Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.90%. Comparing base (5fce790) to head (03eaced).
⚠️ Report is 298 commits behind head on main.

@@            Coverage Diff             @@##             main   #10392      +/-   ##==========================================+ Coverage   95.84%   95.90%   +0.05%==========================================  Files         174      176       +2       Lines       18995    19122     +127     ==========================================+ Hits        18206    18339     +133+ Misses        789      783       -6

🤖 According to the primer, this change hasno effect on the checked open source code. 🤖🎉

This comment was generated for commit03eaced

should we wait for the fix un setup-python or should we add cdce8p to the trusted workflow ? It feels like it enlarge the surface of attack

Does it increase the surface area though? It's my own fork and I have full access anyway. Yes, we could wait for the PR but the Github action staff can be slow to respond sometimes unfortunately. Might be worth it to unblock our CI in the meantime by addingcdce8p/setup-python@* as trusted workflow. (Already did so, otherwise the workflow wouldn't have run here probably.)

No you're right if your account is compromised it's already game over

The backport tomaintenance/3.3.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHubgit fetch# Create a new working treegit worktree add .worktrees/backport-maintenance/3.3.x maintenance/3.3.x# Navigate to the new working treecd .worktrees/backport-maintenance/3.3.x# Create a new branchgit switch --create backport-10392-to-maintenance/3.3.x# Cherry-pick the merged commit of this pull request and resolve the conflictsgit cherry-pick -x --mainline 1 58813cd3627194395f6c0c893b217fb71cc425a3# Push it to GitHubgit push --set-upstream origin backport-10392-to-maintenance/3.3.x# Go back to the original working treecd ../..# Delete the working treegit worktree remove .worktrees/backport-maintenance/3.3.x

Then, create a pull request where thebase branch ismaintenance/3.3.x and thecompare/head branch isbackport-10392-to-maintenance/3.3.x.

Let's not backport this one. The CI for the maintenance branch is fine without it.