From 9761525e9ffc4fd655d88c2858b6222a04e6ee0a Mon Sep 17 00:00:00 2001 From: Travis Herbranson Date: Tue, 12 May 2026 18:57:16 -0400 Subject: [PATCH] deps: skip env-mode audit on pyproject-only projects (no lockfile) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When a project has pyproject.toml but no uv.lock, audit isn't possible without mutating the project (running 'uv lock' or 'uv sync'). The bare 'pip-audit' fallback was incorrect — it audited pip-audit's own bundled venv, producing false positives for pip/urllib3. Skip with a clear message pointing to 'uv sync' instead, so the gauntlet stays read-only. Exit code 2 mirrors the existing convention used when a check tool isn't installed (e.g., pip-audit not installed at line 27); run-all.sh recognizes it as "skipped" rather than passed or failed. Co-Authored-By: Claude Opus 4.7 (1M context) --- validate/deps.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/validate/deps.sh b/validate/deps.sh index 91bd8db..d09bb4e 100755 --- a/validate/deps.sh +++ b/validate/deps.sh @@ -44,8 +44,13 @@ if [ -n "$has_python" ]; then printf " source: %s (requirements file)\n" "$has_reqtxt" audit_cmd="pip-audit -r $has_reqtxt" else - printf " source: %s (environment mode)\n" "$has_pyproject" - audit_cmd="pip-audit" + # pyproject.toml present but no uv.lock and no requirements.txt. + # Running bare `pip-audit` here would audit the gauntlet's own + # Python environment (pip-audit's bundled uv-tool venv), producing + # false positives. Skip cleanly instead of mutating the project + # with `uv lock` / `uv sync` as a side effect of validation. + printf "${YELLOW}!${NC} No uv.lock found — run 'uv sync' to enable deps audit, skipping for now\n" + exit 2 fi # Run via eval so audit_cmd can carry shell metacharacters (e.g. the