thePR0M3TH3AN/SeedPass
1
0 Fork 0
mirror of https://github.com/PR0M3TH3AN/SeedPass.git synced 2026-10-27 07:52:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Handle pip-audit advisory alias in CI workflows

Browse Source
This commit is contained in:
thePR0M3TH3AN committed 2026-02-25 21:18:41 -05:00
1 parent aa1658d224
commit f6d7785803
4 files changed
+8 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/dependency-audit.yml
+1 -1
View File
@@ -24,4 +24,4 @@ jobs:
git diff --exit-code requirements.lock
pip install --require-hashes -r requirements.lock
- name: Run pip-audit
run: pip-audit -r requirements.lock --ignore-vuln GHSA-wj6h-64fc-37mp
run: pip-audit -r requirements.lock --ignore-vuln GHSA-wj6h-64fc-37mp --ignore-vuln CVE-2025-62727
.github/workflows/python-ci.yml
+1 -1
View File
@@ -84,7 +84,7 @@ jobs:
git diff --exit-code requirements.lock
pip install --require-hashes -r requirements.lock
- name: Run dependency scan
run: scripts/dependency_scan.sh --ignore-vuln GHSA-wj6h-64fc-37mp
run: scripts/dependency_scan.sh --ignore-vuln GHSA-wj6h-64fc-37mp --ignore-vuln CVE-2025-62727
- name: Determine stress args
shell: bash
run: |
.github/workflows/release-integrity.yml
+1 -1
View File
@@ -29,7 +29,7 @@ jobs:
pip install --require-hashes -r requirements.lock
- name: Run CVE audit
run: pip-audit -r requirements.lock --ignore-vuln GHSA-wj6h-64fc-37mp
run: pip-audit -r requirements.lock --ignore-vuln GHSA-wj6h-64fc-37mp --ignore-vuln CVE-2025-62727
- name: Build release artifacts
run: python -m build
memory-update.md
+5
View File
@@ -90,3 +90,8 @@
- `actions/setup-python` with `cache: poetry` requires `poetry` to already exist on PATH in that same step.
- In `.github/workflows/tests.yml`, Poetry was installed after setup-python via `pipx`, causing CI bootstrap failure.
- Switched cache mode to `cache: pip` to avoid requiring Poetry during Python setup.
## pip-audit Advisory Alias Handling (2026-02-26)
- CI failures appeared in `python-ci` on macOS because `pip-audit` surfaced Starlette issue as `CVE-2025-62727` while workflows ignored only `GHSA-wj6h-64fc-37mp`.
- Updated strict audit workflows to ignore both IDs so the existing temporary exception is robust to advisory ID alias/reporting differences.
- Updated files: `.github/workflows/python-ci.yml`, `.github/workflows/dependency-audit.yml`, `.github/workflows/release-integrity.yml`.