Skip to content

chore(deps): Bump github/codeql-action/init from 3.37.9 to 4.37.9 - #329

Merged
dwolfson merged 2 commits into
mainfrom
dependabot/github_actions/github/codeql-action/init-4.37.9
Sep 5, 2026
Merged

chore(deps): Bump github/codeql-action/init from 3.37.9 to 4.37.9#329
dwolfson merged 2 commits into
mainfrom
dependabot/github_actions/github/codeql-action/init-4.37.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github/codeql-action/init from 3.37.9 to 4.37.9.

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.9

  • Update default CodeQL bundle version to 2.26.4. #4106

v4.37.8

No user facing changes.

v4.37.7

  • Update default CodeQL bundle version to 2.26.3. #4085

v4.37.6

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

v4.37.5

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

v4.37.4

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

v4.37.3

No user facing changes.

v4.37.2

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

v4.37.1

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

v4.37.0

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

v4.36.2

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

v4.36.1

No user facing changes.

v4.36.0

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

... (truncated)

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

4.37.9 - 26 Aug 2026

  • Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

  • Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

  • Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
  • Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995

... (truncated)

Commits
  • 47fa622 Make EACCES a ConfigurationError
  • 45693cc Refactor ENOSPC check into isDiskConfigurationError function
  • c2fd8f5 Merge pull request #4081 from github/mario-campos/version-cache-to-disk
  • c56f48e Log unexpected conditions during caching CLI output
  • aa0eadc Merge branch 'main' into mario-campos/version-cache-to-disk
  • 43250d6 Change cache key to string type to include CLI args
  • 5008eff Merge pull request #4094 from github/mergeback/v4.37.7-to-main-ff2f1c62
  • 053d41e Rebuild
  • 1158e1c Update changelog and version after v4.37.7
  • ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 31, 2026
@dependabot
chore(deps): Bump github/codeql-action/init from 3.37.9 to 4.37.9
371e3d4 
Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 3.37.9 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@6f5948d...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github/codeql-action/init-4.37.9 branch from 3389054 to 371e3d4 Compare September 5, 2026 19:11
@dwolfson
dwolfson merged commit d259aee into main Sep 5, 2026
2 of 3 checks passed
@dwolfson
dwolfson deleted the dependabot/github_actions/github/codeql-action/init-4.37.9 branch September 5, 2026 19:13
pcoldico pushed a commit to pcoldico/egeria-python that referenced this pull request Sep 7, 2026
@dependabot @dwolfson @pcoldico
chore(deps): Bump github/codeql-action/init from 3.37.9 to 4.37.9 (od…
0280eac 
…pi#329)

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 3.37.9 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@6f5948d...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>
dwolfson added a commit that referenced this pull request Sep 8, 2026
@pcoldico @dwolfson
@dependabot @claude
My_Egeria pull request (#346)
2bab0ae 
* End of day backup, added my bookmarks functionality, not yet tested, included in auto tests or added to documentation

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>

* Save changes to enable my_bookmarks functionality

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>

* Updates to the flows in Shop for Data and a new MD doc covering all return codes across the application

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>

* fix+feat: ISSUE-87/80/86 fixed, ISSUE-88 corrected as not-a-bug (report-spec review batch) (#342)

* docs(PYEGERIA_ISSUES): ISSUE-87/86/80 fixed, ISSUE-88 corrected as not-a-bug

ISSUE-88: not a bug. GovernanceZone (0424) is a GovernanceDefinition
subtype like every other one create_governance_definition already
handles -- pass GovernanceDefinitionProperties with typeName:
"GovernanceZone" (same generic mechanism as
BusinessImperative/RegulationArticle/etc.). Confirmed against
GOV_DEF_PROPERTIES_LIST (pyegeria/omvs/governance_officer.py) and the
.http ground truth, which has no separate governance-zones create
endpoint at all. Moved to the 'Not a bug / n/a' section; kept the
original report for history. Real, separate follow-up noted: the
method's own docstring doesn't list GovernanceZone (or other
0401-family subtypes) as valid typeName values -- a documentation
gap, not an API gap.

ISSUE-87, ISSUE-80, ISSUE-86: entries updated to record the fixes
landed in this same session (see the corresponding code commits) --
docstring correction, MCP tool exposure, and bearer-token support in
exec_report_spec, respectively.

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* fix(classification-explorer): ISSUE-87 -- correct OwnerProperties -> OwnershipProperties in add_ownership_to_element docstrings

_async_add_ownership_to_element/add_ownership_to_element documented a
sample body with "class": "OwnerProperties", but the method itself
validates against prop=["OwnershipProperties"] -- the documented body
was rejected client-side (PyegeriaInvalidParameterException,
'unexpected property class name') before any HTTP call, 100% of the
time. .http ground truth already used OwnershipProperties and agreed
with the code; the docstring was the outlier, repeated in both the
async and sync wrapper.

Fix: both docstrings corrected to OwnershipProperties. Swept every
other _async_new_classification_request caller in the file (matched
by function boundary, not naive line-proximity, to avoid false
positives from adjacent functions) -- this was the only class-name/
prop= mismatch in classification_explorer.py.

Verified: TypeAdapter(NewClassificationRequestBody).validate_python(...)
with the corrected body now validates cleanly (previously raised
ValidationError). Full pytest tests/micro-tests/ green.

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* feat(format-set-executor): ISSUE-86 -- exec_report_spec accepts a bearer token, not just user/user_pass

exec_report_spec (and its two client-building helpers, _exec_analytic_chart
and _run_analytic_function) always built a fresh EgeriaTech/client from
user/user_pass and called create_egeria_bearer_token() -- no way to run a
report as a caller who already holds a bearer token for the calling user.
Egeria Advisor's app JWT carries the user's Egeria bearer token and no
longer their password (matching the Portal's existing X-Egeria-Token +
set_bearer_token() pattern), so report execution had to fall back to a
service account, and Egeria's provenance recorded that service account
instead of the person who ran the report.

Fix: added token: Optional[str] = None to exec_report_spec,
_exec_analytic_chart, and _run_analytic_function, threaded through every
client-building call site. When token is given, the client is
authenticated with set_bearer_token(token) instead of
create_egeria_bearer_token(); when omitted, behavior is byte-for-byte
unchanged. NewElementRequestBody-style constructors already accept a
token= kwarg directly (confirmed: EgeriaTech.__init__ and ServerClient
.__init__ both do, and lazily-instantiated sub-clients inherit self.token
via _get_subclient), so no model changes were needed.

New test tests/micro-tests/test_exec_report_spec_token.py (2 tests,
monkeypatched EgeriaTech, no live server): confirms token routes through
set_bearer_token with zero calls to create_egeria_bearer_token, and
confirms the no-token path is unchanged. Full pytest tests/micro-tests/
green.

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* feat(mcp): ISSUE-80 -- expose find_report_specs_by_perspective/by_question as MCP tools; ISSUE-86 -- thread bearer token through run_report

ISSUE-80: find_report_specs_by_perspective/find_report_specs_by_question
(pyegeria/view/base_report_formats.py) were real, working, tested
functions with no MCP tool or CLI command exposing them -- only their
own functional test exercised them. Added run_find_report_specs_by_
perspective/run_find_report_specs_by_question adapters (same thin-wrapper
pattern as the existing run_find_report_specs) and registered them as
MCP tools find_report_specs_by_perspective/find_report_specs_by_question,
alongside the existing find_report_specs tool. Pure additive wiring, no
change to the underlying functions. hey_egeria CLI exposure (the
issue's 'and/or' half) left undone -- MCP was the natural fit given the
existing find_report_specs tool precedent.

ISSUE-86: run_report and _execute_egeria_call_blocking (mcp_adapter.py)
now accept token: Optional[str] = None and pass it through to
exec_report_spec, so a caller that already holds a bearer token for the
calling user can run a report as that user instead of the user/user_pass
service account. describe_report doesn't build a client (pure registry
lookup) so needed no change. mcp_server.py's own run_report MCP tool
takes a different, already-token-capable path (a pre-built egeria_client
passed to _async_run_report_tool, not exec_report_spec's builder) and is
out of scope here.

Full pytest tests/micro-tests/ green throughout.

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

---------

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump actions/checkout from 4.4.0 to 7.0.1 (#330)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.4.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11d5960...3d3c42e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump click from 8.3.1 to 8.5.0 (#328)

Bumps [click](https://github.com/pallets/click) from 8.3.1 to 8.5.0.
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.3.1...8.5.0)

---
updated-dependencies:
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump altair from 6.0.0 to 6.2.2 (#327)

Bumps [altair](https://github.com/vega/altair) from 6.0.0 to 6.2.2.
- [Release notes](https://github.com/vega/altair/releases)
- [Commits](vega/altair@v6.0.0...v6.2.2)

---
updated-dependencies:
- dependency-name: altair
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump astral-sh/setup-uv from 3.2.4 to 10.0.1 (#326)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 3.2.4 to 10.0.1.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@caf0cab...20cfd1b)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump softprops/action-gh-release from 1 to 2 (#325)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 1 to 2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@de2c0eb...3bb1273)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: '2'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump github/codeql-action/init from 3.37.9 to 4.37.9 (#329)

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 3.37.9 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@6f5948d...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump github/codeql-action/analyze from 3.37.9 to 4.37.9 (#331)

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 3.37.9 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@6f5948d...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(release): bump version to 6.1.10 (#343)

First tagged/CI-built release since 6.1.8 (6.1.9 was an out-of-band
publish, never tagged). Includes: click 8.3.1->8.5.0, altair
6.0.0->6.2.2, actions/checkout/setup-uv/codeql-action/action-gh-release
CI bumps (#325-#331), and ISSUE-86/87/80 fixes (#342).

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* Some small fixes  (#344)

* docs(PYEGERIA_ISSUES): log ISSUE-91 -- mcp dependency floor too loose

pyproject.toml declares mcp >=0.1 but pyegeria/core/mcp_server.py imports
mcp.server.mcpserver.MCPServer, which requires mcp>=2.0 (confirmed live:
this dev venv has mcp==2.0.0 installed and the import works; the module
path doesn't exist in the 0.x/1.x mcp package line). Found by Egeria
Advisor rebuilding its demo deployment against pyegeria 6.1.10 -- worked
fine because they pinned mcp==2.1.1 explicitly, not because pyegeria's
own floor would have caught an older mcp.

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* test(view): cover ISSUE-86's caller-held bearer token in exec_report_spec

format_set_executor.py's `token` parameter (ISSUE-86 — let a caller that
already holds an Egeria bearer token run a report without a password) is on
main with no dedicated test.

These tests existed only on an unpushed local branch,
claude/cranky-chebyshev-be2494, alongside a second, parallel implementation
of the same feature that main had meanwhile gained by another route.
Pushing that branch would have added a duplicate implementation; the tests
were the part worth keeping, so they are salvaged here on their own.

They were written against that branch's `_authenticate_client()` helper,
which main does not have — verified they pass unchanged against main's
inline implementation (7 passed), so they test the behaviour rather than
that refactor's shape.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

---------

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

* Update to base_report_formats to add the GUID to the Data-Product-Catalog-MyE report format

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>

* Update to base_report_formats to add GUID to Data-Product-Catalog-MyE, previous commit was just the test code

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>

---------

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>
Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
pcoldico added a commit to pcoldico/egeria-python that referenced this pull request Sep 8, 2026
@pcoldico @dwolfson
@dependabot @claude
My_Egeria pull request (odpi#346)
d4750bf 
* End of day backup, added my bookmarks functionality, not yet tested, included in auto tests or added to documentation

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>

* Save changes to enable my_bookmarks functionality

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>

* Updates to the flows in Shop for Data and a new MD doc covering all return codes across the application

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>

* fix+feat: ISSUE-87/80/86 fixed, ISSUE-88 corrected as not-a-bug (report-spec review batch) (odpi#342)

* docs(PYEGERIA_ISSUES): ISSUE-87/86/80 fixed, ISSUE-88 corrected as not-a-bug

ISSUE-88: not a bug. GovernanceZone (0424) is a GovernanceDefinition
subtype like every other one create_governance_definition already
handles -- pass GovernanceDefinitionProperties with typeName:
"GovernanceZone" (same generic mechanism as
BusinessImperative/RegulationArticle/etc.). Confirmed against
GOV_DEF_PROPERTIES_LIST (pyegeria/omvs/governance_officer.py) and the
.http ground truth, which has no separate governance-zones create
endpoint at all. Moved to the 'Not a bug / n/a' section; kept the
original report for history. Real, separate follow-up noted: the
method's own docstring doesn't list GovernanceZone (or other
0401-family subtypes) as valid typeName values -- a documentation
gap, not an API gap.

ISSUE-87, ISSUE-80, ISSUE-86: entries updated to record the fixes
landed in this same session (see the corresponding code commits) --
docstring correction, MCP tool exposure, and bearer-token support in
exec_report_spec, respectively.

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* fix(classification-explorer): ISSUE-87 -- correct OwnerProperties -> OwnershipProperties in add_ownership_to_element docstrings

_async_add_ownership_to_element/add_ownership_to_element documented a
sample body with "class": "OwnerProperties", but the method itself
validates against prop=["OwnershipProperties"] -- the documented body
was rejected client-side (PyegeriaInvalidParameterException,
'unexpected property class name') before any HTTP call, 100% of the
time. .http ground truth already used OwnershipProperties and agreed
with the code; the docstring was the outlier, repeated in both the
async and sync wrapper.

Fix: both docstrings corrected to OwnershipProperties. Swept every
other _async_new_classification_request caller in the file (matched
by function boundary, not naive line-proximity, to avoid false
positives from adjacent functions) -- this was the only class-name/
prop= mismatch in classification_explorer.py.

Verified: TypeAdapter(NewClassificationRequestBody).validate_python(...)
with the corrected body now validates cleanly (previously raised
ValidationError). Full pytest tests/micro-tests/ green.

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* feat(format-set-executor): ISSUE-86 -- exec_report_spec accepts a bearer token, not just user/user_pass

exec_report_spec (and its two client-building helpers, _exec_analytic_chart
and _run_analytic_function) always built a fresh EgeriaTech/client from
user/user_pass and called create_egeria_bearer_token() -- no way to run a
report as a caller who already holds a bearer token for the calling user.
Egeria Advisor's app JWT carries the user's Egeria bearer token and no
longer their password (matching the Portal's existing X-Egeria-Token +
set_bearer_token() pattern), so report execution had to fall back to a
service account, and Egeria's provenance recorded that service account
instead of the person who ran the report.

Fix: added token: Optional[str] = None to exec_report_spec,
_exec_analytic_chart, and _run_analytic_function, threaded through every
client-building call site. When token is given, the client is
authenticated with set_bearer_token(token) instead of
create_egeria_bearer_token(); when omitted, behavior is byte-for-byte
unchanged. NewElementRequestBody-style constructors already accept a
token= kwarg directly (confirmed: EgeriaTech.__init__ and ServerClient
.__init__ both do, and lazily-instantiated sub-clients inherit self.token
via _get_subclient), so no model changes were needed.

New test tests/micro-tests/test_exec_report_spec_token.py (2 tests,
monkeypatched EgeriaTech, no live server): confirms token routes through
set_bearer_token with zero calls to create_egeria_bearer_token, and
confirms the no-token path is unchanged. Full pytest tests/micro-tests/
green.

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* feat(mcp): ISSUE-80 -- expose find_report_specs_by_perspective/by_question as MCP tools; ISSUE-86 -- thread bearer token through run_report

ISSUE-80: find_report_specs_by_perspective/find_report_specs_by_question
(pyegeria/view/base_report_formats.py) were real, working, tested
functions with no MCP tool or CLI command exposing them -- only their
own functional test exercised them. Added run_find_report_specs_by_
perspective/run_find_report_specs_by_question adapters (same thin-wrapper
pattern as the existing run_find_report_specs) and registered them as
MCP tools find_report_specs_by_perspective/find_report_specs_by_question,
alongside the existing find_report_specs tool. Pure additive wiring, no
change to the underlying functions. hey_egeria CLI exposure (the
issue's 'and/or' half) left undone -- MCP was the natural fit given the
existing find_report_specs tool precedent.

ISSUE-86: run_report and _execute_egeria_call_blocking (mcp_adapter.py)
now accept token: Optional[str] = None and pass it through to
exec_report_spec, so a caller that already holds a bearer token for the
calling user can run a report as that user instead of the user/user_pass
service account. describe_report doesn't build a client (pure registry
lookup) so needed no change. mcp_server.py's own run_report MCP tool
takes a different, already-token-capable path (a pre-built egeria_client
passed to _async_run_report_tool, not exec_report_spec's builder) and is
out of scope here.

Full pytest tests/micro-tests/ green throughout.

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

---------

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump actions/checkout from 4.4.0 to 7.0.1 (odpi#330)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.4.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11d5960...3d3c42e)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump click from 8.3.1 to 8.5.0 (odpi#328)

Bumps [click](https://github.com/pallets/click) from 8.3.1 to 8.5.0.
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.3.1...8.5.0)

---
updated-dependencies:
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump altair from 6.0.0 to 6.2.2 (odpi#327)

Bumps [altair](https://github.com/vega/altair) from 6.0.0 to 6.2.2.
- [Release notes](https://github.com/vega/altair/releases)
- [Commits](vega/altair@v6.0.0...v6.2.2)

---
updated-dependencies:
- dependency-name: altair
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump astral-sh/setup-uv from 3.2.4 to 10.0.1 (odpi#326)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 3.2.4 to 10.0.1.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@caf0cab...20cfd1b)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump softprops/action-gh-release from 1 to 2 (odpi#325)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 1 to 2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@de2c0eb...3bb1273)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: '2'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump github/codeql-action/init from 3.37.9 to 4.37.9 (odpi#329)

Bumps [github/codeql-action/init](https://github.com/github/codeql-action) from 3.37.9 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@6f5948d...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(deps): Bump github/codeql-action/analyze from 3.37.9 to 4.37.9 (odpi#331)

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 3.37.9 to 4.37.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@6f5948d...cdf488f)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* chore(release): bump version to 6.1.10 (odpi#343)

First tagged/CI-built release since 6.1.8 (6.1.9 was an out-of-band
publish, never tagged). Includes: click 8.3.1->8.5.0, altair
6.0.0->6.2.2, actions/checkout/setup-uv/codeql-action/action-gh-release
CI bumps (odpi#325-odpi#331), and ISSUE-86/87/80 fixes (odpi#342).

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* Some small fixes  (odpi#344)

* docs(PYEGERIA_ISSUES): log ISSUE-91 -- mcp dependency floor too loose

pyproject.toml declares mcp >=0.1 but pyegeria/core/mcp_server.py imports
mcp.server.mcpserver.MCPServer, which requires mcp>=2.0 (confirmed live:
this dev venv has mcp==2.0.0 installed and the import works; the module
path doesn't exist in the 0.x/1.x mcp package line). Found by Egeria
Advisor rebuilding its demo deployment against pyegeria 6.1.10 -- worked
fine because they pinned mcp==2.1.1 explicitly, not because pyegeria's
own floor would have caught an older mcp.

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

* test(view): cover ISSUE-86's caller-held bearer token in exec_report_spec

format_set_executor.py's `token` parameter (ISSUE-86 — let a caller that
already holds an Egeria bearer token run a report without a password) is on
main with no dedicated test.

These tests existed only on an unpushed local branch,
claude/cranky-chebyshev-be2494, alongside a second, parallel implementation
of the same feature that main had meanwhile gained by another route.
Pushing that branch would have added a duplicate implementation; the tests
were the part worth keeping, so they are salvaged here on their own.

They were written against that branch's `_authenticate_client()` helper,
which main does not have — verified they pass unchanged against main's
inline implementation (7 passed), so they test the behaviour rather than
that refactor's shape.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>

---------

Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

* Update to base_report_formats to add the GUID to the Data-Product-Catalog-MyE report format

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>

* Update to base_report_formats to add GUID to Data-Product-Catalog-MyE, previous commit was just the test code

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>

---------

Signed-off-by: Peter Coldicott <86156876+pcoldico@users.noreply.github.com>
Signed-off-by: Dan Wolfson <dan.wolfson@pdr-associates.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Dan Wolfson <dan.wolfson@pdr-associates.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dwolfson