From fb570c85e55a882bf7a95464d38df5afcf0fa8bc Mon Sep 17 00:00:00 2001 From: Thorsten Klein Date: Sun, 25 Oct 2026 20:05:59 +0100 Subject: [PATCH] ci: audit only the runtime dependencies with pip-audit pip-audit ran against the whole dev environment, so a CVE in a dev-only tool failed every build. filelock (pulled in by pre-commit via virtualenv, and by pip-audit itself via cachecontrol) has CVEs whose fix needs Python >= 3.11, so the 3.10 jobs could never pass. Audit an export of the locked runtime dependencies instead: that is what ships with git-nested. Co-Authored-By: Claude Opus 5.5 (1M context) --- pyproject.toml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index ae2c7d3..c87509f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -233,7 +233,17 @@ lint = "ruff check ." mypy = "mypy" pyright = "pyright" bandit = "bandit -c pyproject.toml -r src" -"pip-audit" = "pip-audit --skip-editable" +# Audits only what ships: the locked runtime dependencies, no dependency +# groups. A CVE in a dev tool (e.g. filelock via pre-commit, whose fix needed a +# newer Python than we support) must not fail the build. Markers in the export +# are evaluated for the running Python, so each CI version audits its own set. +"pip-audit" = {shell = """ +set -e +req="$(mktemp)" +trap 'rm -f "$req"' EXIT +uv export --frozen --no-emit-project --no-default-groups --quiet --output-file "$req" > /dev/null +pip-audit --disable-pip --requirement "$req" +"""} complexity = "complexipy" # Fast inner loop: the unit tests only, and deliberately WITHOUT --cov -- # `fail_under = 100` would otherwise fail every partial run.