Skip to content

fix(ci): scope pip-audit to locked deps (was failing on transient runner pip CVE) #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Navi Bot (project-navi-bot) merged 1 commit into from
Apr 26, 2026
Merged

fix(ci): scope pip-audit to locked deps (was failing on transient runner pip CVE) #53

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,14 @@ jobs:
run: uv run bandit -r src/navi_bootstrap -ll

- name: Audit dependencies (pip-audit)
run: uvx pip-audit==2.9.0
# Scope the audit to OUR locked dependency tree exported from uv,
# not the transient uvx environment. Otherwise pip-audit also scans
# its own runtime (which currently flags the runner's pip 26.0.1
# for GHSA-58qw-9mgm-455v / CVE-2026-3219, an unpatched pip CVE
# that has nothing to do with this project's dependencies).
run: |
uv export --format requirements.txt --no-emit-project --no-hashes > /tmp/audit-deps.txt 2>/dev/null

Copilot AI Apr 26, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uv export ... 2>/dev/null suppresses all stderr, which will hide real export errors/warnings and make CI failures much harder to debug (you'll just see a downstream pip-audit failure). Prefer keeping stderr visible, or suppress only the known benign progress line (e.g., via a --quiet/--no-progress flag if uv export supports it, or by filtering that specific line while still surfacing errors).

Suggested change
uv export --format requirements.txt --no-emit-project --no-hashes > /tmp/audit-deps.txt 2>/dev/null
uv export --format requirements.txt --no-emit-project --no-hashes > /tmp/audit-deps.txt

Copilot uses AI. Check for mistakes.
uvx pip-audit==2.9.0 -r /tmp/audit-deps.txt
Comment on lines +169 to +176

@qodo-code-review qodo-code-review Bot Apr 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Disallowed .github/ path modified 📘 Rule violation § Compliance

This PR modifies .github/workflows/tests.yml, which is outside the allowed top-level directories
(src/, tests/, packs/, docs/) and no explicit approval is recorded. This violates the
directory allow-list policy for file modifications.
Agent Prompt 
## Issue description
A file outside the allowed directory prefixes was modified without an explicit approval note.

## Issue Context
Policy allow-lists modifications to `src/`, `tests/`, `packs/`, `docs/` unless an explicit approval/exception is recorded in the PR.

## Fix Focus Areas
- .github/workflows/tests.yml[169-176]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


# ── Required check: quality-gate ────────────────────────────────────
# CONTRACT: org ruleset requires this exact check name
Expand Down
Loading