Repository navigation
ci: audit uv.lock against OSV daily - #33
Merged
Merged
Conversation
Dependabot alerts missed vulnerable pins in this org (certifi in gerberdiff, msgpack in partspec), so an empty alert list is not evidence the lock is clean. `just audit` runs uv's `uv audit --frozen` over every package in uv.lock, extras included; audit.yml runs the same `uv audit` command the recipe does, as ci.yml runs its commands directly daily, on dispatch, and on PRs touching the lock, pyproject, the justfile or the workflow. A scheduled or dispatched failure opens or comments on one `audit` issue. It stays out of `just check` and the required `ok` gate, where an upstream advisory would turn every unrelated PR red. Same shape as heibench/orlab#84. Measured locally: exit 0 on this lock (57 packages); exit 1 on the lock from before #32 (certifi 2026.5.20, GHSA-6q48-6c7w-9gw2). just check: clean. just test: 487 passed, coverage 95.77%.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the lockfile audit piloted in heibench/orlab#84.
Why: Dependabot alerts missed vulnerable pins in this org: certifi 2026.5.20 in gerberdiff and msgpack 1.2.1 in partspec, neither alerted. An empty alert list isn't evidence that
uv.lockis clean.What
just audit:uv audit --frozen --preview-features audit-command. uv's own OSV audit over every package inuv.lock, extras included, with nothing new to install..github/workflows/audit.yml: runs the sameuv auditcommand the recipe does, as ci.yml runs its commands directly, daily, on dispatch, and on PRs touchinguv.lock,pyproject.toml, thejustfileor the workflow. If a scheduled or dispatched run fails, a separateissues: writejob opens anauditissue, or comments on the open one. The audit job itself iscontents: read.just checkand the requiredokgate on purpose: advisories arrive while nothing here changes, and in the gate one would turn every unrelated PR red.Evidence (local)
Not verified: the
file-issuepath, which only runs after a failed audit.uv auditis experimental; if its interface moves, the scheduled run fails and files the issue.