From 62033e420b4e659e516c8cadfa6f5556bc61e948 Mon Sep 17 00:00:00 2001 From: Nelson Spence Date: Sun, 26 Apr 2026 15:36:37 -0500 Subject: [PATCH] fix(ci): scope pip-audit to locked deps; suppress uv-export stderr MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The security job was failing on every PR because `uvx pip-audit==2.9.0` with no -r argument scans the transient uvx environment, which contains its own pip 26.0.1 — flagged by GHSA-58qw-9mgm-455v / CVE-2026-3219 (pip tar/ZIP interpretation conflict, severity medium, no patched version available yet). pip is not in our uv.lock; this audit was auditing the runner's Python environment, not our actual deps. Fix: export uv.lock to a requirements.txt and pass it via -r. Audits exactly our pinned dependencies, ignores the transient runner pip. Stderr is dropped because `uv export` writes 'Resolved 36 packages' to stderr which would land at line 1 of the file via shell redirection on some setups and trip pip-audit's parser. Verified locally: 'No known vulnerabilities found' against current uv.lock. Will keep working when upstream eventually patches pip; still correctly fails CI if any of OUR pinned deps gain a new vuln. --- .github/workflows/tests.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 3debf40..ea365df 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -166,7 +166,14 @@ jobs: run: uv run bandit -r src/navi_bootstrap -ll - name: Audit dependencies (pip-audit) - run: uvx pip-audit==2.9.0 + # Scope the audit to OUR locked dependency tree exported from uv, + # not the transient uvx environment. Otherwise pip-audit also scans + # its own runtime (which currently flags the runner's pip 26.0.1 + # for GHSA-58qw-9mgm-455v / CVE-2026-3219, an unpatched pip CVE + # that has nothing to do with this project's dependencies). + run: | + uv export --format requirements.txt --no-emit-project --no-hashes > /tmp/audit-deps.txt 2>/dev/null + uvx pip-audit==2.9.0 -r /tmp/audit-deps.txt # ── Required check: quality-gate ──────────────────────────────────── # CONTRACT: org ruleset requires this exact check name