Fix all bandit security findings (medium + high) #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| workflow_dispatch: | |
| jobs: | |
| # Build universal Python wheel and source distribution | |
| build-wheel: | |
| name: Build wheel + sdist | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install build tools | |
| run: python -m pip install --upgrade pip build | |
| - name: Build wheel and sdist | |
| run: python -m build | |
| - name: Verify wheel | |
| run: | | |
| pip install dist/*.whl | |
| rag-mini --help | |
| - name: Upload wheel | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: wheel | |
| path: dist/*.whl | |
| - name: Upload sdist | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sdist | |
| path: dist/*.tar.gz | |
| # Build portable zipapp | |
| build-zipapp: | |
| name: Build zipapp (.pyz) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| - name: Build zipapp | |
| run: python scripts/build_pyz.py | |
| - name: Upload zipapp | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: zipapp | |
| path: dist/rag-mini.pyz | |
| # Build Linux .deb package | |
| build-deb: | |
| name: Build .deb package | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install build tools | |
| run: | | |
| python -m pip install --upgrade pip build | |
| sudo apt-get update | |
| sudo apt-get install -y ruby ruby-dev | |
| sudo gem install fpm | |
| - name: Extract version | |
| id: version | |
| run: | | |
| VERSION=${GITHUB_REF#refs/tags/v} | |
| if [ "$VERSION" = "$GITHUB_REF" ]; then | |
| VERSION=$(python -c "import mini_rag; print(mini_rag.__version__)") | |
| fi | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| - name: Build .deb | |
| run: | | |
| pip install -r requirements.txt | |
| pip install -e . | |
| mkdir -p dist | |
| fpm \ | |
| -s python \ | |
| -t deb \ | |
| --name fss-mini-rag \ | |
| --version ${{ steps.version.outputs.version }} \ | |
| --description "Self-contained research and code search system" \ | |
| --url "https://github.com/FSSCoding/Fss-Mini-Rag" \ | |
| --maintainer "Brett Fox <brett@foxsoftwaresolutions.com.au>" \ | |
| --license MIT \ | |
| --depends python3 \ | |
| --depends python3-tk \ | |
| --depends python3-venv \ | |
| --depends python3-pip \ | |
| --category science \ | |
| --python-bin python3 \ | |
| --python-install-lib /opt/fss-mini-rag/lib/python3/site-packages \ | |
| --python-install-bin /usr/local/bin \ | |
| --package dist/fss-mini-rag_${{ steps.version.outputs.version }}_amd64.deb \ | |
| . | |
| - name: Upload .deb | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: deb | |
| path: dist/*.deb | |
| # Build Linux AppImage | |
| build-appimage: | |
| name: Build AppImage | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Extract version | |
| id: version | |
| run: | | |
| VERSION=${GITHUB_REF#refs/tags/v} | |
| if [ "$VERSION" = "$GITHUB_REF" ]; then | |
| VERSION=$(python -c "import mini_rag; print(mini_rag.__version__)") | |
| fi | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install -e . | |
| sudo apt-get update | |
| sudo apt-get install -y libfuse2 | |
| - name: Download appimagetool | |
| run: | | |
| wget -q "https://github.com/AppImage/AppImageKit/releases/download/continuous/appimagetool-x86_64.AppImage" -O appimagetool | |
| chmod +x appimagetool | |
| - name: Download Python AppImage base | |
| run: | | |
| wget -q "https://github.com/niess/python-appimage/releases/download/python3.11/python3.11.9-cp311-cp311-manylinux_2_28_x86_64.AppImage" \ | |
| -O python.AppImage || \ | |
| wget -q "https://github.com/niess/python-appimage/releases/latest/download/python3.11.9-cp311-cp311-manylinux_2_28_x86_64.AppImage" \ | |
| -O python.AppImage | |
| chmod +x python.AppImage | |
| - name: Build AppImage | |
| run: | | |
| # Extract Python base | |
| ./python.AppImage --appimage-extract | |
| mv squashfs-root AppDir | |
| # Install app into AppImage | |
| PYTHON_BIN=$(ls AppDir/usr/bin/python3.* | head -1) | |
| "${PYTHON_BIN}" -m pip install --upgrade pip | |
| "${PYTHON_BIN}" -m pip install -r requirements.txt | |
| "${PYTHON_BIN}" -m pip install . | |
| # Copy AppRun entry point from repo | |
| cp packaging/linux/AppRun AppDir/AppRun | |
| chmod +x AppDir/AppRun | |
| # Add desktop file and icon | |
| cp packaging/linux/fss-mini-rag.desktop AppDir/ | |
| cp assets/Fss_Mini_Rag.png AppDir/fss-mini-rag.png | |
| mkdir -p AppDir/usr/share/icons/hicolor/256x256/apps/ | |
| cp assets/Fss_Mini_Rag.png AppDir/usr/share/icons/hicolor/256x256/apps/fss-mini-rag.png | |
| # Build | |
| ARCH=x86_64 ./appimagetool AppDir dist/FSS-Mini-RAG-${{ steps.version.outputs.version }}-x86_64.AppImage | |
| - name: Upload AppImage | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: appimage | |
| path: dist/*.AppImage | |
| # Build Windows standalone installer | |
| build-windows-installer: | |
| name: Build Windows installer | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install build tools and dependencies | |
| run: | | |
| python -m pip install --upgrade pip build | |
| pip install -r requirements.txt | |
| pip install -e . | |
| - name: Extract version | |
| id: version | |
| shell: bash | |
| run: | | |
| VERSION=${GITHUB_REF#refs/tags/v} | |
| if [ "$VERSION" = "$GITHUB_REF" ]; then | |
| VERSION=$(python -c "import mini_rag; print(mini_rag.__version__)") | |
| fi | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| - name: Install Inno Setup | |
| run: | | |
| choco install innosetup -y --no-progress | |
| shell: cmd | |
| - name: Build installer | |
| run: | | |
| $env:FSS_VERSION = "${{ steps.version.outputs.version }}" | |
| powershell -ExecutionPolicy Bypass -File packaging\windows\build-installer.ps1 -Version "${{ steps.version.outputs.version }}" | |
| shell: pwsh | |
| - name: Upload Windows installer | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: windows-installer | |
| path: dist/*-setup.exe | |
| # Create GitHub Release with all artifacts | |
| create-release: | |
| name: Create GitHub Release | |
| needs: [build-wheel, build-zipapp, build-deb, build-appimage, build-windows-installer] | |
| runs-on: ubuntu-latest | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Extract version | |
| id: version | |
| run: | | |
| VERSION=${GITHUB_REF#refs/tags/v} | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: artifacts/ | |
| - name: Prepare release assets | |
| run: | | |
| mkdir -p release/ | |
| cp artifacts/wheel/*.whl release/ | |
| cp artifacts/sdist/*.tar.gz release/ | |
| cp artifacts/zipapp/*.pyz release/ | |
| cp artifacts/deb/*.deb release/ | |
| cp artifacts/appimage/*.AppImage release/ | |
| cp artifacts/windows-installer/*-setup.exe release/ | |
| ls -lh release/ | |
| - name: Generate changelog | |
| id: changelog | |
| run: | | |
| LAST_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "") | |
| if [ -n "$LAST_TAG" ]; then | |
| COMMITS=$(git log --oneline "$LAST_TAG"..HEAD --pretty=format:"- %s") | |
| else | |
| COMMITS=$(git log --oneline --pretty=format:"- %s" -20) | |
| fi | |
| echo "commits<<EOF" >> $GITHUB_OUTPUT | |
| echo "$COMMITS" >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: release/* | |
| body: | | |
| ## FSS-Mini-RAG v${{ steps.version.outputs.version }} | |
| ### Downloads | |
| | Platform | File | Notes | | |
| |----------|------|-------| | |
| | **Windows** | `fss-mini-rag-${{ steps.version.outputs.version }}-setup.exe` | Standalone installer, no Python needed | | |
| | **Linux (Debian/Ubuntu)** | `fss-mini-rag_${{ steps.version.outputs.version }}_amd64.deb` | `sudo dpkg -i *.deb` | | |
| | **Linux (Portable)** | `FSS-Mini-RAG-${{ steps.version.outputs.version }}-x86_64.AppImage` | Single file, `chmod +x` and run | | |
| | **Any (pip)** | `fss_mini_rag-${{ steps.version.outputs.version }}-py3-none-any.whl` | `pip install *.whl` | | |
| | **Any (portable)** | `rag-mini.pyz` | `python rag-mini.pyz` (needs Python) | | |
| ### One-Line Install (Linux/macOS) | |
| ```bash | |
| curl -fsSL https://raw.githubusercontent.com/FSSCoding/Fss-Mini-Rag/main/install.sh | bash | |
| ``` | |
| ### Changes | |
| ${{ steps.changelog.outputs.commits }} | |
| draft: false | |
| prerelease: false | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |