Promote to 0.4.6 - #42
Merged
Lukas Märdian (slyon) merged 14 commits intoAug 13, 2026
Merged
Conversation
Signed-off-by: Kartik Nema <kartnema@qti.qualcomm.com>
Signed-off-by: Kartik Nema <kartnema@qti.qualcomm.com>
Removes an obsolete upstream workflow that is no longer part of the pkg supported model. No functional replacement is needed. Signed-off-by: Mark Matyas <mmatyas@qti.qualcomm.com>
Addresses all 33 findings from the enterprise zizmor scan:
- template-injection (23x, High) in actions/aws_s3_helper: move all
attacker-controllable ${{ inputs.* }} (and github.workspace)
expansions out of the run: shell into env: vars and reference them
as quoted shell variables. Behavior is unchanged.
- artipacked (7x, Medium): set persist-credentials: false on all
checkouts in actions/sync, codeql.yml, doc_generator.yml and pr.yml.
None rely on the persisted git credential (doc_generator pushes to
gh-pages with an explicit token in the remote URL).
- excessive-permissions (2x, Medium): add least-privilege permissions
blocks (contents: read for pr.yml; contents: write scoped to the
gh-pages deploy job in doc_generator.yml).
- dependabot-cooldown (1x, Medium): add a 7-day cooldown to the
github-actions ecosystem in dependabot.yaml.
Assisted-by: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Mark Matyas <mmatyas@qti.qualcomm.com>
* Move test fixtures out of /etc into /usr/share and /var/lib The test suite's fixtures were installed below /etc/urm/tests/, which made all 32 of them dpkg conffiles. That is wrong on two counts: they are not configuration an administrator is expected to edit, and being conffiles means dpkg prompts about local changes on every upgrade -- for files the test binaries themselves rewrite as they run. The fixtures are not all the same kind of data, so they do not all move to the same place: * Configs/*.yaml are read-only inputs parsed by the tests. Per Debian Policy 9.1.1 that is architecture-independent static data, so they move to /usr/share/urm/tests/configs/. * Configs/ResourceSysFsNodes/*.txt stand in for real sysfs nodes. The resource appliers write to them at runtime via AuxRoutines::writeToFile() (see ResourceRegistry.cpp and ResourceHooks.cpp), so they are variable state and move to /var/lib/urm/tests/nodes/. Rewrite the hardcoded paths in the test sources and fixtures to match, and point the corresponding CMake install() rules at CMAKE_INSTALL_DATADIR and CMAKE_INSTALL_LOCALSTATEDIR instead of CMAKE_INSTALL_SYSCONFDIR. Bug: #39 Assisted-by: Claude:claude-opus-5 Signed-off-by: Lukas Märdian <lukas.maerdian@oss.qualcomm.com>
…stead of /etc/urm (#290) Signed-off-by: Kartik Nema <kartnema@qti.qualcomm.com>
This commit pulls in upstream changes from 'v0.4.6' into the Debian packaging branch. Since upstream project might have content of their own in their .github/ folder (because they have CI stuff on their side), it's important to NOT pick up .github/ folder from upstream, and only leave the .github/ folder from debian packaging branch. The same applies to debian/ folder if upstream has one (which is rare but possible). This commit was generated automatically by qcom-build-utils/scripts/merge_debian_packaging_upstream. Signed-off-by: GitHub Service Bot <githubservice@qti.qualcomm.com>
Signed-off-by: GitHub Service Bot <githubservice@qti.qualcomm.com>
Signed-off-by: Lukas Märdian <lukas.maerdian@oss.qualcomm.com>
Signed-off-by: Lukas Märdian <lukas.maerdian@oss.qualcomm.com>
Co-authored-by: Kartik Nema <kartnema@qti.qualcomm.com> Signed-off-by: Lukas Märdian <lukas.maerdian@oss.qualcomm.com>
…bols. - detect-libyaml-at-top-level.patch - link-classifier-against-restunecore.patch Signed-off-by: Lukas Märdian <lukas.maerdian@oss.qualcomm.com>
Signed-off-by: Lukas Märdian <lukas.maerdian@oss.qualcomm.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion PR
This PR was generated by
pkg-promoteto move this package repo to upstream tagv0.4.6.Summary
qli/debian/latestupstream/latest/upstream/0.4.6debian/pr/0.4.6-0qli1_0.4.6-0qli1~(UNRELEASED)Reviewer checklist
Buildworkflow is green.Flow
--- config: themeVariables: 'gitInv2': '#ff0000' gitGraph: parallelCommits: true rotateCommitLabel: true --- gitGraph BT: branch qli/debian/latest order: 1 branch upstream-main order: 4 branch upstream/latest order: 3 checkout main commit id: 'Unrelated history: workflows, doc' checkout upstream-main commit checkout upstream-main commit commit id: 'release' tag: 'v0.4.6' checkout upstream/latest commit id: 'previous stuff' merge upstream-main id: 'Filtered .github/debian folders' tag: 'upstream/0.4.6' checkout qli/debian/latest commit commit commit branch debian/pr/0.4.6-0qli1_ order: 2 merge upstream/latest id: 'Merged Upstream' commit id: 'Changelog version update' type: HIGHLIGHT