Replaces the PIPAPI_PYTHON_LOCATION approach (reverted in previous
commit) which assumed pip in the project venv; uv-created venvs don't
ship pip by default, so pip-audit failed when it tried to enumerate
packages via `<python> -m pip --version`.
New approach: export the lockfile as a flat requirements list via
`uv export --no-hashes --format requirements-txt` and pipe it to
`pip-audit -r /dev/stdin --disable-pip --no-deps`. This audits exactly
what uv.lock resolves to, without touching either the project venv or
pip-audit's bundled venv.
Also switch the audit_cmd invocation from `$audit_cmd` to
`eval "$audit_cmd"` so the pipeline operator survives variable
expansion. The other audit_cmd branches (requirements.txt mode,
environment mode) are simple commands and eval handles them
transparently.
Verified clean on trellis-mcp and the herbylab worktree (both uv
projects); no spurious pip/urllib3 CVEs. Trellis's editable install
produces a benign "could not deduce package version" note that
pip-audit treats as a skip, not a failure.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
bba1526ea5