[icanhasmath]

The fork's only CI config is .travis.yml, which no longer runs, so pull requests show no checks. The 4.5.post1 security release (#4) was verified only by local Python 2.7 runs.

This adds .github/workflows/tests.yml. It runs pytest tests on every pull request and on pushes to version-4.5.x:

• Python 2.7, in the python:2.7 container, with pytest 4.6.11, mock 3.0.5 and pyasn1 0.4.8. setup-python no longer provides 2.7.
• Python 3.8 (end of life, near the 3.5-3.7 that setup.py lists) and Python 3.13 (in support), in the python:3.8 and python:3.13 containers.

tox.ini's [pytest] addopts asks for pytest-cov, so the job passes -o addopts=.

.travis.yml is left in place. Removing it is a separate change.

Verification

• The same commands in docker, on this branch merged with version-4.5.x after Release 4.5.post1: CVE-2020-25658 for the Python 2.7 line #4 (52e2215): 99 passed on 2.7, 3.8, 3.12 and 3.13.
• The suite catches a regression of Release 4.5.post1: CVE-2020-25658 for the Python 2.7 line #4: with sep_idx_bad = sep_idx < 10 changed to < 0 in rsa/pkcs1.py, the 2.7 run fails tests/test_pkcs1.py:243 (DecryptionError not raised).
• The doctests aren't run: 5 of them fail the same way on upstream 4.5, because their expected output is Python 3 b''.

CI on this push (dcbdfba): 99 passed on 2.7.18, 3.8.20 and 3.13.18, with no Node.js deprecation warning.

Tracking: Linear PROD-2446.

[Copilot]

🟢 Approval recommended

No active review issues remain for the added GitHub Actions test workflow.

No open issues 🎉

What changed in this PR

Adds GitHub Actions test coverage for the Python 2.7 maintenance branch, providing automated checks for future changes to the 4.5.post1 security release.

Changes:

• Runs tests on pull requests, pushes to version-4.5.x, and manual dispatch.
• Tests Python 2.7, 3.8, and 3.13 in official containers, with compatible dependency pins for Python 2.7.
• Overrides pytest’s default options to avoid requiring pytest-cov; leaves Travis configuration unchanged.

File	Description
.github/​workflows/​tests.yml	Adds the container-based Python test matrix with read-only repository permissions.

_{Review effort: Balanced}

[swagile1]

Verdict: approve, no blockers. This does what PROD-2446 asks: a PR to version-4.5.x runs the suite on Python 2.7 and a supported Python 3 and reports a check.

Change map

Problem. The fork's only CI config is a dead .travis.yml, so the 4.5.post1 security release (#4) was verified only by local 2.7 runs. The PR body matches the ticket.

Approach. One file, .github/workflows/tests.yml: a two-entry matrix in python:2.7 (pytest 4.6.11, mock 3.0.5, pyasn1 0.4.8 pinned, since setup-python no longer ships 2.7) and python:3.8 (unpinned). Triggers on every PR, pushes to version-4.5.x, and workflow_dispatch; contents: read; -o addopts= drops tox.ini's coverage flags.

Evidence. Both jobs are green at 92 passed each, but the branch starts at 4834b90, before #4 merged, so those checks ran against the pre-fix code. I merged this PR onto the current version-4.5.x and ran the workflow's own commands in the same two images: 99 passed on 2.7, 99 passed on 3.8, matching the ticket's count. The pre-2.7.7 _compare_digest fallback is exercised directly by tests/test_compat.py:84-96, so the 2.7.18 image covers it.

Shape. No new code beyond the YAML, and no earlier GitHub Actions workflow in the fork to duplicate. Doctests stay out, as the ticket allows. .travis.yml and tox.ini are untouched.

What merging commits us to. Little; reverting is deleting one file. The 3.8 job can drift as dependencies drop 3.8, though pip's python_requires handling keeps choosing versions that support it.

Findings

🔴 Blockers: None.

⚪ Suggestions

1. Rebase on version-4.5.x and re-run [importance 1 / effort 1]. The checks and the body's "92 passed" predate #4. The merged tree passes 99/99 locally, but the PR's own record should show the security code under test.
2. Bump actions/checkout@v4 to @v5 [importance 1 / effort 1]. Both jobs warn that Node.js 20 is deprecated and checkout@v4 is being forced onto Node 24. It already runs fine on Node 24 inside the buster-based python:2.7 container, so v5 is safe.
3. No change needed here: the ticket's agent notes credit setup.cfg with the coverage flags, but they come from tox.ini's [pytest] addopts, as the PR comment says.

Checked

• Security: pull_request, not pull_request_target; read-only token; no third-party actions beyond checkout.
• Failure modes: a pip install failure fails the job; fail-fast: false keeps a 3.8 break from hiding the 2.7 result; the python:2.7 tag has been frozen since 2020.
• -e . --no-deps after installing pyasn1 explicitly is consistent with setup.py's install_requires.

Not assessed

• Doctests (out of scope per the ticket).
• THR's review dispatcher was not run, since this PR is outside THR; the checklist was applied by hand on a scratch clone.