Repository navigation
ci: audit uv.lock against OSV daily - #84
Merged
Merged
Conversation
Dependabot alerts missed vulnerable pins elsewhere in the org (a certifi in gerberdiff and an msgpack in partspec, neither alerted), so an empty alert list is not evidence the lock is clean. `just audit` runs uv's `uv audit --frozen` over every package in uv.lock, extras included; audit.yml runs it daily, on dispatch, and on PRs that touch the lock, pyproject, the justfile or the workflow itself. It stays out of `just check` and the required `ok` gate: advisories arrive while nothing here changes, and in the gate one would turn every unrelated PR red. A scheduled or dispatched failure opens or comments on a single `audit` issue instead, split from the audit job the way canary.yml splits its token scopes. `uv audit` is experimental in uv 0.13; --preview-features opts in. Measured locally: exit 0 on this lock (56 packages); exit 1 on the pre-#79 lock (pillow 12.3.0, certifi 2026.6.17). just check: clean. just test: 235 passed, 2 skipped (pandas absent).
This was referenced Oct 31, 2026
CameronBrooks11
added a commit
to heibench/partspec
that referenced
this pull request
Oct 31, 2026
Dependabot alerts missed vulnerable pins in this org (certifi in gerberdiff, msgpack in partspec), so an empty alert list is not evidence the lock is clean. `just audit` runs uv's `uv audit --frozen` over every package in uv.lock, extras included; audit.yml runs `just audit` daily, on dispatch, and on PRs touching the lock, pyproject, the justfile or the workflow. A scheduled or dispatched failure opens or comments on one `audit` issue. It stays out of `just check` and the required `ok` gate, where an upstream advisory would turn every unrelated PR red. Same shape as heibench/orlab#84. Measured locally: exit 0 on this lock (118 packages); exit 1 on the lock from before #427 (msgpack 1.2.1, CVE-2026-114613). just check: clean. just test: 1401 passed.
CameronBrooks11
added a commit
to heibench/gerberdiff
that referenced
this pull request
Oct 31, 2026
Adds the lockfile audit piloted in heibench/orlab#84. **Why:** Dependabot alerts missed vulnerable pins in this org: certifi 2026.5.20 in gerberdiff and msgpack 1.2.1 in partspec, neither alerted. An empty alert list isn't evidence that `uv.lock` is clean. **What** - `just audit`: `uv audit --frozen --preview-features audit-command`. uv's own OSV audit over every package in `uv.lock`, extras included, with nothing new to install. - `.github/workflows/audit.yml`: runs the same `uv audit` command the recipe does, as ci.yml runs its commands directly, daily, on dispatch, and on PRs touching `uv.lock`, `pyproject.toml`, the `justfile` or the workflow. If a scheduled or dispatched run fails, a separate `issues: write` job opens an `audit` issue, or comments on the open one. The audit job itself is `contents: read`. - Out of `just check` and the required `ok` gate on purpose: advisories arrive while nothing here changes, and in the gate one would turn every unrelated PR red. **Evidence (local)** - Current lock: no known vulnerabilities in 57 packages, exit 0. - Red state: exit 1 on the lock from before #32 (certifi 2026.5.20, GHSA-6q48-6c7w-9gw2). - just check: clean. just test: 487 passed, coverage 95.77%. **Not verified:** the `file-issue` path, which only runs after a failed audit. `uv audit` is experimental; if its interface moves, the scheduled run fails and files the issue.
CameronBrooks11
added a commit
to heibench/slicelab
that referenced
this pull request
Oct 31, 2026
Dependabot alerts missed vulnerable pins in this org (certifi in gerberdiff, msgpack in partspec), so an empty alert list is not evidence the lock is clean. `just audit` runs uv's `uv audit --frozen` over every package in uv.lock, extras included; audit.yml runs `just audit` daily, on dispatch, and on PRs touching the lock, pyproject, the justfile or the workflow. A scheduled or dispatched failure opens or comments on one `audit` issue. It stays out of `just check` and the required `ok` gate, where an upstream advisory would turn every unrelated PR red. Same shape as heibench/orlab#84. Measured locally: exit 0 on this lock (15 packages); no vulnerable lock in this repo's history to show it red on; the same recipe goes red on partspec's and gerberdiff's. just check: clean. just test: 500 passed, 75 skipped (no slicer engine here).
CameronBrooks11
added a commit
to heibench/prusaslicer-py
that referenced
this pull request
Oct 31, 2026
Dependabot alerts missed vulnerable pins in this org (certifi in gerberdiff, msgpack in partspec), so an empty alert list is not evidence the lock is clean. `just audit` runs uv's `uv audit --frozen` over every package in uv.lock, extras included; audit.yml runs `just audit` daily, on dispatch, and on PRs touching the lock, pyproject, the justfile or the workflow. A scheduled or dispatched failure opens or comments on one `audit` issue. It stays out of `just check` and the required `ok` gate, where an upstream advisory would turn every unrelated PR red. Same shape as heibench/orlab#84. Measured locally: exit 0 on this lock (13 packages); no vulnerable lock in this repo's history to show it red on; the same recipe goes red on partspec's and gerberdiff's. just check: clean. just test: 71 passed, 15 skipped (no PrusaSlicer here).
CameronBrooks11
added a commit
to heibench/netspec
that referenced
this pull request
Oct 31, 2026
Dependabot alerts missed vulnerable pins in this org (certifi in gerberdiff, msgpack in partspec), so an empty alert list is not evidence the lock is clean. `just audit` runs uv's `uv audit --frozen` over every package in uv.lock, extras included; audit.yml runs `just audit` daily, on dispatch, and on PRs touching the lock, pyproject, the justfile or the workflow. A scheduled or dispatched failure opens or comments on one `audit` issue. It stays out of `just check` and the required `ok` gate, where an upstream advisory would turn every unrelated PR red. Same shape as heibench/orlab#84. Measured locally: exit 0 on this lock (39 packages); no vulnerable lock in this repo's history to show it red on (the lock was first committed in #45); the same recipe goes red on partspec's and gerberdiff's. just lint, typecheck: clean. just test: 252 passed, 12 skipped (no KiCad here). `ruff format --check .` failed locally on unreadable device nodes under .claude/ in my checkout, not on repo files; over the tracked files it reports 50 already formatted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pilot for a lockfile audit in every repo with a committed
uv.lock. Once the shape is agreed here, I'll copy it to partspec, gerberdiff, slicelab, prusaslicer-py and netspec.Why: Dependabot alerts missed vulnerable pins in this org: certifi 2026.5.20 in gerberdiff and msgpack 1.2.1 in partspec (CVE-2026-114613) had no alert, and netspec's lock wasn't committed at all until heibench/netspec#45. An empty alert list isn't evidence that a lock is clean. An OSV query over the committed lock caught all three.
What
just audit:uv audit --frozen --preview-features audit-command. That's uv's own OSV audit over every package inuv.lock, extras included, with nothing new to install.--preview-featuresopts in to the experimental command..github/workflows/audit.yml: runsjust auditdaily, on dispatch, and on PRs touchinguv.lock,pyproject.toml, thejustfileor the workflow itself.file-issuejob (issues: write; the audit job iscontents: read) opens anauditissue, or comments on the one already open. It creates the label itself. PR runs only report on the PR.Not in
just checkor the requiredokgate, on purpose: advisories land while nothing in the repo changes (msgpack's did), and in the gate one would turn every unrelated PR red.Evidence (local)
Found no known vulnerabilities ... in 56 packages, exit 0.Found 61 known vulnerabilities ... in 64 packages, exit 1. (61 vs the 42 Dependabot alerts: OSV lists GHSA and PYSEC ids for the same advisories.)just check: clean.just test: 235 passed, 2 skipped (pandas not in the dev group).Not verified: the
file-issuepath, which only runs after a failed audit. This PR's ownauditrun exercises the audit job only. To test the issue path after merge, dispatch the workflow on a branch with a vulnerable lock.Risk:
uv auditis experimental. If uv changes its interface, the job fails, and the scheduled failure files an issue saying so.