mirror of
https://github.com/astral-sh/setup-uv.git
synced 2026-06-28 10:45:08 +00:00
1 commit
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Zsolt Dollenstein
|
c86fe4ef1f
|
Add a threat model for setup-uv (#923)
Some checks are pending
test / test-restore-cache (auto, ubuntu-latest) (push) Blocked by required conditions
test / test-restore-cache (auto, windows-latest) (push) Blocked by required conditions
test / test-setup-cache-requirements-txt (push) Waiting to run
test / test-restore-cache (false, ubuntu-latest) (push) Blocked by required conditions
test / test-restore-cache (false, windows-latest) (push) Blocked by required conditions
test / test-restore-cache (true, ubuntu-latest) (push) Blocked by required conditions
test / test-restore-cache (true, windows-latest) (push) Blocked by required conditions
test / test-restore-cache-requirements-txt (push) Blocked by required conditions
test / test-setup-cache-dependency-glob (push) Waiting to run
test / test-restore-cache-dependency-glob (push) Blocked by required conditions
test / test-setup-cache-save-cache-false (push) Waiting to run
test / test-restore-cache-save-cache-false (push) Blocked by required conditions
test / test-setup-cache-restore-cache-false (push) Waiting to run
test / test-restore-cache-restore-cache-false (push) Blocked by required conditions
test / test-cache-local (map[expected-cache-dir:/home/runner/work/_temp/setup-uv-cache os:ubuntu-latest]) (push) Waiting to run
test / test-cache-local (map[expected-cache-dir:D:\a\_temp\setup-uv-cache os:windows-latest]) (push) Waiting to run
test / test-cache-local-cache-disabled (push) Waiting to run
test / test-cache-local-cache-disabled-but-explicit-path (push) Waiting to run
test / test-no-python-version (push) Waiting to run
test / test-custom-manifest-file (push) Waiting to run
test / test-download-from-astral-mirror-false (push) Waiting to run
test / test-absolute-path (push) Waiting to run
test / test-relative-path (push) Waiting to run
test / test-cache-prune-force (push) Waiting to run
test / test-cache-dir-from-file (push) Waiting to run
test / test-cache-python-missing-managed-install-dir (push) Waiting to run
test / test-cache-python-installs (push) Waiting to run
test / test-restore-python-installs (push) Blocked by required conditions
test / test-python-install-dir (map[expected-python-dir:/home/runner/work/_temp/uv-python-dir os:ubuntu-latest]) (push) Waiting to run
test / test-python-install-dir (map[expected-python-dir:D:\a\_temp\uv-python-dir os:windows-latest]) (push) Waiting to run
This adds a threat model for `setup-uv` so security scanners can use it as a baseline in terms of what's in-, and out of scope. The TM covers credential recipients, executable and cache boundaries, and release authority. It treats checkout-selected interpreters, paths, virtual environments, symlinks, and helpers as delegated project authority unless they override an explicit workflow choice or cross an independent cache, runner, remote, or publication boundary. |