gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ci): add pip-audit dependency vulnerability scanning to CI/CD

Browse Source 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-21 21:17:15 +00:00
parent a2658cb018
commit ac51f7206a
6 changed files with 66 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY_AUDIT.md
+3 -3
View File
@@ -246,7 +246,7 @@ ftp = ftplib.FTP() # nosec B321 - Plaintext FTP intentional when configured
### Dependency Management
- ✅ Version pinning for security-critical packages (authlib, starlette)
- ✅ Advisory database checks integrated into development workflow
- ⏳ TODO: Add automated dependency vulnerability scanning in CI/CD ([#171](https://github.com/christianlouis/DocuElevate/issues/171))
- ✅ Automated dependency vulnerability scanning in CI/CD via pip-audit ([#171](https://github.com/christianlouis/DocuElevate/issues/171))
### Authentication & Secrets
- ✅ Strong validation for SESSION_SECRET (minimum 32 characters)
@@ -265,8 +265,8 @@ ftp = ftplib.FTP() # nosec B321 - Plaintext FTP intentional when configured
- ✅ **COMPLETED:** Bandit (Python security linter) audit completed
- ✅ **COMPLETED:** Bandit integrated into CI pipeline (fails on high/medium severity issues)
- ✅ **COMPLETED:** CodeQL security scanning enabled in GitHub Actions
- ⏳ **TODO:** Add dependency vulnerability scanning (Safety, pip-audit) to CI ([#171](https://github.com/christianlouis/DocuElevate/issues/171))
- ⏳ **TODO:** Make dependency scans blocking (fail on critical issues) ([#171](https://github.com/christianlouis/DocuElevate/issues/171))
- ✅ **COMPLETED:** pip-audit dependency vulnerability scanning added to CI ([#171](https://github.com/christianlouis/DocuElevate/issues/171))
- ✅ **COMPLETED:** Dependency scans are blocking (fail build when vulnerabilities detected) ([#171](https://github.com/christianlouis/DocuElevate/issues/171))
### Code Security
- ✅ Authentication required on all sensitive endpoints (@require_login decorator)