MITLibraries / alma-patronload

100%

main: 100%

LAST BUILD ON BRANCH IN-1244-pip-audit

branch: IN-1244-pip-audit

CHANGE BRANCH

x

Reset

Sync Branches

• IN-1244-pip-audit
• ENSY-430-patronload-preferred-names-project-update-patron-load-app
• IN-1165-maintenance-2025-01
• IN-719-cli-setup
• IN-720-config-module
• IN-722-database-module
• IN-723-patron-module
• IN-723-staff-student-fields
• IN-724-cli-command
• IN-875-database-connection-test
• IN-875-test-connection
• add-email
• app-setup
• automation-updates
• create-diagram
• dependabot-update
• dependabot/docker/python-3.12-slim
• dependabot/pip/bandit-1.7.5
• dependabot/pip/black-24.3.0
• dependabot/pip/black-24.4.0
• dependabot/pip/black-24.4.2
• dependabot/pip/boto3-1.26.100
• dependabot/pip/boto3-1.26.101
• dependabot/pip/boto3-1.26.102
• dependabot/pip/boto3-1.26.103
• dependabot/pip/boto3-1.26.104
• dependabot/pip/boto3-1.26.105
• dependabot/pip/boto3-1.26.106
• dependabot/pip/boto3-1.26.164
• dependabot/pip/boto3-1.26.165
• dependabot/pip/boto3-1.26.96
• dependabot/pip/boto3-1.26.97
• dependabot/pip/boto3-1.26.98
• dependabot/pip/boto3-1.26.99
• dependabot/pip/boto3-1.28.1
• dependabot/pip/boto3-1.34.103
• dependabot/pip/boto3-1.34.108
• dependabot/pip/boto3-1.34.113
• dependabot/pip/boto3-1.34.117
• dependabot/pip/boto3-1.34.59
• dependabot/pip/boto3-1.34.64
• dependabot/pip/boto3-1.34.69
• dependabot/pip/boto3-1.34.74
• dependabot/pip/boto3-1.34.79
• dependabot/pip/boto3-1.34.84
• dependabot/pip/boto3-1.34.88
• dependabot/pip/boto3-1.34.93
• dependabot/pip/boto3-1.34.98
• dependabot/pip/boto3-stubs-1.26.100
• dependabot/pip/boto3-stubs-1.26.101
• dependabot/pip/boto3-stubs-1.26.102
• dependabot/pip/boto3-stubs-1.26.103.post1
• dependabot/pip/boto3-stubs-1.26.104
• dependabot/pip/boto3-stubs-1.26.105
• dependabot/pip/boto3-stubs-1.26.106
• dependabot/pip/boto3-stubs-1.26.164
• dependabot/pip/boto3-stubs-1.26.165
• dependabot/pip/boto3-stubs-1.26.96
• dependabot/pip/boto3-stubs-1.26.97.post1
• dependabot/pip/boto3-stubs-1.26.98
• dependabot/pip/boto3-stubs-1.26.99
• dependabot/pip/boto3-stubs-1.28.1
• dependabot/pip/boto3-stubs-1.34.103
• dependabot/pip/boto3-stubs-1.34.108
• dependabot/pip/boto3-stubs-1.34.113
• dependabot/pip/boto3-stubs-1.34.117
• dependabot/pip/boto3-stubs-1.34.59
• dependabot/pip/boto3-stubs-1.34.64
• dependabot/pip/boto3-stubs-1.34.69
• dependabot/pip/boto3-stubs-1.34.74
• dependabot/pip/boto3-stubs-1.34.79
• dependabot/pip/boto3-stubs-1.34.84
• dependabot/pip/boto3-stubs-1.34.88
• dependabot/pip/boto3-stubs-1.34.93
• dependabot/pip/boto3-stubs-1.34.98
• dependabot/pip/cryptography-41.0.2
• dependabot/pip/idna-3.7
• dependabot/pip/jinja2-3.1.4
• dependabot/pip/moto-4.1.5
• dependabot/pip/moto-4.1.6
• dependabot/pip/mypy-1.0.1
• dependabot/pip/mypy-1.1.1
• dependabot/pip/pytest-7.2.2
• dependabot/pip/pytest-8.1.1
• dependabot/pip/pytest-8.2.0
• dependabot/pip/pytest-8.2.1
• dependabot/pip/requests-2.32.0
• dependabot/pip/ruff-0.3.2
• dependabot/pip/ruff-0.3.3
• dependabot/pip/ruff-0.3.4
• dependabot/pip/ruff-0.3.5
• dependabot/pip/ruff-0.3.7
• dependabot/pip/ruff-0.4.1
• dependabot/pip/ruff-0.4.2
• dependabot/pip/ruff-0.4.3
• dependabot/pip/ruff-0.4.4
• dependabot/pip/ruff-0.4.5
• dependabot/pip/ruff-0.4.7
• dependabot/pip/sentry-sdk-1.16.0
• dependabot/pip/sentry-sdk-1.17.0
• dependabot/pip/sentry-sdk-1.41.0
• dependabot/pip/sentry-sdk-1.42.0
• dependabot/pip/sentry-sdk-1.43.0
• dependabot/pip/sentry-sdk-1.44.0
• dependabot/pip/sentry-sdk-1.44.1
• dependabot/pip/sentry-sdk-1.45.0
• dependabot/pip/sentry-sdk-2.0.1
• dependabot/pip/sentry-sdk-2.1.0
• dependabot/pip/sentry-sdk-2.1.1
• dependabot/pip/sentry-sdk-2.2.0
• dependabot/pip/sentry-sdk-2.3.1
• dependabot/pip/types-beautifulsoup4-4.12.0.0
• dependabot/pip/types-beautifulsoup4-4.12.0.1
• dependabot/pip/types-python-dateutil-2.8.19.11
• dependabot/pip/types-python-dateutil-2.8.19.12
• dependabot/pip/werkzeug-3.0.3
• main
• maintenance-week-updates
• mit-id
• refs/tags/v1.0.0
• refs/tags/v1.0.1
• refs/tags/v1.0.2
• v1.1.0
• v1.2.0

Build # 14845563684

Build Type

push

github

Committed by ehanson8

Commit Message

Replace pipenv check with pip-audit

Why these changes are being introduced:

As of pipenv 2025.0.1 the use of `pipenv check` would throw
an error, indicating that the library `safety` was not installed.
It worked to run `pipenv check --auto-install` which would
temporarily install `safety`, but this was not ideal for multiple
reasons.

First, we anticipate potentially moving away from `pipenv`.

Second, it appears that `safety` is moving to a pay / subscription
model.

Third, it remains a little obfuscated what `pipenv check` is actually
doing.

As this new situation affects all builds in Github Actions CI,
we need a way to scan for vulnerabilities that ideally is not
a massive overhaul of our vulnerability scanning approach.

How this addresses that need:

`pip-audit` is a nice standalone, open-source library that
performs very similar work to `safety`.

This commit replaces `pipenv check` (which was `safety` under
the hood) with `pip-audit`.

Side effects of this change:
* Builds will be successful in Github Actions

Relevant ticket(s):
* https://mitlibraries.atlassian.net/browse/IN-1244

Run Details

1 of 1 new or added line in 1 file covered. (100.0%)

230 of 230 relevant lines covered (100.0%)

1.0 hits per line