gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ci): add pip-audit dependency vulnerability scanning to CI/CD

Browse Source 
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-21 21:17:15 +00:00
parent a2658cb018
commit ac51f7206a
6 changed files with 66 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/CIToolsGuide.md
+2 -1
View File
@@ -217,7 +217,7 @@ DeepSource provided:
**Analysis:**
- Would duplicate CodeQL for security scanning
- Would duplicate Dependabot for dependency vulnerabilities
- Would duplicate Dependabot + pip-audit for dependency vulnerabilities
- Current tools provide adequate coverage
- Not needed at this time
@@ -231,6 +231,7 @@ DeepSource provided:
| Security Linting | Bandit | Ruff | ✅ Consolidated |
| Code Quality | Pylint, DeepSource | Ruff | ✅ Consolidated |
| Security Scanning | CodeQL, DeepSource | CodeQL | ✅ De-duplicated |
| Dependency Vulnerabilities | None | pip-audit | ✅ Added |
| Type Checking | Mypy | Mypy | ✅ Kept (unique) |
| Testing | pytest | pytest | ✅ Kept (unique) |
| Coverage | Codecov | Codecov | ✅ Kept (unique) |
docs/CIWorkflow.md
+3 -2
View File
@@ -10,11 +10,12 @@ The CI workflow (`.github/workflows/tests.yaml`) runs automatically on every pus
| Job | Tool | Purpose | Enforced |
|--------|--------|---------------------------------------------|----------|
| `test` | pytest | Unit/integration tests with coverage | ✅ |
| `lint` | Ruff | Fast Python linter (replaces Flake8, Black, isort, Bandit) | ✅ |
| `dependency-scan` | pip-audit | Dependency vulnerability scanning against OSV/PyPA advisories | ✅ |
| `test` | pytest | Unit/integration tests with coverage | ✅ |
| `mypy` | mypy | Static type checking | ✅ |
All three jobs start **in parallel** as soon as the workflow is triggered. No job depends on or waits for any other job.
`lint` and `dependency-scan` start **in parallel** at the beginning of the pipeline — neither depends on the other. `test` and `mypy` run only after both have passed.
> **Note:** DocuElevate uses Ruff, a modern all-in-one Python linter that consolidates the functionality of Flake8, Black, isort, and Bandit. This streamlined approach reduces CI complexity while maintaining code quality and security standards.