bba1526ea5
Replaces the PIPAPI_PYTHON_LOCATION approach (reverted in previous commit) which assumed pip in the project venv; uv-created venvs don't ship pip by default, so pip-audit failed when it tried to enumerate packages via `<python> -m pip --version`. New approach: export the lockfile as a flat requirements list via `uv export --no-hashes --format requirements-txt` and pipe it to `pip-audit -r /dev/stdin --disable-pip --no-deps`. This audits exactly what uv.lock resolves to, without touching either the project venv or pip-audit's bundled venv. Also switch the audit_cmd invocation from `$audit_cmd` to `eval "$audit_cmd"` so the pipeline operator survives variable expansion. The other audit_cmd branches (requirements.txt mode, environment mode) are simple commands and eval handles them transparently. Verified clean on trellis-mcp and the herbylab worktree (both uv projects); no spurious pip/urllib3 CVEs. Trellis's editable install produces a benign "could not deduce package version" note that pip-audit treats as a skip, not a failure. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| skills/zero-check | ||
| templates | ||
| validate | ||
| .gitignore | ||
| .python-version | ||
| check-deps.sh | ||
| main.py | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||