When a project has pyproject.toml but no uv.lock, audit isn't
possible without mutating the project (running 'uv lock' or
'uv sync'). The bare 'pip-audit' fallback was incorrect — it
audited pip-audit's own bundled venv, producing false positives
for pip/urllib3. Skip with a clear message pointing to 'uv sync'
instead, so the gauntlet stays read-only.
Exit code 2 mirrors the existing convention used when a check
tool isn't installed (e.g., pip-audit not installed at line 27);
run-all.sh recognizes it as "skipped" rather than passed or failed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the PIPAPI_PYTHON_LOCATION approach (reverted in previous
commit) which assumed pip in the project venv; uv-created venvs don't
ship pip by default, so pip-audit failed when it tried to enumerate
packages via `<python> -m pip --version`.
New approach: export the lockfile as a flat requirements list via
`uv export --no-hashes --format requirements-txt` and pipe it to
`pip-audit -r /dev/stdin --disable-pip --no-deps`. This audits exactly
what uv.lock resolves to, without touching either the project venv or
pip-audit's bundled venv.
Also switch the audit_cmd invocation from `$audit_cmd` to
`eval "$audit_cmd"` so the pipeline operator survives variable
expansion. The other audit_cmd branches (requirements.txt mode,
environment mode) are simple commands and eval handles them
transparently.
Verified clean on trellis-mcp and the herbylab worktree (both uv
projects); no spurious pip/urllib3 CVEs. Trellis's editable install
produces a benign "could not deduce package version" note that
pip-audit treats as a skip, not a failure.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`uv run --directory <project> pip-audit` runs the pip-audit BINARY
through uv, but pip-audit's binary lives at
~/.local/share/uv/tools/pip-audit/ with its own embedded Python. When
invoked without `PIPAPI_PYTHON_LOCATION`, pip-audit defaults to using
the python it shipped with for its dependency resolution — so it audits
ITS OWN venv (which has its own bundled pip + urllib3 versions, both
currently flagged with CVEs) instead of the project's venv.
pip-audit emits a stderr warning about this:
pip-audit will run pip against
~/.local/share/uv/tools/pip-audit/bin/python, but you have a virtual
environment loaded at <project>/.venv. This may result in unintuitive
audits, since your local environment will not be audited. You can
forcefully override this behavior by setting PIPAPI_PYTHON_LOCATION
to the location of your virtual environment's Python interpreter.
Reproduced as a false positive on every uv project on this host —
trellis-mcp and herbylab both got the identical 4 CVEs despite neither
having pip or urllib3 in its dep tree.
Fix: set PIPAPI_PYTHON_LOCATION to the project's .venv/bin/python when
it exists. When it doesn't exist, fall back to the old behavior with a
yellow warning that the audit may be inaccurate (avoids silently
running `uv sync` as a side effect of validation).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Preserve pre-existing WIP from master's working tree. When a project
has a uv.lock alongside pyproject.toml, run pip-audit and pytest under
`uv run --directory $project` so they execute in the project's own
managed venv instead of whatever pytest/pip-audit happens to be on PATH.
Lifted verbatim from master's uncommitted working tree; committed on
this branch as the base for subsequent Bug B (tests.sh SIGPIPE) and
Bug C (pip-audit venv) fixes which both modify these regions.
