9761525e9f
When a project has pyproject.toml but no uv.lock, audit isn't possible without mutating the project (running 'uv lock' or 'uv sync'). The bare 'pip-audit' fallback was incorrect — it audited pip-audit's own bundled venv, producing false positives for pip/urllib3. Skip with a clear message pointing to 'uv sync' instead, so the gauntlet stays read-only. Exit code 2 mirrors the existing convention used when a check tool isn't installed (e.g., pip-audit not installed at line 27); run-all.sh recognizes it as "skipped" rather than passed or failed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| skills/zero-check | ||
| templates | ||
| validate | ||
| .gitignore | ||
| .python-version | ||
| check-deps.sh | ||
| main.py | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||