From bf8d3b1faed31726432e7e2820c32c015c45ff6d Mon Sep 17 00:00:00 2001 From: Chisanan232 <42397554+Chisanan232@users.noreply.github.com> Date: Fri, 2 Oct 2026 16:30:39 +0800 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20ci(dependency-audit):=20Audit=20?= =?UTF-8?q?the=20project=20env,=20not=20uvx's=20own?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gate ran `uvx pip-audit`. `uvx` gives the tool its own throwaway environment and pip-audit audits whichever environment it runs in, so the job audited pip-audit's ~29 dependencies and never looked at the 194 packages the preceding `uv sync --frozen` had just installed. It was therefore incapable of failing on a project dependency, and it did not: it was green on every commit while this repository carried 24 open Dependabot alerts against uv.lock, one of them critical. Run the audit through `uv run --frozen --with` so it resolves the locked project environment, and allowlist the one advisory that has no fixed release (nltk PYSEC-2026-3740) in the format the job already documented. Proven on one identical tree, the pre-bump lock at 7cad098b: `uvx pip-audit --strict --desc` exits 0 with "No known vulnerabilities found", while the new command exits 1 with "Found 24 known vulnerabilities, ignored 1 in 3 packages" (pyjwt, urllib3, virtualenv). refs AAASM-6251 Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yaml | 42 +++++++++++++++++++++++++++++---------- 1 file changed, 31 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f3293be7..e14f58d3 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -80,9 +80,22 @@ jobs: # AAASM-3612: advisory gate. Fail CI when a (possibly transitive) dependency # in the locked set carries a known advisory, so a poisoned dep cannot ride - # into a release through uv.lock. pip-audit resolves the synced environment - # against the PyPI Advisory + OSV databases; a non-empty result exits - # non-zero and fails the job. + # into a release through uv.lock. pip-audit audits whichever environment it is + # itself running in, against the PyPI Advisory + OSV databases; a non-empty + # result exits non-zero and fails the job. + # + # AAASM-6251: that last sentence is why the audit MUST run through + # `uv run --frozen --with`, and must not go back to `uvx`. `uvx` deliberately + # builds the tool its own throwaway environment, so `uvx pip-audit` audited + # pip-audit's own ~29 dependencies and never looked at the 194 packages the + # step above had just synced. The gate was therefore structurally incapable of + # failing on a project dependency, and it did not: it was green on every + # commit while this repository carried 24 open Dependabot alerts against + # uv.lock, one of them critical. + # + # `--path .venv/lib/python/site-packages` is not an alternative. It is + # silent on a path that does not exist, so the day the interpreter version + # moves, the gate goes back to passing vacuously with no error at all. dependency-audit: name: Dependency advisory audit (pip-audit) runs-on: ubuntu-latest @@ -97,17 +110,24 @@ jobs: run: uv sync --frozen - name: Run pip-audit advisory gate # Documented allowlist for advisories with NO available fix, mirroring - # go-sdk's KNOWN_UNFIXED. Add an entry ONLY when there is no fixed - # release, with a dated rationale, in the form: - # --ignore-vuln GHSA-xxxx-xxxx-xxxx # - # The list starts empty: every known-vuln dependency fails the gate. + # go-sdk's KNOWN_UNFIXED. Add an `--ignore-vuln ` flag ONLY when + # there is no fixed release, and put a dated rationale and a removal + # condition in a comment immediately above it, as done below. + # + # `--frozen` keeps `uv run` from touching uv.lock, so the audited set is + # exactly the locked set rather than a fresh resolution. run: | set -euo pipefail - uvx pip-audit \ + # PYSEC-2026-3740 - nltk, reached transitively through + # llama-index-core in the dev group. As of 2026-10-02 the locked + # 3.10.3 is the newest nltk release on PyPI and no fixed release + # exists, so the gate cannot be satisfied by a bump. + # REMOVE this flag once nltk publishes a release that fixes it and + # uv.lock picks that version up. + uv run --frozen --with pip-audit pip-audit \ --strict \ - --desc - # To allowlist an unfixable advisory, append flags above, e.g.: - # --ignore-vuln GHSA-xxxx-xxxx-xxxx # 2026-06-23 no fixed release yet + --desc \ + --ignore-vuln PYSEC-2026-3740 # AAASM-4034: dedicated leg that installs `langchain-core` (the non-default # `langchain-test` group) so the AAASM-4014 `__getattr__` is exercised against