Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Python support to audit workflow #451

Open
lopopolo opened this issue Apr 9, 2023 · 0 comments
Open

Add Python support to audit workflow #451

lopopolo opened this issue Apr 9, 2023 · 0 comments
Assignees
Labels
A-github-actions Area: GitHub Actions workflows and automation. A-security Area: Security vulnerabilities and unsoundness issues.

Comments

@lopopolo
Copy link
Member

lopopolo commented Apr 9, 2023

PyPA has an official GitHub Action for running pip audit: https://github.com/pypa/gh-action-pip-audit.

the nightly repo has a requirements.txt in it.

A new template to add Python to the language matrix for the audit workflow is required. Do a deploy of all impacted repos.

Deploy something like this diff to audit.yaml:

diff --git c/.github/workflows/audit.yaml w/.github/workflows/audit.yaml
index 4c2f2da..5c83a8f 100644
--- c/.github/workflows/audit.yaml
+++ w/.github/workflows/audit.yaml
@@ -23,3 +23,19 @@ jobs:

       - name: npm audit
         run: npm audit
+
+  python:
+    name: Audit Python Dependencies
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Ensure python environment
+        uses: actions/setup-python@v4
+
+      - uses: pypa/gh-action-pip-audit@v1.0.6
+        with:
+          inputs: requirements.txt
+          require-hashes: true
@lopopolo lopopolo added A-security Area: Security vulnerabilities and unsoundness issues. A-github-actions Area: GitHub Actions workflows and automation. labels Apr 9, 2023
@lopopolo lopopolo self-assigned this Apr 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-github-actions Area: GitHub Actions workflows and automation. A-security Area: Security vulnerabilities and unsoundness issues.
Development

No branches or pull requests

1 participant