cover of episode #408 python-preference only-managed 3.13t

#408 python-preference only-managed 3.13t

2024/11/4
logo of podcast Python Bytes

Python Bytes

Chapters

The chapter discusses a new tool called zizmor for finding security issues in GitHub Actions setups.
  • zizmor is a tool for auditing GitHub Actions workflows for security concerns.
  • It can be installed via cargo or brew and points at workflow yml files for evaluation.
  • The tool looks for issues like abandoned projects and is still in beta.

Shownotes Transcript

Translations:
中文

Hello, and welcome to python bites where we deliver python music headlines directly to your ear buds. This is up to four hundred and eight recorded monday, november two thousand and twenty four.

I'm mickley .

and this abode is brought you by scout A P, M, get python and jingle application performance monitor and code um a free A I code completion and chat. Well, that's pretty awesome, so be sure to check them out to tell you more about both of them later. Links for the shoots you can connect with us on the socials best place probably is posted on or masted on.

Sometimes people confused this, like, oh, you have to be on faster. I like note anywhere, Mason, anyone that social network is totally find that many where you are, we would be happy to chat with you there. You can sometimes find us on x sometimes don't made me what show live at python side of slash alive. Be part of the audience dually brian, usually at ten on monday ya fil time, but not finally.

If you want a artisanal, handcrafted digest of everything that we talked about, written by hand for you by brian oken destroy in our newsletter news list, go by the by side of, like a news letter for your stuff, just for us to talk with you and with I believe we are already to kick IT off. It's both earlier and slightly less early than you expected. Yes, right it's seven thirty for our time in the morning. But actually that is that eight thirty I don't know like time as where IT has .

been ah yeah times I hold right down till you into tomorrow but will see no but time change but we're not going to talk about time change, where to talk about get action. So I really let's pop this up and across the bad elders, get up, action, security isma Z I Z M O R.

So it's not news to a body chemical so will talk a little bit about so IT is is when the pop over IT is this more is um says it's a tool for finding security issues with get hub action setups. So went to be talking about here um really there's good action worker ser or something that um I don't actually look at very often. I update when I think I need to but I haven't done a security out of of them so I think it's idea to think about that.

And um in this article from dead says he he went through a lot of a lot of projects and did find some issues. Um so I think he said he found some issues, but he has here's I mean net supports a lot of projects, so there was a bit of work. So in his um in his article he also includes a um a script y route to go through all of his reposited orties to um to audit on them for their get workplace. So what do you do? So this um this is more tool.

It's uh it's not a pip install IT is um this is something you can do, cargo lot of bin stall I think yeah or you can get IT from source but but hopefully one of those will work for you to install IT and then and then you just point IT at your yahoo your flow yamal files dozen and evaluation um and IT does IT it's looking it's this is still sort of in what I think they worked said that he was in alpha or he says as beta. So it's in beta. They're still working on IT.

But there's um there's some things that they're looking for like like abandoned projects and things like that to um I think this is a kind of a cool thing I don't really pay too much attention to. I think of I have to admit, I copy I find another project, a python project that's doing something similar that I want to do and I can copy what they're doing and they are get back work flow. So like something like this, very good.

There is an audit rules page so you can see what kind of things is looking for. Um and just not material ET, but I think the add more so um anyway that's new tool. Yeah great.

Looks very good. I think we want to stick with get up here. So I wanna a tell you about some pretty exciting news, but also not just exciting news.

Be pretty powerful. Look into the open source world. So the headline here, I ran across this and got a few plus ones from listeners, including to think you part, this is the report. A K, A, get up. A, I leads python to the top language as the number of global developers surge. So we previously said pon is a one language according to stack overflow questions, right? This on the number of is the number of language as a usage on get up, which is, I would say, more meaningful maybe I I don't know what does that mean that to be number one of a language is that lines of code is that numbers of IT is that numbers of users as many metrics that can be used.

right?

Yeah, I know this article is no, I first thought this just be like a little headline or something. This is twenty five minute read according to. So this is a serious beast.

And so I want to jump over the pocket. And why am I using pocket in an overall omino? Well, hang in for the extras at the end.

So let's let's see a couple of things here. So first of all, this is forget we have five hundred and eighteen million total projects on get tab. Well, with twenty five percent year over your growth, that's pretty crazy. Over a billion contributions to public and open source projects is not on private ones. I think something like seventy five or eight percent of contributions of private repo of the public in our source ones.

that's a lot, a lot.

And I thought overtakes job script is a number one language, which is pretty interesting. So I highlighted a couple of things here because there's just too much here for me. Give my head a rapidly growing number of liberals worldwide, especially in africa, at american asia.

This suggests A I isn't just helping more people learn to write hoder able software faster is also attracting and helping more people become developers. First time, open touch contributions continue to show wide scale interest in AI projects. Importantly, we aren't seen signs that A I has hurt open source with low quality contributions. Again.

what magic interest and the headline.

at least for us, as python is now the most used language on github as a global open source, as a global open source activity continues to extend beyond traditional software development, have long thought that that's the magic python is it's not just a cool for an end framework. Oh, wow. This is a cool several language that many people coming from other areas that are not traditional developers really dive into the rain.

So we saw a python emerge for the first time, is the most used language. The rise of python, great with large communities of people join in open source community from across the stem world, rather than traditional community, is often developers, right? No big surprise there.

They also talk about where people are, where their developers are in the world. There are three places that notably stand out. And again, what is the metric here? I wish they were a little more clear.

We look at their heat map thing then that would be um states by far closely behind would be india and then china. And then after that, IT tells us best. But is that divided? But is that per capital, right? Like just maybe there's more people in other than or in india or america.

But if you look at this, they've got some cool projections into I think this is they have over time, but they also projections into the future. I like stack flow transit when they came out their big article. So that's pretty interesting.

And you sort to see where your place lands. I think there's there's a lot of interesting things here. I projected into the future.

They're projecting that india is gonna over for the united states and the U. S. Are going to fall the number two.

But also, my indonesia jumps up three places. A lot of interesting stuff there. Jump over. And a few more than, oh, no, go. I think things so hard now.

We is so big, okay? So there continue to be an increase in first time contributors. We saw one point four million and new developers globally join the opsf ce community.

And we didn't see again, this is one of the metric that was actually they called out noticeably. We did not see a rise and rejected poor request. So anyway, there is a bunch to see here.

I think one more I like to hit on is the rise of jupiter. No books, if you look at the graph of jupiter notebooks on on, get to IT, is the most silicon valley hockey tic dream you never seen, right? There's a little glitch.

So that is twenty twenty. I don't know what happened to twenty, twenty, who nobody remembers that anyway, but not just getting painting other than a pedee c like this thing is just the last in office. This is really interesting to see yeah I yeah and AI is maybe following a someone thing just ever so slightly behind. Anyway, this is A A deep article that has lots of insights across minimum aspects. That's my big item of the week, and I think people should check that out.

It's pretty yeah that's interesting comment from, uh, liz from the audience. My brothers a friend dev and started learning python last week because he's feeling the need to become full stack. So job is security stuff. Some of the job is scrip. People are learned in python also, maybe.

yeah, exactly. Let me tell, you know, quick about that. A P.

M. There are big supporters of piton bite. So we preciate that very much. So if you are tired of spending hours trying to find the root cause of issues impact your performance, then you urge yourself to check out scout A P M there, a leading python application performance monitoring tool, A P M, that helps you identify and solve performance abNormalities faster and easier.

Got A P M ties, botany, such as memory leagues, low database queries, background jobs and the dread in plus one inquires that you can end up. If you do lazy load in your thorium, then you say, oh no, 我爱 so slow。 Are you doing two hundred database series for what should be one?

So you can find out things like that links you back recent the source code, so you can spend less time in the debugging and healing logs and just buying the problems and moving on. And you love IT because it's built for developers. By developers, IT makes IT easy to gets set up serious.

Ly, you can do IT in less than four minutes. So that's awesome. And the best part is the pricing is three forward.

You only pay for the data that use with no hidden overage fees or pursue praising. And I just learn this brain. They also have they provide the proverb for free to all open source projects.

So if you're an open source maintainer and you want to have scout A P M for that project, a message or something on their pricing page so you can start your free trial and get instant insights today was IT by them by side of firm. Flash out the link is in your past of shots as well. And please use that link. Don't just search for them because otherwise they don't think you came from us and then y'd stop supporting the show so please, you are a link photo by a film. Slash out, check them out IT really supports the show.

Um yeah I want to talk about python three thirteen again. We we talked about five thirteen um quite a bit on the show so far, and we have talked about fourteen in last week. Um but um there's an article that I ran across from bike codes saying python three thirteen what didn't make the headlines and there's a few things I want to call out that I actually did miss also.

So i'm glad that that they rote this up. Um so there's we had a whole bunch nice new editions to the rapper. So like motoring code, code block or motor and code editing and and some colors and stuff, but a lot of those have trickle down to P D B now.

So um I I didn't really possibly I noticed this too much because I usually debug within A V S code or p cham. But um but sometimes times I do use P D B. Um this is i'm glad around is a python.

P D B is the python debug for unfamiliar but um what what did P D B get? Um I got mountain line ending which is um which is cool. He got code completion just like the rapper. Uh what's some other things? Break excepts doted paths really know what that means um so easily add break points to any lib .

dynamically make sense that maybe like that slash this kind of relative imports. 对 anyway um .

mostly the first two i'm really pretty excited about good completion and like eating with P D B, that's a great, great addition. So i'm cool to have those those go to P D B as well. Um some and yeah what else want to highlight? There were a few other things in here that I thought were pretty cool.

There's um athlete had some um a lot of performance optimization, which is great. Um X I love I I use bathroom all the time now, so may its a little bit faster. Great, awesome. I like .

that in s shall you tell?

Yeah you shall you much?

Yeah little bit like very welcome.

A S A little or and never and said this is probably, yes, you do anyway. Um yeah, what would we say about that little module providing high level BIOS to Operations such as resistance delete copy has seen tweak. Many, many bugs were fixed and options were added.

H, you can choose how to handle simple links. Oh, that's cool. Yeah I have checked that. Um that's great.

Um and one of the things about virtual environments, which I did not know uh school at the end um so i've been enjoying this with i've been when creating virtual environments with U V envy IT creates a little that get ignored so that the entire thing is your virtual environment directory gets ignored. But a python dash M V N V does that. Now the built in visual environment too nice as that as well.

Speaking of that though, this is kind of attention, but I just learned I think I I remember I learned IT from somebody on I masted on um think I may have been jeff triplet but i'm not sure um said that um one of things i've noticed when I use a virtual enviro created by U V is that IT doesn't install pip. So pips not there because you use pip instead. But you can have IT install pip. You could just know .

what is that.

You add a fly, I believe so um if you miss pip from A U V vision environment at IT with dash so anyway, 可 i'm got that got this article are you functions such as find all split search and sub can now be interned with which perform short repeated matches can now be interpreted by the user, interrupted, interrupted by user. I read that wrong.

Um so some of these could go off, go off and and do things that uh that are evil and stop uh your your code and now you can control see IT, that's good. So these are there. There's lots of great new things in for thirteen. I've just jumped in to start using IT I think just portrait.

So that's very cool. The eyes switch season and as well. And I on by the website.

I know why.

Why wit? Yeah, right. Shall we talk conferences? Brain, sure to conferences. So I saw you at an action on this.

I had already pipped IT for the main one for double main there. So pon U S twenty twenty five is now officially announced in terms of specific details, it's pretty cool. I'm i'm pretty excited.

It's back in pittsburgh because it's year two of the two year deal. So if you went last year, same deal, if you didn't, well, we had a lot of fun there so you can check out there's, uh, many interesting things. The website doesn't make IT incredibly clear.

Yeah, here you are in front. perfect. The breakdown. So if you go on here to the breakdown, I think is probably the first question people have. There's two questions I imagine many people would have straight up here.

The first one is, when is that? Because this has a huge spin of eight days that the comfort is, but it's not really those dates depending on what you want to do. For example, tutorials are made fourteen and fifteen, twenty, twenty five, but the main conference is sixteen, eighteen.

There's a good chance that you will find me at the main conference I plan on going unless something comes up with family commitment, that's something I can't make, you know. But the plane right now for me is to go to the main conference. That's pretty much IT. But how about you? You think you might go here?

I haven't a hairy appointed on that day now.

understand you really pretty mazing these days. So IT doesn't need a lot of IT.

It's pretty far out. I'm not sure i'm still offense with one. yes.

Okay, so that's one. Number one is a question. Number two.

cofer bustles.

No, that's number three. O comer two is too. I have to wear a mask all day. I'll be related to like a different time or we go into like, hey, let's pretend the world isn't the way IT is, but IT is a different way. no.

In fact, that's exactly the policy that I hope that would be a nice strongly encourage IT just like the policy as mass are strongly encouraged but not required. Please respect people who were choose, ask. great. If you don't want to.

you don't have to. Ah, that's great.

As seems reasonable. That seems come good with the world right now.

I mico extremely, and where, like a mask and flight goggles.

and and put on the side of ski gear, put on some gargles in the helmet. And no, this is not go well. We just bringing your um your apple vision pro put you have .

you fine to put like a uh like a covered mask on the top of this narrow at the end.

No, no, this, this is really good. So they are taking less precautions, you know, as you should, hand hand sentience, tions converts are full of germs. Regardless, I coit please have these kind of things, right? And things, I, hey, we have outdoor areas where eating will be available, if anyone is listening and the in charge of this and urge you.

Yes, chairs, please. Last time there was a roof area with a like a cover and he was beautiful. You can see over the river and there are these toll table.

No chairs in my back just hurt so much. After caring recording equipment on my back for half a day, I just gotta sit down somewhere there. Literally not a single chair like there just be a chair. So chairs, please. Some chairs, but other that I think this is great.

So one chair with a tag on that this has four. Michael.

yeah, exactly. Please reserved the this back hurts a lot. Just look at him is a wind and over there are right. And then somewhere in here there's call for proposals, speak yes, a peers in the talk, important deadline ah we over .

month is can start .

yes heard IT so awesome excited .

i'm excited. Oh, i'm now website is beautiful and .

I know you previous .

smayle skates .

morning looking that guys just ride in that rail there I mean, already you want to go right? They're program of skate board skatepark ks at the comforts, I guess, part.

Imagine the snake.

Sweet, sweet. What is the snake writing anyway out of?

I think it's a scape board with beans on the bottom. No, this is that. Or just get we trying to .

put a lot of meeting into this?

No, anyway, okay, right. Well.

before we get to our extras, let's quickly talk about sodium. This portion of pithum bites is brought to by codiss, the A I tool of choice for professional software developers. C O D E I cordium removes tedium from your development through a sweet of state. The R A I capabilities available with extensions in all of your favorite ID use code um in VS code.

The Debra's including pattern visual dio, proper eclipse, xcode, new vm, jupiter notebooks and more uniquely, codiss is fully enterprise ready with over a thousand pain enterprise customers, including multiple regulated fortune five hundred companies in complete self hosted air gap 的 employment。 Ts, join over a million developers and news coding for free forever. Once you see the value, then it's time to ask your company to consider a free trial of the enterprise plan to learn more about kodiak and get started today for free visit.

Python bites that F M slash code um that is python bites that F M slash C O D E R U M don't forget the e or just click the link in your pocket players so much. Thank you to kodiak or supporting pither bites. How about actress? How actually are you feeling?

I only get one extra and that is to say if this is from jeff triplet saying please publish and share more and um he he did talk about this. I messed done a little bit and the the thought is that he sees a lot of great ideas i'm ston and people posting in the thought process and research and stuff that goes into publishing A A couple of those ideas and maybe there are threads um you're almost too oppose just right like just write IT up and I told agree there's um um if it's great to post on social media but why not just right on a blog and then do a snipped of IT in link to IT from mass or whatever social you're posting IT on total degree and encourage people to do that more. Um and there's a little bit around IT like um uh talking about he says he uses a grammar um because of dislike here because I didn't know that about jeff. That's pretty cool and I don't mean to plug gravity but I may I did help one of my kids get through college.

So this epsom sponsor burning great but if you don't want .

me for something, he's also recommending something called language tool. There's link to IT in his post um cal but also don't really need to do that. It's fine to just my world nerd's here um uh right right up something you learned to on post on a blog and link to IT in a meston post or something let us know and you know if if there's something glaringly techy technical editors um or technical errors, one of your one your readers let you know to fix IT but it's it's to be nice it's not to be mean um and I I encourage that too I I don't actually don't use any grammar checkers when i'm writing blog posts.

I just put nice and yeah you I both have our blogs on hugo, which you write with markdown, have a little bit of hack for folks if they also do that, uh, writing my host, my longer post at least on something like google dogs where you get grammar checking and help and auto complete know that stuff. And I found if you just control a drill c and place IT into type pora, IT will mark down fy. Everything like h two become hash hash things, and all the links become bracket links and balls, all that kind of stuff really. And I saw, if you want a little .

bit support.

but ora a is an amazing market. good.

I use VS. Coit does enough grammar and spelling checking for me.

And you know the type you can save as an e pop file if you want to. Exactly exactly. Anyway, that's pretty right.

I I got a couple of years, but i'll go quick. I just recently had Stephanie mullen on to talk about recommit hooks. I think I talked about that, that was going to beyond, and now that has happened.

Now i'm talking about that haven't happened. The reason I bring that up is one of the things that I just ran crossed is recommit U V. So this is pretty l from the talks.

Dev group uses U, V to create virtual environments and install packages for recommend rather than regular one. So this pretty cool. So you know that something that talks and knocks and brands all do a lot of. So pretty cool people can check that out. They like.

why?

Why bryan, was I using pocket? And you see how much I had to struggle having. That's because my favorite really later thing is shutting down.

I'm of shutting down, not because they went out of business because they were awesome, but because they got bought and they decided it's too expensive to run text base. Ghilghit, I don't know. IT doesn't seem that intense, not .

profitable enough.

It's not. And I mean, get on if folks because one of one of people who started music because we recommended IT is pointing this out to me, I will support exports of your data into Jason because what are going to do with that until november seventh? And then after that time, we will be deleting all of your data.

So yeah, uh, there's a lot of options. Read wise has been recommended. Pocket is an option inside paper I found some really cool open source, self hosted ones like no mind, you don't need more things to baby, just go back in the pocket.

I am i've been using pocket. I think that works for me um is that sounds great.

but IT works.

I didn't really was back in the day.

Yeah no, me too back in the day was a good one, right? The voices though, and that's what they were required by the required by this thing called eleven lambs, which is all about creating, give IT audio. And I was pretty excited, my own.

This might just make IT even Better. Free text, speciation voice generate in my goat. I could just don't know that and check IT out, right? But if you look at the pricing, it's ridiculous.

I mean, you get for five box of months, you get thirty minutes of speech like e ababa Prices, but they don't generate the book. They just speak IT for eleven dollars, you get an hour a half per month, okay? If you are only purposes to read that in the body and you only thirty .

minutes of per month boxin eleven to ninety nine dollars, that's a big jump.

That's a month. That's not a year to have a read the text of the net, please. So I I was kind of excited, but i'm like, not excited.

So the text, of course, you, hey, I talked about moving the header and some of the U. S. Da centers, and I played around that.

And you know what, right? And think, I think, in all the things, because the whole new doctor cluster reportable across cloud thing that I did before and I was pretty easy, just tried out and i'm O K, this worked really well. I'm going to try IT because you get really nice new CPU like um A M D epic TPU and stuff along those line, which is great.

And this is not A A massive concern. But wow, the Price is good for this thing. So for example, check this out.

We could go to the U. S. And you could get in hills, burgh or ash.

Ash, unfortunate makes more sense for consumers, but I wanted to run up locally because health words just outside of poland anyway, actually, but told reason, able to run IT for thirteen dollars a month or something, or twenty dolla month. Like, for example, they have five dollars. A A C P U, sixteen, six server with twenty year by serum of band. With that is a two hundred and fifty dollar A W S server in a three hundred dollar ASR server for twenty bucks so anyway.

pretty twenty five .

euro but that's uro it's y're pretty yeah e box euro box. Um also we've talked previously about free threat of python over and over, but there is now a pretty awesome new thing that you can do with U V. Were talking a lot about U V these days, but that's because it's making a big bus really cool. U V python install dash preference only managed and a thirty three or thirteen t will create your virtual .

environment.

Yeah, yeah, that's really so probably the quick kest you you can see. I run an example. I linked to a mass on post a screen shot I posted in two point five three seconds to install three, three, three python. It's that closer and that's of course, why the preamp hooks what to use this do and some other things .

that's on yeah that's really also um remember, if you're going to try something like that, you probably need to do A U V self update first.

Yes, that's a very good point, right? Because he doesn't check more IT just knows what to burn into the binary of U V. And if you don't U V self update, IT possibly know the old one. So yeah, that's always the place .

to start with the U V. IT seems yeah, I just up the Normal thirteen other day .

and IT ouldn't work why that wasn't very funny. But I have something that we'll see. It's funny, but I have something for you.

You're already close out with the joke. yes. alright. So we have different kinds of chairs in life. No brand like you can have one of the games chairs you can have I have a slightly uncomfortable chair so I don't move around away from my mike and go like this and then like this and like so excuse me, fix but it's not that coffee, but I would like to present to you two types of chairs that are in opposition to each other. Or this is a cynical y, let's call this a cynara. You have a coating chair, which looks like an office chair, and you have the drugging chair which looks like a toilet. Just two of the different types of chairs you may try .

to sit in yeah actually you know if if it's just the the third process is um take your lapped up to the bathroom. I don't recommend IT room bug .

still out there, but just get .

away from the keyboard for a while. agree?

Yes, yeah. I think the message here, the the underlying reality of the joke is that sometimes if you just step away, IT unlocks, unlocks problem. I know when I was doing this migration of all my, I said I couldn't get let script the work midnight or something stupid letting cyp I went to sleep I like docker letting cripp combo of not working to woke up the next time I just typed some boom went I mean but I just been my happened .

I if this this hasn't happening for very long, but it's been happening, is all we stuck on issue then and then I wake up early. And I think, and I think about one of the possible a possible solution, something want to try in the code. And what time is IT mean if it's like something like an hour before Normal is fine, but often it's like one the morning, no, no, not get up right now. I will be exhausted in the morning, so just have .

to draw IT .

down and go back to sleep. yeah. Oh, great show.

sue. Thank you for here and like everyone to listen to you later. bye.