[devin-ai-integration]

Summary

Fixes 29 SonarCloud code-scanning alerts in the GitHub Actions workflows and tig-cli/pyproject.toml. The fixes pin third-party actions to commit SHAs and lock tig-cli's dependencies with hashes. None of them are suppressions.

• S7637 (action pinning): each flagged third-party action now uses the commit its floating major tag points to today, with the version as a comment, e.g. docker/login-action@c94ce9fb… # v3.7.0. Behavior should not change. First-party actions/* steps were not flagged and are left alone.
• S8565 (no lock file): tig-cli/uv.lock is new. pyproject.toml gets two [dependency-groups]: backend (setuptools, wheel) and release (build, twine). From the lock, uv export produces three hash-pinned files that work across Python 3.9–3.12 and macOS/Linux:
  • requirements.txt: runtime deps plus backend
  • requirements-dev.txt: [dev] extras plus backend
  • requirements-release.txt: backend plus release
    The command that regenerates each file is in its header.
• S8541 / S8544 (pip installs): every pip install in CI now looks like this:

  pip install --only-binary :all: --require-hashes -r tig-cli/requirements-*.txt      # locked third-party deps, wheels only
  pip install --only-binary :all: --no-deps --no-build-isolation [-e] ./tig-cli       # the local project, built with the locked setuptools
  

  This is the same pattern .github/workflows/project-requirements-tests.yml already uses.
  • Builds now run python -m build --no-isolation. Previously the isolated build env fetched unpinned setuptools and wheel.
  • The unpinned pip install --upgrade pip steps are gone. The runners keep the pip that setup-python ships.

Alert	Rule	Location	Fix
#14, #15	S7637	build-publish-fullfeatured.yml:97, 133	docker/login-action v3.7.0, docker/metadata-action v5.10.0 pinned to SHA
#18, #19, #20, #21, #22	S7637	build-publish-terrain-intelligence-generator.yml:72, 76, 84, 129, 672	setup-buildx-action v3.12.0, login-action v3.7.0, metadata-action v5.10.0, build-push-action v5.4.0, softprops/action-gh-release v1 pinned to SHA
#24, #25	S7637	build-publish-visor-variants.yml:123, 142	login-action v3.7.0, metadata-action v5.10.0 pinned to SHA
#34	S7637	release-visual-regression.yml:50	login-action v3.7.0 pinned to SHA
#17, #32, #33	S7637	publish-test.yml:49, publish.yml:117, 138	pypa/gh-action-pypi-publish v1.14.3 (current release/v1) pinned to SHA
#28	S7637	test.yml:52	codecov/codecov-action v4.6.0 pinned to SHA
#72, #26	S8541, S8544	test.yml:36	unpinned pip install --upgrade pip removed
#73, #27	S8541, S8544	test.yml:37	-e ".[dev]" replaced by hashed requirements-dev.txt + --no-deps --no-build-isolation -e .
#74, #29	S8541, S8544	publish.yml:56	unpinned pip install --upgrade pip removed
#75, #30	S8541, S8544	publish.yml:57	same change as test.yml:37
#76, #31	S8541, S8544	publish.yml:87	pip build twine replaced by hashed requirements-release.txt; python -m build --no-isolation
#71, #16	S8541, S8544	publish-test.yml:20	same change as publish.yml:87
#23	S8541	calibration-demo.yml:49	pip install ./tig-cli replaced by hashed requirements.txt + --only-binary :all: --no-deps --no-build-isolation ./tig-cli
#35	S8541	release-visual-regression.yml:47	same change as calibration-demo.yml:49
#47	S8565	tig-cli/pyproject.toml	tig-cli/uv.lock added; CI installs from its hash-pinned exports

No alert is left unfixed, and none needs a dismissal.

Verified locally

Ran with uv-managed CPython 3.9, 3.10, 3.11 and 3.12 on Linux:

• test.yml / publish.yml test job (3.9–3.12): the exact install commands, then pytest -m "not integration". 418 passed on every version. The 3.12 coverage run produces coverage.xml.
• publish.yml / publish-test.yml build (3.9 and 3.12): release requirements, then python -m build --no-isolation and twine check dist/*. Builds the sdist and wheel, and both pass.
• calibration-demo / release-visual-regression install (3.11): the non-editable install puts tig on PATH, and tig --help works.
• macOS: not run here. The lock does include the macOS wheels (e.g. coverage cp39 arm64 and x86_64).

Reviewer notes

• Updating dependencies: after changing a dependency in pyproject.toml, run uv lock and then the uv export command from each requirements file's header. Dependabot/Renovate can keep the SHAs and the lock current.
• setuptools warning: newer setuptools warns that the project.license = {text = ...} table is deprecated (deadline 2027-02). The warning is not new: the old isolated builds used the latest setuptools too. It is outside this PR's alerts.

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/d776f644971d4383b590977b18381efe
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/d776f644971d4383b590977b18381efe?variant=devin
Requested by: @HuiJun

---

🟢 Devin Review found nothing to fix · View findings

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[github-actions]

Project Requirements: PASS

PR #50 is a CI supply-chain hardening change. It pins third-party GitHub Actions to commit SHAs. It also makes CI install tig-cli and its build/release tooling from hash-locked requirements exports (requirements.txt, requirements-dev.txt, requirements-release.txt, generated from a new uv.lock), using --only-binary/--require-hashes and --no-build-isolation. The only pyproject.toml change adds PEP 735 [dependency-groups] (backend, release), which do not go into published wheel/sdist metadata. Runtime dependencies, supported Python versions, CLI behavior, and container images are unchanged. All three requirements pass. One minor optional note: the contributor Development section in tig-cli/README.md could mention the new lock/export workflow.

Requirement	Verdict	Notes
1. Documentation parity	Pass	Not user-facing. The changes only touch CI workflows and dev/release dependency locking. [project].dependencies, requires-python, the CLI, the images, and the scripts are unchanged, so the published tig-cli artifact and the documented pip install tig-cli / pip install -e ".[dev]" instructions still match. Optional: tig-cli/README.md 'Development' could mention that dependency changes require uv lock plus the recorded uv export commands. Right now only a comment in pyproject.toml says this, and that is contributor-facing, not user-facing.
2. Broad deployability	Pass	Nothing ties TIG to one organization. Actions are pinned to public upstream SHAs. Locks resolve from public PyPI with environment markers for Python 3.9–3.12 across the existing ubuntu/macos matrix. uv (a widely used, permissively licensed tool) is needed only by maintainers to regenerate the lock files. End users can still install with plain pip, and setuptools/wheel/build/twine are standard tools.
3. Test coverage	Pass	No new tests needed: this is a CI/dependency-pinning change with no behavior change in tig-cli code or images. The existing unit suite in .github/workflows/test.yml (3.9–3.12 on ubuntu and macOS) now installs from requirements-dev.txt and the editable package, so the new install path is tested in CI. The publish/publish-test workflows build with --no-isolation and run twine check, which tests the release locks. calibration-demo and release-visual-regression test requirements.txt.

Automated pre-check hints

• CI workflows changed without any Markdown changes (requirement 1).

---

Evaluated at c9b28c0 · Devin session · workflow run

Criteria: .github/project-requirements/criteria.md. A fail blocks the merge; a maintainer can waive it by adding the requirements-waived label.