petal-power/zero-check-pipeline
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deps: audit uv lockfile directly via pip-audit -r /dev/stdin

Browse Source 
Replaces the PIPAPI_PYTHON_LOCATION approach (reverted in previous
commit) which assumed pip in the project venv; uv-created venvs don't
ship pip by default, so pip-audit failed when it tried to enumerate
packages via `<python> -m pip --version`.

New approach: export the lockfile as a flat requirements list via
`uv export --no-hashes --format requirements-txt` and pipe it to
`pip-audit -r /dev/stdin --disable-pip --no-deps`. This audits exactly
what uv.lock resolves to, without touching either the project venv or
pip-audit's bundled venv.

Also switch the audit_cmd invocation from `$audit_cmd` to
`eval "$audit_cmd"` so the pipeline operator survives variable
expansion. The other audit_cmd branches (requirements.txt mode,
environment mode) are simple commands and eval handles them
transparently.

Verified clean on trellis-mcp and the herbylab worktree (both uv
projects); no spurious pip/urllib3 CVEs. Trellis's editable install
produces a benign "could not deduce package version" note that
pip-audit treats as a skip, not a failure.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Travis Herbranson 2026-05-12 08:01:48 -04:00
parent 32e999def2
commit bba1526ea5
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
validate/deps.sh
View File

@ -32,7 +32,14 @@ if [ -n "$has_python" ]; then
if [ -n "$has_uvlock" ]; then
printf " source: %s (uv project)\n" "$has_uvlock"
pyproject_dir=$(dirname "$has_uvlock")
audit_cmd="uv run --directory $pyproject_dir pip-audit"
# Audit the lockfile directly: export uv.lock as a flat
# requirements list and feed it into pip-audit. Avoids
# `uv run pip-audit` (which audits pip-audit's own bundled venv,
# not the project's) AND avoids PIPAPI_PYTHON_LOCATION (which needs
# pip installed in the project venv — uv venvs don't ship pip).
# --disable-pip + --no-deps tells pip-audit not to invoke pip as
# an installer; the exported list is already resolved.
audit_cmd="( cd $pyproject_dir && uv export --no-hashes --format requirements-txt ) | pip-audit -r /dev/stdin --disable-pip --no-deps"
elif [ -n "$has_reqtxt" ]; then
printf " source: %s (requirements file)\n" "$has_reqtxt"
audit_cmd="pip-audit -r $has_reqtxt"
@ -41,7 +48,10 @@ if [ -n "$has_python" ]; then
audit_cmd="pip-audit"
fi
if $audit_cmd 2>/dev/null; then
# Run via eval so audit_cmd can carry shell metacharacters (e.g. the
# pipeline used by the uv branch). The other branches' audit_cmd
# strings are simple commands that eval handles transparently.
if eval "$audit_cmd" 2>/dev/null; then
printf "${GREEN}✓${NC} No known vulnerabilities in Python dependencies\n"
else
printf "${RED}✗${NC} Vulnerable Python dependencies found\n"