Commit Graph

1546 Commits

Author SHA1 Message Date
Klaas van Schelven
354af7ea0a Fix issues as reported by bandit or mark as nosec
Nothing worrying, but good to have checked this regardless
and important to have a green pipeline.

Fix #175
2025-07-30 12:16:40 +02:00
Klaas van Schelven
6266f15aa1 Configure Bandit in the CI
See #175
2025-07-30 12:14:24 +02:00
Klaas van Schelven
0d59f96b41 GitHub CI: document hardcoded list of branches 2025-07-30 11:42:40 +02:00
Klaas van Schelven
2fede39985 Envelope parsing: validate headers as per the docs
headers means: envelope headers and item headers.

Provides more robustness and a layer of defense-in-depth
Only those headers that we might rely on in a near future (event-based)
are included.

See #173
2025-07-29 23:46:48 +02:00
Klaas van Schelven
354edc81f9 Use django.utils._os.safe_join to construct paths
Even though '_os' suggests a private interface, this is likely to be stable
(for our purposes, i.e. may get more secure); if it ever isn't our tests
will expose it.

See #173
2025-07-29 22:23:37 +02:00
Klaas van Schelven
aab9b38352 Update CHANGELOG for 1.7.4, 1.6.4, 1.5.5, 1.4.3 2025-07-29 17:03:35 +02:00
Klaas van Schelven
2488d81595 Enable manual invocation via "Run workflow" button in the Actions UI 2025-07-29 16:11:41 +02:00
Klaas van Schelven
87f5a5887e CI workflow: run for 1.*.x branches too
working in the assumptions that:

* 1.*.x is not valid, explicitly listing is needed
* In GitHub Actions, workflow evaluation happens from the main (or default) branch of the repo, not from the branch being pushed to or pulled from.
2025-07-29 16:09:21 +02:00
Klaas van Schelven
4bf2c1c522 envelope event_id check: on-parse 2025-07-29 15:22:34 +02:00
Klaas van Schelven
fe5527308c (extra) check on storage event_id uuid-ness before using in filenames 2025-07-29 15:08:02 +02:00
Klaas van Schelven
b8b179ff94 Ingestion: ensure event_id is a dashless uuid before using as a filename 2025-07-29 14:50:16 +02:00
Klaas van Schelven
5d8d73097c copilot instructions: fixes on createsuperuser
For some reason the env-vars were missed; pulling them closer hopefully fixes
this (and makes more sense generally)

the `|| true` pattern was removed: it just hides problems.

also: different username (email) to stick closer to what we do elsewhere.
2025-07-29 14:15:17 +02:00
Klaas van Schelven
735f5ceaa0 Copilot instructions; another attempt
after having seen copilot in action on #171
2025-07-29 14:05:18 +02:00
Klaas van Schelven
d4b4c2fb52 Copilot env: check out event-samples outside the workspace
* avoids annoying accidental checkins
* actually matches the SAMPLES_DIR env var
2025-07-29 14:02:53 +02:00
Klaas van Schelven
9b8409d8b2 Global trailing whitespace cleanup 2025-07-29 12:53:10 +02:00
Klaas van Schelven
9fa2fde3e5 pre-commit: fail on trailing whitespace 2025-07-29 12:53:10 +02:00
Klaas van Schelven
547e423df0 Remove '. bin/activate' from pre-commit hook
that assumes my particular setup (top-level venv) which is unusual.
better have 'active env' as a requirement for the script instead
2025-07-29 12:53:10 +02:00
Klaas van Schelven
00a686d103 Tell contributors (and copilot) about the pre-commit hooks 2025-07-29 12:52:59 +02:00
Klaas van Schelven
3c00ab2da7 pre-commit-hook: trigger tailwind rebuild conditionally 2025-07-29 12:10:26 +02:00
Klaas van Schelven
4024a4863f Merge branch 'copilot/fix-169'
Fix #169, See #170
2025-07-28 23:35:48 +02:00
Klaas van Schelven
0fdfa3354d GitHub copilot instructions: WIP 2025-07-28 23:19:43 +02:00
Klaas van Schelven
91b99af08d project-alert edits: fix misalignments (by asking ChatGPT) 2025-07-28 22:18:02 +02:00
Klaas van Schelven
718127fd08 Add timeouts to external calls to service
following the principle 'always set timeouts when making network calls'
2025-07-28 22:18:02 +02:00
Klaas van Schelven
0aa7de30d2 Don't re-raise exceptions that are 'handled in the UI'
we now have handling for them, no need to keep seeing them as stacktraces.
also: in the EAGER setup, raising means the transaciton is rolled back,
and nothing is stored in the DB at all.

if we ever want to 'get more info' something like capture_or_log_exception
would be more apt
2025-07-28 22:17:59 +02:00
Klaas van Schelven
fe343f0749 Remove copilot's overuse of comments / fallbacks 2025-07-28 22:14:05 +02:00
Klaas van Schelven
e6c8c694bd alerts config: in the admin 2025-07-28 22:14:05 +02:00
Klaas van Schelven
cdca0a054e Whitespace/flake8 2025-07-28 22:14:05 +02:00
copilot-swe-agent[bot]
21ee428938 Add UI components to display alert backend failure status
Co-authored-by: vanschelven <223833+vanschelven@users.noreply.github.com>
2025-07-28 22:13:22 +02:00
copilot-swe-agent[bot]
b564774f21 Add failure tracking fields and error handling to alert backends
Co-authored-by: vanschelven <223833+vanschelven@users.noreply.github.com>
2025-07-28 22:13:17 +02:00
Klaas van Schelven
5f7cccf901 PID_FILE check: don't use in docker/systemd
As per the parent commit: the "small check" is not bullet-proof (as per #99)
and in Docker/systemd environments it's better to leave the thing that's
actually in charge of lifecycles in charge rather than reproduce that behavior.

You can’t fail the check if you deliberately skipped it.

Fix #99
2025-07-28 20:47:06 +02:00
Klaas van Schelven
4a73880ea7 PID_FILE check: make optional
As implied by this comment:

> this implementation is not supposed to be bullet-proof for race conditions (nor is it cross-platform)... it's
> just a small check to prevent the regularly occurring cases:
> * starting a second runsnappea in development
> * running 2 separate instances of bugsink on a single machine without properly distinguishing them

but this "small check" gets in the way sometimes, so it's better to be able to turn it off.

See #99
2025-07-28 20:46:45 +02:00
Klaas van Schelven
530fc7f166 Copilot instructions and workflow; a first attempt 2025-07-28 20:10:49 +02:00
Klaas van Schelven
c6ced06a2f assertEquals -> assertEual (Python 3.12)
on the subject of this being the 3rd time (or more) that I'm fixing this:

> even a donkey typically doesn't bump into the same stone twice (Dutch proverb)

Q: but what animal put the stone there in the first place?
A: Python's lanuage "designers"
2025-07-28 15:33:05 +02:00
Klaas van Schelven
e363917e9c Per-month quota for email-sending
Fix #34
2025-07-28 14:41:32 +02:00
Klaas van Schelven
13dbc4dd29 Use remote_addr for '{{auto}}' ip_addr tags
See #165
2025-07-28 11:12:53 +02:00
Klaas van Schelven
ceca12940b Breadcrumb timestamps: display harmonized w/ rest of application
in the correct timezone, with smaller milis

According to the spec, this should work because:

> The timestamp of the breadcrumb. Recommended. A timestamp representing when
> the breadcrumb occurred. The format is either a string as defined in [RFC
> 3339](https://tools.ietf.org/html/rfc3339) or a numeric (integer or float)
> value representing the number of seconds that have elapsed since the [Unix
> epoch](https://en.wikipedia.org/wiki/Unix_time). Breadcrumbs are most useful
> when they include a timestamp, as it creates a timeline leading up to an
> event.
2025-07-28 10:24:48 +02:00
Klaas van Schelven
13226603ec send_json utility: make envelope API the default
the store API is deprecated and b/c it doesn't support the ingest/digest
split can be quite confusing.

this is similar to 2b8efc9452 (for the stress_test command the 'store'
API option was removed entirely)
2025-07-25 22:00:21 +02:00
Klaas van Schelven
6b8d912e1a Store remote_addr on the event
Fix #165
2025-07-25 21:54:32 +02:00
Klaas van Schelven
33fafc473b Remove the Django Debug Toolbar entirely
Given that I rarely use this in practice, the potential advantages do not
weigh up aginst the actual disadvantages (breakage today, as well as in March,
see 38d49f5000)

Fix #168
2025-07-25 20:30:03 +02:00
Klaas van Schelven
db94c00a94 DJDT: pin at 5.2
'philosphofically' I prefer to keep my dev-deps in flux ('bleeding edge')
but since I barely use the DJDT I'd rather just pin it at a known-working
version.

Also: 6.0 introduces DB-models (for a debug tool) which I'm not a fan of.

Probably removing DJDT right after this, which would make this commit to
be a good point to revert to if we ever want to reintroduce it

See #168
2025-07-25 20:12:09 +02:00
Klaas van Schelven
c11ca5626c DJDT: fix 'HistoryEntry doesn't declare an explicit app_label'
Since we already established that the DJDT shouldn't be in-use
during tests: better be more complete in that attempt. The
thing that is the actual _fix_ is the MIDDLEWARE update.

See https://github.com/django-commons/django-debug-toolbar/issues/2167

See #168
2025-07-25 20:10:42 +02:00
Klaas van Schelven
c5f9b1d593 DJDT: fix 'Apps aren't loaded yet.'
Deferred import fixes this particular problem

See #168
2025-07-25 20:00:25 +02:00
Klaas van Schelven
8439acf256 Add note about IP addresses in X-Forwarded-For headers 2025-07-25 17:12:06 +02:00
Klaas van Schelven
b432d3f6b6 Docker: BEHIND_HTTPS and BEHIND_PROXY
Fix #164
2025-07-25 16:52:09 +02:00
Klaas van Schelven
b993112558 semaphore-for-db-write-lock: sqlite only
See #117
2025-07-25 16:21:04 +02:00
Klaas van Schelven
ff7db03643 SINGLE_USER implies SINGLE_TEAM and more
As per the docs, which already stated:

> This disables all multi-user functionality, i.e. user-registration, teams and project-membership.

Fix #162
2025-07-25 15:08:02 +02:00
Klaas van Schelven
6ad9947460 Uploaded, but ignored, files: warn
See #158
2025-07-23 12:18:30 +02:00
Klaas van Schelven
bd1eabe60b Warn (in the logs) on multiple-debug-ids source uploads
See #157, #158
2025-07-23 12:11:20 +02:00
Klaas van Schelven
e80855a8b9 Admin for filemetadata: click-don't-select
See #158
2025-07-23 11:37:27 +02:00
Klaas van Schelven
c4fe1c1292 Debug IDs for missing sourcemaps: show them right in the stacktrace
See #158
2025-07-23 10:57:30 +02:00