From ec74ed6b3d60c62862bbd46265dd739e919fbd66 Mon Sep 17 00:00:00 2001 From: Morten Brekkevold Date: Fri, 2 Oct 2026 08:20:15 +0200 Subject: [PATCH 1/6] Diff test names against the PR's actual base (#2069) * Diff test names against the PR's actual base The test name check runs on `pull_request_target`, where the bare `actions/checkout` lands on the default branch rather than the branch the pull request targets. Taking the merge base from `HEAD` therefore compares against `main` no matter what the pull request is based on, and every commit another base branch carries that `main` lacks gets attributed to the pull request. Almost every Argus pull request targets `main`, so the wrong baseline happens to be the right one and this rarely shows. It misfires on anything based on a branch such as `alpha/2.0.x`. The identical bug in NAV was live rather than latent, because bugfixes there routinely target a version branch, and the check reported pre-existing tests as new on every one of them. Take the merge base from the pull request's own base branch instead. The checkout is deliberately left alone, so `check_test_names.py` keeps coming from the default branch and the job keeps working even when a base branch predates the script. * Document why this job must not check out PR code `pull_request_target` gives this job a write token and access to secrets even for pull requests from forks. That is safe only for as long as nothing from the pull request is checked out or executed here, which is an invariant the file states nowhere. Adding a `ref:` to the checkout looks like an obvious correctness fix to anyone reading the step in isolation, and would silently turn this into a workflow that runs fork-authored code with our credentials. Say so where someone would make the change. --- .github/workflows/check-test-names.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check-test-names.yml b/.github/workflows/check-test-names.yml index c3fd0dbb9..decacf76f 100644 --- a/.github/workflows/check-test-names.yml +++ b/.github/workflows/check-test-names.yml @@ -11,11 +11,19 @@ jobs: runs-on: ubuntu-latest name: Check test naming convention steps: + # This job runs on pull_request_target, so it has a write token and access + # to secrets even when the pull request comes from a fork. Nothing from the + # pull request may be checked out or executed here: no build, no install, + # no running its tests or scripts. Leaving this checkout bare keeps us on + # the default branch, and that is the only reason it is safe to run + # check_test_names.py below. Adding a ref: pointing at the pull request + # head would hand its author our credentials. - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false + # Fetch only. The head is read as data by git diff, never checked out. - name: Fetch PR head run: git fetch origin "+refs/pull/${PR_NUMBER}/head:refs/remotes/pull/head" env: @@ -23,8 +31,11 @@ jobs: - name: Check new test names id: check + env: + BASE_REF: ${{ github.event.pull_request.base.ref }} run: | - merge_base=$(git merge-base HEAD refs/remotes/pull/head) + # Name the base branch explicitly; HEAD is not it + merge_base=$(git merge-base "origin/$BASE_REF" refs/remotes/pull/head) output=$(git diff "$merge_base" refs/remotes/pull/head --unified=0 | python3 checks/check_test_names.py --stdin --format markdown 2>&1) && has_violations=false || has_violations=true echo "$output" { From ed47dff1c1aa4360c3cf0eca29c174ff403e19cc Mon Sep 17 00:00:00 2001 From: Johanna England Date: Sun, 27 Sep 2026 09:51:31 +0200 Subject: [PATCH 2/6] Add option to set base url in create_source --- changelog.d/2081.added.md | 1 + docs/development/management-commands.rst | 6 ++++++ .../incident/management/commands/create_source.py | 4 +++- .../management_commands/test_create_source.py | 15 +++++++++++++++ 4 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 changelog.d/2081.added.md diff --git a/changelog.d/2081.added.md b/changelog.d/2081.added.md new file mode 100644 index 000000000..177ff8bbf --- /dev/null +++ b/changelog.d/2081.added.md @@ -0,0 +1 @@ +Added options to set base url for source created with management command 'create_source' diff --git a/docs/development/management-commands.rst b/docs/development/management-commands.rst index df8e5952a..043e6b643 100644 --- a/docs/development/management-commands.rst +++ b/docs/development/management-commands.rst @@ -259,6 +259,12 @@ To add a custom source system type, instead of the default `argus`, add the $ python manage.py create_source -t "Custom type" +To add a base_url add the `-u` flag to the command as such: + + .. code:: console + + $ python manage.py create_source -u "https://example.com" + .. _check-token-expiry: diff --git a/src/argus/incident/management/commands/create_source.py b/src/argus/incident/management/commands/create_source.py index 7971c908f..531181156 100644 --- a/src/argus/incident/management/commands/create_source.py +++ b/src/argus/incident/management/commands/create_source.py @@ -14,13 +14,15 @@ def add_arguments(self, parser): parser.add_argument( "-t", "--source-type", type=str, help="Create/use the source type instead of argus" ) + parser.add_argument("-u", "--base-url", type=str, help="Add this base-url to the created source") def handle(self, *args, **options): source = options["source"] source_type = options.get("source_type") or "argus" + base_url = options.get("base_url") or "" if SourceSystem.objects.filter(name=source, type__name=source_type).exists(): return with transaction.atomic(): user = SourceUserFactory(username=source) sst = SourceSystemTypeFactory(name=source_type.lower()) - SourceSystemFactory(user=user, name=source, type=sst) + SourceSystemFactory(user=user, name=source, type=sst, base_url=base_url) diff --git a/tests/incident/management_commands/test_create_source.py b/tests/incident/management_commands/test_create_source.py index 487deb253..bfbd5b19b 100644 --- a/tests/incident/management_commands/test_create_source.py +++ b/tests/incident/management_commands/test_create_source.py @@ -35,6 +35,21 @@ def test_create_source_will_create_source_with_set_type(self): self.assertTrue(SourceSystem.objects.exclude(id__in=previous_source_pks).filter(type_id=source_type).exists()) + def test_create_source_will_create_source_with_set_base_url(self): + previous_source_pks = [source.id for source in SourceSystem.objects.all()] + source_name = "source name" + base_url = "https://example.com" + call_command("create_source", source_name, base_url=base_url) + + self.assertTrue(SourceSystem.objects.exclude(id__in=previous_source_pks).filter(base_url=base_url).exists()) + + def test_create_source_will_create_source_with_base_url_empty_string_if_not_set(self): + previous_source_pks = [source.id for source in SourceSystem.objects.all()] + source_name = "source name" + call_command("create_source", source_name) + + self.assertTrue(SourceSystem.objects.exclude(id__in=previous_source_pks).filter(base_url="").exists()) + def test_create_source_will_use_already_existing_source_system_type(self): previous_source_pks = [source.id for source in SourceSystem.objects.all()] source_name = "source name" From bf605bc9b4aa3dab91ff0dccdf4d2d35e29ceee9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 13 Oct 2026 18:51:04 +0000 Subject: [PATCH 3/6] Bump actions/upload-artifact from 7.0.1 to 7.0.2 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.1 to 7.0.2. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/python.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml index 7602f5eb5..e1de5fc15 100644 --- a/.github/workflows/python.yml +++ b/.github/workflows/python.yml @@ -112,7 +112,7 @@ jobs: - name: Upload test reports (${{ matrix.python-version }}) if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: test-reports-${{ matrix.python-version }} path: | From 2a2d2501b3437e1eb666d966259c0bbc1bfb5c6c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 16:03:53 +0000 Subject: [PATCH 4/6] Bump EnricoMi/publish-unit-test-result-action from 2.24.0 to 2.25.0 Bumps [EnricoMi/publish-unit-test-result-action](https://github.com/enricomi/publish-unit-test-result-action) from 2.24.0 to 2.25.0. - [Release notes](https://github.com/enricomi/publish-unit-test-result-action/releases) - [Commits](https://github.com/enricomi/publish-unit-test-result-action/compare/d0a4676d0e0b938bc201470d88276b7c74c712b3...7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d) --- updated-dependencies: - dependency-name: EnricoMi/publish-unit-test-result-action dependency-version: 2.25.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/publish-test-results.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-test-results.yml b/.github/workflows/publish-test-results.yml index 89034727d..235dc0b28 100644 --- a/.github/workflows/publish-test-results.yml +++ b/.github/workflows/publish-test-results.yml @@ -34,7 +34,7 @@ jobs: done - name: "Publish test results" - uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0 + uses: EnricoMi/publish-unit-test-result-action@7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d # v2.25.0 with: commit: ${{ github.event.workflow_run.head_sha }} check_name: "Test results" From af50fd9ef76271473f861ef4c2de5da2eae77af6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Oct 2026 16:03:57 +0000 Subject: [PATCH 5/6] Bump actions/create-github-app-token from 3.2.0 to 3.3.0 Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 3.2.0 to 3.3.0. - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/create-github-app-token/compare/bcd2ba49218906704ab6c1aa796996da409d3eb1...64ab729a6294000f5aa4a4bc0b73d1f32bc45510) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/trigger-argus-docker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trigger-argus-docker.yml b/.github/workflows/trigger-argus-docker.yml index 763efd6e5..da458a2d6 100644 --- a/.github/workflows/trigger-argus-docker.yml +++ b/.github/workflows/trigger-argus-docker.yml @@ -10,7 +10,7 @@ jobs: steps: - name: Generate an installation access token id: generate-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: app-id: ${{ vars.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} From afcf9b8e34a1ef56707bd125b56423366a592f9a Mon Sep 17 00:00:00 2001 From: Hanne Moa Date: Thu, 22 Oct 2026 14:35:40 +0200 Subject: [PATCH 6/6] Update changelog for release v2.10.2 --- CHANGELOG.md | 40 +++++++++++++++++++ .../+django-tasks-db-upgrade.changed.md | 4 -- changelog.d/+django-tasks-db-upgrade.fixed.md | 2 - changelog.d/+emudhra.changed.md | 1 - changelog.d/2061.changed.md | 2 - changelog.d/2072.fixed.md | 4 -- changelog.d/2081.added.md | 1 - 7 files changed, 40 insertions(+), 14 deletions(-) delete mode 100644 changelog.d/+django-tasks-db-upgrade.changed.md delete mode 100644 changelog.d/+django-tasks-db-upgrade.fixed.md delete mode 100644 changelog.d/+emudhra.changed.md delete mode 100644 changelog.d/2061.changed.md delete mode 100644 changelog.d/2072.fixed.md delete mode 100644 changelog.d/2081.added.md diff --git a/CHANGELOG.md b/CHANGELOG.md index b19588dda..2a5b39480 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,46 @@ This project uses [*towncrier*](https://towncrier.readthedocs.io/) and the chang +## [2.10.2] - 2026-10-22 + +Mini-release. The most important bit is fixing a dependency problem +that affects the task queue. The most visible bit is "Level" in the +filter box should no longer magically flip to the middle position for +no reason. + +Do upgrade if: + +- using Argus to send notifications +- using the planned maintenance subsystem + +### Added + +- Added options to set base url for source created with management + command `create_source` + ([#2081](https://github.com/Uninett/Argus/issues/2081)) + +### Changed + +- Altered helper function `get_version()` so that it either returns + a valid version string for Argus, or "unknown", and nothing else. + ([#2061](https://github.com/Uninett/Argus/issues/2061)) +- We now explicitly depend on "django-tasks" since how "django-tasks-db" + depends on "django-tasks" has changed. We cannot do it the new way, by + depending on "django-tasks-db[compat]", since that conflicts with + Django 6.1, which we still want to be able to test on. + +### Fixed + +- Fixed a problem with `maxlevel` in the filter box caused by the + default of an HTML range-input defaulting to the middle value if no + value is given. It now defaults to the maximum level, "5", as it + should. This should cut down on maxlevel suddenly flipping to "3" for + apparently no reason. + ([#2072](https://github.com/Uninett/Argus/issues/2072)) +- Fixed a dependency issue with the most recent "django-tasks-db", by + always depending directly on "django-tasks". + + ## [2.10.1] - 2026-10-21 Security release! Install this version *after* having made sure that the OS diff --git a/changelog.d/+django-tasks-db-upgrade.changed.md b/changelog.d/+django-tasks-db-upgrade.changed.md deleted file mode 100644 index bcc92aa04..000000000 --- a/changelog.d/+django-tasks-db-upgrade.changed.md +++ /dev/null @@ -1,4 +0,0 @@ -We now explicitly depend on "django-tasks" since how "django-tasks-db" depends -on "django-tasks" has changed. We cannot do it the new way, by depending on -"django-tasks-db[compat]", since that conflicts with Django 6.1, which we still -want to be able to test on. diff --git a/changelog.d/+django-tasks-db-upgrade.fixed.md b/changelog.d/+django-tasks-db-upgrade.fixed.md deleted file mode 100644 index aedffba9f..000000000 --- a/changelog.d/+django-tasks-db-upgrade.fixed.md +++ /dev/null @@ -1,2 +0,0 @@ -Fixed a dependency issue with the most recent "django-tasks-db", by always -depending directly on "djabgo-tasks". diff --git a/changelog.d/+emudhra.changed.md b/changelog.d/+emudhra.changed.md deleted file mode 100644 index 5032b7d7a..000000000 --- a/changelog.d/+emudhra.changed.md +++ /dev/null @@ -1 +0,0 @@ -Security-release upgrading bundled TLS root certificates in the subdependency "certifi". diff --git a/changelog.d/2061.changed.md b/changelog.d/2061.changed.md deleted file mode 100644 index a5d4d6381..000000000 --- a/changelog.d/2061.changed.md +++ /dev/null @@ -1,2 +0,0 @@ -Altered helper function `get_version()` so that it either returns a valid -version string for Argus, or "unknown", and nothing else. diff --git a/changelog.d/2072.fixed.md b/changelog.d/2072.fixed.md deleted file mode 100644 index b61442b99..000000000 --- a/changelog.d/2072.fixed.md +++ /dev/null @@ -1,4 +0,0 @@ -Fixed a problem with `maxlevel` in the filter box caused by the default of an -HTML range-input defaulting to the middle value if no value is given. It now -defaults to the maximum level, "5", as it should. This should cut down on -maxlevel suddenly flipping to "3" for apparently no reason. diff --git a/changelog.d/2081.added.md b/changelog.d/2081.added.md deleted file mode 100644 index 177ff8bbf..000000000 --- a/changelog.d/2081.added.md +++ /dev/null @@ -1 +0,0 @@ -Added options to set base url for source created with management command 'create_source'