forked from strands-agents/harness-sdk
-
Notifications
You must be signed in to change notification settings - Fork 0
51 lines (45 loc) · 1.54 KB
/
Copy pathpython-security-audit.yml
File metadata and controls
51 lines (45 loc) · 1.54 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
name: "Python: Security Audit"
on:
workflow_call:
inputs:
ref:
required: true
type: string
jobs:
security-audit:
name: pip-audit
permissions:
contents: read
runs-on: ubuntu-latest
defaults:
run:
working-directory: strands-py
steps:
- name: Checkout code
uses: actions/checkout@v7
with:
ref: ${{ inputs.ref }}
persist-credentials: false
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: '3.10'
cache: 'pip'
- name: Install pip-audit
run: pip install --no-cache-dir pip-audit
# Mirror of typescript-security-audit.yml: informational, does not block
# the release. PR-introduced vulns are gated by the repo-level Dependency
# Review job in ci.yml; pre-existing advisories are driven down via
# Dependabot. The release reviewer can read the report below before
# approving.
- name: Audit installed dependency closure (informational)
continue-on-error: true
run: |
set -euo pipefail
# Resolve the package's full dependency closure into a temporary
# venv, then audit it. Auditing the project metadata directly skips
# transitive deps; this mirrors what an end user actually installs.
python -m venv /tmp/audit-env
/tmp/audit-env/bin/pip install --upgrade pip
/tmp/audit-env/bin/pip install .
pip-audit --path /tmp/audit-env/lib/python*/site-packages