petal-power/zero-check-pipeline
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "deps: pin pip-audit to project venv via PIPAPI_PYTHON_LOCATION"

Browse Source 
This reverts commit 283dc0a632.
This commit is contained in:
Travis Herbranson 2026-05-12 08:00:09 -04:00
parent 283dc0a632
commit 32e999def2
1 changed files with 1 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
validate/deps.sh
View File

@ -32,21 +32,7 @@ if [ -n "$has_python" ]; then
if [ -n "$has_uvlock" ]; then
printf " source: %s (uv project)\n" "$has_uvlock"
pyproject_dir=$(dirname "$has_uvlock")
# Point pip-audit at the project's venv interpreter. Without this,
# `uv run pip-audit` ends up running the pip-audit binary from its
# own uv-tool install (~/.local/share/uv/tools/pip-audit/), and
# pip-audit then audits THAT environment instead of the project's
# — surfacing CVEs in pip-audit's own bundled pip/urllib3 as if
# they were the project's deps. See pip-audit's stderr warning
# ("you have a virtual environment loaded at <project>/.venv ...
# your local environment will not be audited") for context.
project_venv_python="$pyproject_dir/.venv/bin/python"
if [ -x "$project_venv_python" ]; then
audit_cmd="PIPAPI_PYTHON_LOCATION=$project_venv_python uv run --directory $pyproject_dir pip-audit"
else
printf "${YELLOW}!${NC} No project venv at %s — pip-audit may report on its own bundled deps; run \`uv sync\` and retry for an accurate audit.\n" "$project_venv_python"
audit_cmd="uv run --directory $pyproject_dir pip-audit"
fi
elif [ -n "$has_reqtxt" ]; then
printf " source: %s (requirements file)\n" "$has_reqtxt"
audit_cmd="pip-audit -r $has_reqtxt"