petal-power/zero-check-pipeline
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deps: skip env-mode audit on pyproject-only projects (no lockfile)

Browse Source 
When a project has pyproject.toml but no uv.lock, audit isn't
possible without mutating the project (running 'uv lock' or
'uv sync'). The bare 'pip-audit' fallback was incorrect — it
audited pip-audit's own bundled venv, producing false positives
for pip/urllib3. Skip with a clear message pointing to 'uv sync'
instead, so the gauntlet stays read-only.

Exit code 2 mirrors the existing convention used when a check
tool isn't installed (e.g., pip-audit not installed at line 27);
run-all.sh recognizes it as "skipped" rather than passed or failed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Travis Herbranson 2026-05-12 18:57:16 -04:00
parent bba1526ea5
commit 9761525e9f
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
validate/deps.sh
View File

@ -44,8 +44,13 @@ if [ -n "$has_python" ]; then
printf " source: %s (requirements file)\n" "$has_reqtxt" printf " source: %s (requirements file)\n" "$has_reqtxt"
audit_cmd="pip-audit -r $has_reqtxt" audit_cmd="pip-audit -r $has_reqtxt"
else else
printf " source: %s (environment mode)\n" "$has_pyproject" # pyproject.toml present but no uv.lock and no requirements.txt.
audit_cmd="pip-audit" # Running bare `pip-audit` here would audit the gauntlet's own
# Python environment (pip-audit's bundled uv-tool venv), producing
# false positives. Skip cleanly instead of mutating the project
# with `uv lock` / `uv sync` as a side effect of validation.
printf "${YELLOW}!${NC} No uv.lock found — run 'uv sync' to enable deps audit, skipping for now\n"
exit 2
fi fi
# Run via eval so audit_cmd can carry shell metacharacters (e.g. the # Run via eval so audit_cmd can carry shell metacharacters (e.g. the