Repository navigation
ci: maintain and audit dependency security weekly - #855
xianshijing-lk wants to merge 9 commits into
Conversation
…endencies # Conflicts: # uv.lock
…-security-automation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
| uvx --from pip-audit==2.10.1 pip-audit --disable-pip --no-deps -r "$RUNNER_TEMP/dependencies.txt" --format json --output "$RUNNER_TEMP/python-audit.json" | ||
| uvx --from pip-audit==2.10.1 pip-audit --disable-pip --no-deps -r "$RUNNER_TEMP/example.txt" --format json --output "$RUNNER_TEMP/example-audit.json" |
There was a problem hiding this comment.
🟡 Example audit skipped after workspace findings
When the workspace scan finds an advisory, pip-audit exits nonzero and the step stops before scanning the example. The example receives no audit report for that run.
Learn more
GitHub runs the shell block with fail-fast behavior. pip-audit returns a nonzero status when it finds vulnerabilities, even if it writes the JSON report. Because the example audit follows the workspace audit in the same step, a workspace finding prevents the example audit and its artifact from being produced. The upload step still runs, but it can only upload reports that exist.
Example: A workspace dependency has one advisory and the local-video example has another. The workspace scan writes python-audit.json and exits 1; the example scan never writes example-audit.json, leaving its advisory unreported.
Recommended fix: Run both pip-audit commands independently, capture each exit status, then fail the job if either status is nonzero. Keep artifact upload under if: always() so both JSON reports remain available.
Was this helpful? React with 👍 or 👎 to provide feedback.
This branch has not been deployed
1 participant
Transitive dependencies in uv.lock and the notebook lockfile need recurring maintenance and security checks. Enable Renovate's weekly lockfile maintenance, migrate config:base to config:recommended, and prevent automatic Python runtime-version upgrades from removing supported-version coverage.
Add weekly, PR, main-push, and manual dependency audits for the workspace and local-video example on Linux/Python 3.10, 3.12, and 3.14. Preserve full JSON reports as artifacts. Audit notebook dependencies as well; block all findings except the exact, still-unpatched braces GHSA-vfj7-8cjw-p6xm, which emits a warning and remains in the artifact. If a patched braces version becomes available, that exception no longer applies and the job fails until it is updated.
Python 3.9 is intentionally retained by the SDK. Its aiohttp/multidict security fixes require Python 3.10+, so explicitly report those residual findings in a separate, nonblocking audit step instead of declaring the legacy environment fixed. The compatibility matrix added by the runtime PR continues to exercise Python 3.9.
Validation: official Renovate configuration validator passes; workflow YAML parses; Ruff passes for the audit helpers; actual before/after npm audit reports prove that actionable findings fail and the single known unpatched advisory is visible; malformed/error audit responses fail. Requirement selection tested for Python 3.9/3.10/3.12/3.14. Workspace and example modern dependency scans report no known vulnerabilities.
Land after the tooling, runtime, and notebook dependency fixes. This stacked branch includes the notebook fix commit so the new audit jobs can pass before main has all prerequisite PRs. No additional SDK release is needed for the workflow/configuration changes.