j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 19:26:48 +00:00
Code Issues Projects Releases Wiki Activity

ci: the audit checks the packages installations get, not the CI tools

Browse source 
pip-audit audited the whole CI environment, so on Python 3.10 it failed
on filelock 4.1.0, a dependency of pip-audit itself: six CVEs published
on 2026-10-23 are fixed only in filelock 4.2.1, which needs Python 3.11.
No installation gets filelock. The step now audits conf/requirements.txt
and conf/requirements-ldap.txt, resolved for the leg's Python, which is
what the audit is for.
This commit is contained in:
catborise 2026-10-24 09:43:23 +03:00
parent 999480301e
commit 9f6ce7dc63
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.github/workflows/test.yml vendored
View file

@ -120,8 +120,10 @@ jobs:
- name: Deployment Checks
run: python manage.py check --deploy --fail-level ERROR
- name: Audit Installed Packages
run: pip-audit
# What installations get, resolved for this Python; not the CI tools
# (their fixes can need a newer Python than the leg's, as filelock's did)
- name: Audit Shipped Packages
run: pip-audit -r conf/requirements.txt -r conf/requirements-ldap.txt
docker:
name: Docker Image