15 +57,15 @@ jobs:
run: poetry run mypy --strict cwms/

- name: Generate Coverage Report
uses: irongut/CodeCoverageSummary@v1.3.0
uses: irongut/CodeCoverageSummary@51cc3a756ddcd398d447c044c02cb6aa83fdae95 # v1.3.0
with:
filename: out/coverage.xml
format: markdown
output: both
badge: true

- name: Generate Job Summary
uses: x-color/github-actions-job-summary@v0.1.1
uses: x-color/github-actions-job-summary@91bbfe6fb3ba53c9d0304991601cf2508e8098a2 # v0.1.1
with:
file: ./code-coverage-results.md
vars: |-
Expand Down
4 changes: 3 additions & 1 deletion compose_files/sql/users.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,16 @@ declare
type office_list_t is table of varchar2(16);

procedure add_full_admin(p_user varchar2, p_offices office_list_t) is
i pls_integer := p_offices.first;
begin
for i in 1 .. p_offices.count loop
while i is not null loop
cwms_sec.add_cwms_user(p_user, NULL, p_offices(i));
cwms_sec.add_user_to_group(p_user, 'All Users', p_offices(i));
cwms_sec.add_user_to_group(p_user, 'CWMS Users', p_offices(i));
cwms_sec.add_user_to_group(p_user, 'TS ID Creator', p_offices(i));
cwms_sec.add_user_to_group(p_user, 'CWMS User Admins', p_offices(i));
cwms_sec.add_user_to_group(p_user, 'CWMS PD Users', p_offices(i));
i := p_offices.next(i);
end loop;
end;
begin
Expand Down
17 changes: 13 additions & 4 deletions tests/cda/levels/location_levels_cda_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@

import cwms.levels.location_levels as location_levels
import cwms.locations.physical_locations as locations
from cwms.api import ApiError

# Load test location level from tests/cda/resources/location_level.json
LEVEL_RESOURCE_PATH = Path(__file__).parent.parent / "resources" / "location_level.json"
Expand Down Expand Up @@ -111,22 +112,30 @@ def test_delete_loc_level():
data["level-date"] = temp_effective_date.isoformat()
data["constant-value"] = 300
location_levels.store_location_level(data)
created = location_levels.get_location_level(
level_id=TEST_LEVEL_ID,
office_id=TEST_OFFICE,
effective_date=temp_effective_date,
unit=TEST_UNIT,
)
assert pd.to_datetime(created.json["level-date"]) == temp_effective_date
location_levels.delete_location_level(
location_level_id=TEST_LEVEL_ID,
office_id=TEST_OFFICE,
effective_date=temp_effective_date,
)
# Try to get it, should raise or return None/empty
# CDA may return the previous effective level after this dated level is deleted.
try:
level = location_levels.get_location_level(
level_id=TEST_LEVEL_ID,
office_id=TEST_OFFICE,
effective_date=temp_effective_date,
unit=TEST_UNIT,
)
assert level.df.empty
except Exception:
pass
except ApiError as error:
assert error.response.status_code == 404
else:
assert pd.to_datetime(level.json["level-date"]) != temp_effective_date


def test_get_loc_level_ts():
Expand Down
12 changes: 4 additions & 8 deletions tests/cda/levels/specified_levels_cda_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,11 +97,7 @@ def test_delete_specified_level():
specified_levels.delete_specified_level(
specified_level_id=temp_id, office_id=TEST_OFFICE
)
# Try to get it, should raise or return None/empty
try:
levels = specified_levels.get_specified_levels(
specified_level_mask=temp_id, office_id=TEST_OFFICE
)
assert not any(lvl.get("id") == temp_id for lvl in levels.json)
except Exception:
pass
levels = specified_levels.get_specified_levels(
specified_level_mask=temp_id, office_id=TEST_OFFICE
)
assert not any(lvl.get("id") == temp_id for lvl in levels.json)
Loading