Introduces a pip-audit job

2026-05-05 06:05:24 +00:00 · 2026-05-02 11:00:05 -07:00
parent b38d112691
commit e1c8c6769f
1 changed files with 19 additions and 0 deletions
@@ -27,6 +27,25 @@ jobs:
          persist-credentials: false
      - name: Run zizmor
        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+  pip-audit:
+    name: pip-audit
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      - name: Export all requirements from lockfile
+        run: uv export --all-groups --format requirements-txt -o /tmp/requirements-all.txt
+      - name: Run pip-audit
+        uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 # v1.1.0
+        with:
+          inputs: /tmp/requirements-all.txt
  semgrep:
    name: Semgrep CE
    runs-on: ubuntu-24.04