bba1526ea5
Replaces the PIPAPI_PYTHON_LOCATION approach (reverted in previous commit) which assumed pip in the project venv; uv-created venvs don't ship pip by default, so pip-audit failed when it tried to enumerate packages via `<python> -m pip --version`. New approach: export the lockfile as a flat requirements list via `uv export --no-hashes --format requirements-txt` and pipe it to `pip-audit -r /dev/stdin --disable-pip --no-deps`. This audits exactly what uv.lock resolves to, without touching either the project venv or pip-audit's bundled venv. Also switch the audit_cmd invocation from `$audit_cmd` to `eval "$audit_cmd"` so the pipeline operator survives variable expansion. The other audit_cmd branches (requirements.txt mode, environment mode) are simple commands and eval handles them transparently. Verified clean on trellis-mcp and the herbylab worktree (both uv projects); no spurious pip/urllib3 CVEs. Trellis's editable install produces a benign "could not deduce package version" note that pip-audit treats as a skip, not a failure. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
82 lines
2.7 KiB
Bash
Executable File
82 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[0;33m'
|
|
NC='\033[0m'
|
|
|
|
TARGET="${1:-.}"
|
|
errors=0
|
|
|
|
echo "=== Dependency Audit ==="
|
|
|
|
has_reqtxt=$(find "$TARGET" -maxdepth 2 -name "requirements*.txt" | head -1)
|
|
has_pyproject=$(find "$TARGET" -maxdepth 2 -name "pyproject.toml" | head -1)
|
|
has_uvlock=$(find "$TARGET" -maxdepth 2 -name "uv.lock" | head -1)
|
|
has_python="${has_reqtxt}${has_pyproject}"
|
|
has_gomod=$(find "$TARGET" -maxdepth 2 -name "go.mod" | head -1)
|
|
|
|
if [ -z "$has_python" ] && [ -z "$has_gomod" ]; then
|
|
printf "${YELLOW}!${NC} No dependency files found — skipping\n"
|
|
exit 0
|
|
fi
|
|
|
|
if [ -n "$has_python" ]; then
|
|
if ! command -v pip-audit &>/dev/null; then
|
|
printf "${RED}✗${NC} pip-audit not installed\n"
|
|
exit 2
|
|
fi
|
|
|
|
echo "-- Python (pip-audit) --"
|
|
if [ -n "$has_uvlock" ]; then
|
|
printf " source: %s (uv project)\n" "$has_uvlock"
|
|
pyproject_dir=$(dirname "$has_uvlock")
|
|
# Audit the lockfile directly: export uv.lock as a flat
|
|
# requirements list and feed it into pip-audit. Avoids
|
|
# `uv run pip-audit` (which audits pip-audit's own bundled venv,
|
|
# not the project's) AND avoids PIPAPI_PYTHON_LOCATION (which needs
|
|
# pip installed in the project venv — uv venvs don't ship pip).
|
|
# --disable-pip + --no-deps tells pip-audit not to invoke pip as
|
|
# an installer; the exported list is already resolved.
|
|
audit_cmd="( cd $pyproject_dir && uv export --no-hashes --format requirements-txt ) | pip-audit -r /dev/stdin --disable-pip --no-deps"
|
|
elif [ -n "$has_reqtxt" ]; then
|
|
printf " source: %s (requirements file)\n" "$has_reqtxt"
|
|
audit_cmd="pip-audit -r $has_reqtxt"
|
|
else
|
|
printf " source: %s (environment mode)\n" "$has_pyproject"
|
|
audit_cmd="pip-audit"
|
|
fi
|
|
|
|
# Run via eval so audit_cmd can carry shell metacharacters (e.g. the
|
|
# pipeline used by the uv branch). The other branches' audit_cmd
|
|
# strings are simple commands that eval handles transparently.
|
|
if eval "$audit_cmd" 2>/dev/null; then
|
|
printf "${GREEN}✓${NC} No known vulnerabilities in Python dependencies\n"
|
|
else
|
|
printf "${RED}✗${NC} Vulnerable Python dependencies found\n"
|
|
errors=$((errors + 1))
|
|
fi
|
|
fi
|
|
|
|
if [ -n "$has_gomod" ]; then
|
|
if ! command -v govulncheck &>/dev/null; then
|
|
printf "${YELLOW}!${NC} govulncheck not installed — skipping Go audit\n"
|
|
else
|
|
echo "-- Go (govulncheck) --"
|
|
printf " source: %s\n" "$has_gomod"
|
|
gomod_dir=$(dirname "$has_gomod")
|
|
if (cd "$gomod_dir" && govulncheck ./... 2>/dev/null); then
|
|
printf "${GREEN}✓${NC} No known vulnerabilities in Go dependencies\n"
|
|
else
|
|
printf "${RED}✗${NC} Vulnerable Go dependencies found\n"
|
|
errors=$((errors + 1))
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
if [ "$errors" -gt 0 ]; then
|
|
exit 1
|
|
else
|
|
exit 0
|
|
fi |