9761525e9f
When a project has pyproject.toml but no uv.lock, audit isn't possible without mutating the project (running 'uv lock' or 'uv sync'). The bare 'pip-audit' fallback was incorrect — it audited pip-audit's own bundled venv, producing false positives for pip/urllib3. Skip with a clear message pointing to 'uv sync' instead, so the gauntlet stays read-only. Exit code 2 mirrors the existing convention used when a check tool isn't installed (e.g., pip-audit not installed at line 27); run-all.sh recognizes it as "skipped" rather than passed or failed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
87 lines
3.1 KiB
Bash
Executable File
87 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[0;33m'
|
|
NC='\033[0m'
|
|
|
|
TARGET="${1:-.}"
|
|
errors=0
|
|
|
|
echo "=== Dependency Audit ==="
|
|
|
|
has_reqtxt=$(find "$TARGET" -maxdepth 2 -name "requirements*.txt" | head -1)
|
|
has_pyproject=$(find "$TARGET" -maxdepth 2 -name "pyproject.toml" | head -1)
|
|
has_uvlock=$(find "$TARGET" -maxdepth 2 -name "uv.lock" | head -1)
|
|
has_python="${has_reqtxt}${has_pyproject}"
|
|
has_gomod=$(find "$TARGET" -maxdepth 2 -name "go.mod" | head -1)
|
|
|
|
if [ -z "$has_python" ] && [ -z "$has_gomod" ]; then
|
|
printf "${YELLOW}!${NC} No dependency files found — skipping\n"
|
|
exit 0
|
|
fi
|
|
|
|
if [ -n "$has_python" ]; then
|
|
if ! command -v pip-audit &>/dev/null; then
|
|
printf "${RED}✗${NC} pip-audit not installed\n"
|
|
exit 2
|
|
fi
|
|
|
|
echo "-- Python (pip-audit) --"
|
|
if [ -n "$has_uvlock" ]; then
|
|
printf " source: %s (uv project)\n" "$has_uvlock"
|
|
pyproject_dir=$(dirname "$has_uvlock")
|
|
# Audit the lockfile directly: export uv.lock as a flat
|
|
# requirements list and feed it into pip-audit. Avoids
|
|
# `uv run pip-audit` (which audits pip-audit's own bundled venv,
|
|
# not the project's) AND avoids PIPAPI_PYTHON_LOCATION (which needs
|
|
# pip installed in the project venv — uv venvs don't ship pip).
|
|
# --disable-pip + --no-deps tells pip-audit not to invoke pip as
|
|
# an installer; the exported list is already resolved.
|
|
audit_cmd="( cd $pyproject_dir && uv export --no-hashes --format requirements-txt ) | pip-audit -r /dev/stdin --disable-pip --no-deps"
|
|
elif [ -n "$has_reqtxt" ]; then
|
|
printf " source: %s (requirements file)\n" "$has_reqtxt"
|
|
audit_cmd="pip-audit -r $has_reqtxt"
|
|
else
|
|
# pyproject.toml present but no uv.lock and no requirements.txt.
|
|
# Running bare `pip-audit` here would audit the gauntlet's own
|
|
# Python environment (pip-audit's bundled uv-tool venv), producing
|
|
# false positives. Skip cleanly instead of mutating the project
|
|
# with `uv lock` / `uv sync` as a side effect of validation.
|
|
printf "${YELLOW}!${NC} No uv.lock found — run 'uv sync' to enable deps audit, skipping for now\n"
|
|
exit 2
|
|
fi
|
|
|
|
# Run via eval so audit_cmd can carry shell metacharacters (e.g. the
|
|
# pipeline used by the uv branch). The other branches' audit_cmd
|
|
# strings are simple commands that eval handles transparently.
|
|
if eval "$audit_cmd" 2>/dev/null; then
|
|
printf "${GREEN}✓${NC} No known vulnerabilities in Python dependencies\n"
|
|
else
|
|
printf "${RED}✗${NC} Vulnerable Python dependencies found\n"
|
|
errors=$((errors + 1))
|
|
fi
|
|
fi
|
|
|
|
if [ -n "$has_gomod" ]; then
|
|
if ! command -v govulncheck &>/dev/null; then
|
|
printf "${YELLOW}!${NC} govulncheck not installed — skipping Go audit\n"
|
|
else
|
|
echo "-- Go (govulncheck) --"
|
|
printf " source: %s\n" "$has_gomod"
|
|
gomod_dir=$(dirname "$has_gomod")
|
|
if (cd "$gomod_dir" && govulncheck ./... 2>/dev/null); then
|
|
printf "${GREEN}✓${NC} No known vulnerabilities in Go dependencies\n"
|
|
else
|
|
printf "${RED}✗${NC} Vulnerable Go dependencies found\n"
|
|
errors=$((errors + 1))
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
if [ "$errors" -gt 0 ]; then
|
|
exit 1
|
|
else
|
|
exit 0
|
|
fi |