ci: add dependency audit workflow#3138
Open
PascalThuet wants to merge 2 commits into
Open
Conversation
Add a Security Audit workflow with a dependency-audit job. Push/PR/manual runs pip-audit against a committed --generate-hashes requirements snapshot (.github/security-audit-requirements.txt) for deterministic CI, while the weekly scheduled run resolves the runtime + test dependency set live across the supported Python/OS matrix to surface newly published advisories. A sync gate (.github/scripts/check_security_requirements.py) fails PRs whose dependency inputs changed without refreshing the committed snapshot, so the committed file can't silently drift from pyproject.toml.
Assisted-by: Codex (model: GPT-5, autonomous)
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a dedicated GitHub Actions “Security Audit” workflow to run deterministic pip-audit checks on PRs/push/manual runs (using a committed, hashed requirements snapshot) and a scheduled job that resolves/audits dependencies live across the supported OS/Python matrix. It also introduces a sync-gate script and corresponding tests/docs to keep the committed snapshot aligned with pyproject.toml.
Changes:
- Added
.github/workflows/security.ymlwith split triggers: deterministic audit for PR/push/manual + scheduled live-resolution audit matrix. - Added
.github/scripts/check_security_requirements.pyand a committed hashed requirements snapshot to gate PRs when dependency inputs change without regenerating the snapshot. - Added tests + CONTRIBUTING docs to enforce and document the workflow, pins, and local commands.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/security.yml |
New Security Audit workflow with deterministic and scheduled dependency-audit jobs. |
.github/scripts/check_security_requirements.py |
Sync-gate script to detect dependency input changes and verify the committed snapshot is current. |
.github/security-audit-requirements.txt |
Committed hashed requirements snapshot used for deterministic audits. |
tests/test_security_workflow.py |
Static tests guarding workflow triggers, pins, matrix, and sync-gate behavior. |
CONTRIBUTING.md |
Documentation for local security audit and snapshot refresh commands. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 5/5 changed files
- Comments generated: 2
Comment on lines
+21
to
+25
| - name: Checkout | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| fetch-depth: 2 | ||
|
|
Comment on lines
+66
to
+71
| def main() -> int: | ||
| if not _dependency_inputs_changed(): | ||
| return 0 | ||
|
|
||
| generated_requirements = Path(os.environ["GENERATED_REQUIREMENTS"]) | ||
| generated_requirements.parent.mkdir(parents=True, exist_ok=True) |
mnriem
requested changes
Jun 24, 2026
mnriem
left a comment
mnriem
left a comment
Collaborator
There was a problem hiding this comment.
Please address Copilot feedback
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of splitting #2442 into smaller, dedicated PRs. This is the original #2438 ask — the dependency-audit workflow — re-derived against current
main.What
.github/workflows/security.ymlwith dependency-audit coverage split by trigger:dependency-auditjob audits the committed.github/security-audit-requirements.txtsnapshot withpip-audit --require-hashes.dependency-audit-scheduledcompiles the runtime +testdependency set live per(os, python)matrix entry (ubuntu/windows× 3.11/3.12/3.13) and audits that, to catch newly published advisories the committed snapshot wouldn't..github/scripts/check_security_requirements.py: a sync gate that fails a PR which changedpyproject.toml(or the snapshot) without regenerating the committed requirements..github/security-audit-requirements.txt: the committed--universal --generate-hashessnapshot (generated against currentmain).tests/test_security_workflow.py: static guards for the jobs, matrix, pins, hashed snapshot, and the sync script. Triggers are asserted by inclusion so the follow-up baseline-gate PR can addlabeled/unlabeledwithout rewriting the test.CONTRIBUTING.md: a "Security checks" subsection documenting the local commands.Why
Gives CI a deterministic dependency-advisory signal on every PR plus a live scheduled sweep, without a lockfile or redundant PR matrix runs.
Validation
tests/test_security_workflow.py— 12 passed.uvx ruff check .github/scripts/check_security_requirements.py tests/test_security_workflow.pyis clean.pip-audit --require-hashesagainst the committed snapshot reports no known vulnerabilities.uv pip compile ... --no-headeris byte-identical to the committed snapshot (sync gate passes).actions/checkoutaligned to the repo-standard9c091bb... # v7.0.0).Bandit + secret-scan gates are deliberately not here — they come in a follow-up PR so each gate reviews on its own. Independent of the other split PRs.
Disclosure: Updated on behalf of @PascalThuet by Codex (model: GPT-5, autonomous).