MITLibraries / alma-sapinvoices-ui

87%

main: 87%

LAST BUILD ON BRANCH IN-1240-pip-audit

branch: IN-1240-pip-audit

CHANGE BRANCH

x

Reset

Sync Branches

• IN-1240-pip-audit
• IN-1033-auth-flask-login
• IN-1034-log-activity
• IN-1052-add-guardrails-final-runs
• IN-1053-update-text-descriptions
• IN-1054-update-command-args
• create-cloudwatch-client
• create-ecs-client
• dependabot/pip/black-24.8.0
• dependabot/pip/boto3-1.34.141
• dependabot/pip/boto3-1.34.142
• dependabot/pip/boto3-1.34.143
• dependabot/pip/boto3-1.34.144
• dependabot/pip/boto3-1.34.145
• dependabot/pip/boto3-1.34.146
• dependabot/pip/boto3-1.34.147
• dependabot/pip/boto3-1.34.148
• dependabot/pip/boto3-1.34.149
• dependabot/pip/boto3-1.34.150
• dependabot/pip/boto3-1.34.151
• dependabot/pip/boto3-1.34.152
• dependabot/pip/boto3-1.34.153
• dependabot/pip/boto3-1.34.154
• dependabot/pip/boto3-1.34.155
• dependabot/pip/boto3-1.34.156
• dependabot/pip/boto3-1.34.157
• dependabot/pip/boto3-1.34.158
• dependabot/pip/boto3-1.34.159
• dependabot/pip/boto3-1.34.160
• dependabot/pip/boto3-1.34.161
• dependabot/pip/boto3-1.34.162
• dependabot/pip/boto3-1.35.0
• dependabot/pip/boto3-1.35.1
• dependabot/pip/boto3-1.35.10
• dependabot/pip/boto3-1.35.11
• dependabot/pip/boto3-1.35.12
• dependabot/pip/boto3-1.35.13
• dependabot/pip/boto3-1.35.14
• dependabot/pip/boto3-1.35.15
• dependabot/pip/boto3-1.35.16
• dependabot/pip/boto3-1.35.17
• dependabot/pip/boto3-1.35.18
• dependabot/pip/boto3-1.35.19
• dependabot/pip/boto3-1.35.2
• dependabot/pip/boto3-1.35.20
• dependabot/pip/boto3-1.35.21
• dependabot/pip/boto3-1.35.22
• dependabot/pip/boto3-1.35.23
• dependabot/pip/boto3-1.35.24
• dependabot/pip/boto3-1.35.25
• dependabot/pip/boto3-1.35.26
• dependabot/pip/boto3-1.35.27
• dependabot/pip/boto3-1.35.28
• dependabot/pip/boto3-1.35.29
• dependabot/pip/boto3-1.35.3
• dependabot/pip/boto3-1.35.30
• dependabot/pip/boto3-1.35.31
• dependabot/pip/boto3-1.35.32
• dependabot/pip/boto3-1.35.33
• dependabot/pip/boto3-1.35.4
• dependabot/pip/boto3-1.35.5
• dependabot/pip/boto3-1.35.6
• dependabot/pip/boto3-1.35.7
• dependabot/pip/boto3-1.35.8
• dependabot/pip/boto3-1.35.9
• dependabot/pip/boto3-stubs-1.34.152
• dependabot/pip/boto3-stubs-1.34.153
• dependabot/pip/boto3-stubs-1.34.154
• dependabot/pip/boto3-stubs-1.34.155
• dependabot/pip/boto3-stubs-1.34.156
• dependabot/pip/boto3-stubs-1.34.157
• dependabot/pip/boto3-stubs-1.34.158
• dependabot/pip/boto3-stubs-1.34.159
• dependabot/pip/boto3-stubs-1.34.160
• dependabot/pip/boto3-stubs-1.34.161
• dependabot/pip/boto3-stubs-1.34.162
• dependabot/pip/boto3-stubs-1.35.0
• dependabot/pip/boto3-stubs-1.35.1
• dependabot/pip/boto3-stubs-1.35.10
• dependabot/pip/boto3-stubs-1.35.11
• dependabot/pip/boto3-stubs-1.35.12
• dependabot/pip/boto3-stubs-1.35.13.post1
• dependabot/pip/boto3-stubs-1.35.14
• dependabot/pip/boto3-stubs-1.35.15
• dependabot/pip/boto3-stubs-1.35.16
• dependabot/pip/boto3-stubs-1.35.17
• dependabot/pip/boto3-stubs-1.35.18
• dependabot/pip/boto3-stubs-1.35.19
• dependabot/pip/boto3-stubs-1.35.2
• dependabot/pip/boto3-stubs-1.35.20
• dependabot/pip/boto3-stubs-1.35.21
• dependabot/pip/boto3-stubs-1.35.22
• dependabot/pip/boto3-stubs-1.35.23
• dependabot/pip/boto3-stubs-1.35.24
• dependabot/pip/boto3-stubs-1.35.25
• dependabot/pip/boto3-stubs-1.35.26
• dependabot/pip/boto3-stubs-1.35.27
• dependabot/pip/boto3-stubs-1.35.28
• dependabot/pip/boto3-stubs-1.35.29
• dependabot/pip/boto3-stubs-1.35.3
• dependabot/pip/boto3-stubs-1.35.30
• dependabot/pip/boto3-stubs-1.35.31
• dependabot/pip/boto3-stubs-1.35.32
• dependabot/pip/boto3-stubs-1.35.33
• dependabot/pip/boto3-stubs-1.35.4
• dependabot/pip/boto3-stubs-1.35.5
• dependabot/pip/boto3-stubs-1.35.6
• dependabot/pip/boto3-stubs-1.35.7
• dependabot/pip/boto3-stubs-1.35.8
• dependabot/pip/boto3-stubs-1.35.9
• dependabot/pip/certifi-2024.7.4
• dependabot/pip/cryptography-43.0.1
• dependabot/pip/moto-5.0.11
• dependabot/pip/mypy-1.10.1
• dependabot/pip/mypy-1.11.1
• dependabot/pip/mypy-1.11.2
• dependabot/pip/ruff-0.5.1
• dependabot/pip/ruff-0.5.2
• dependabot/pip/ruff-0.5.3
• dependabot/pip/ruff-0.5.4
• dependabot/pip/ruff-0.5.5
• dependabot/pip/ruff-0.6.2
• dependabot/pip/ruff-0.6.3
• dependabot/pip/ruff-0.6.4
• dependabot/pip/ruff-0.6.5
• dependabot/pip/ruff-0.6.6
• dependabot/pip/ruff-0.6.7
• dependabot/pip/ruff-0.6.8
• dependabot/pip/sentry-sdk-2.10.0
• dependabot/pip/sentry-sdk-2.11.0
• dependabot/pip/sentry-sdk-2.12.0
• dependabot/pip/sentry-sdk-2.13.0
• dependabot/pip/sentry-sdk-2.8.0
• dependabot/pip/sentry-sdk-2.9.0
• dependabot/pip/types-requests-2.32.0.20240905
• dependabot/pip/types-requests-2.32.0.20240907
• dependabot/pip/types-requests-2.32.0.20240914
• final-workflows
• fix-security-vulnerabilities
• improve-display-run-details
• init-app
• main
• renovate/configure
• renovate/lock-file-maintenance
• renovate/reconfigure
• terraform-updates
• ui-dev
• update-ecs-client
• v0.1.0
• v1.0.0
• v1.0.1

Build # 14860441993

Build Type

Pull #143

github

Committed by ghukill

Commit Message

Replace pipenv check with pip-audit

Why these changes are being introduced:

As of pipenv 2025.0.1 the use of `pipenv check` would throw
an error, indicating that the library `safety` was not installed.
It worked to run `pipenv check --auto-install` which would
temporarily install `safety`, but this was not ideal for multiple
reasons.

First, we anticipate potentially moving away from `pipenv`.

Second, it appears that `safety` is moving to a pay / subscription
model.

Third, it remains a little obfuscated what `pipenv check` is actually
doing.

As this new situation affects all builds in Github Actions CI,
we need a way to scan for vulnerabilities that ideally is not
a massive overhaul of our vulnerability scanning approach.

How this addresses that need:

`pip-audit` is a nice standalone, open-source library that
performs very similar work to `safety`.

This commit replaces `pipenv check` (which was `safety` under
the hood) with `pip-audit`.

Side effects of this change:
* Builds will be successful in Github Actions

Relevant ticket(s):
* https://mitlibraries.atlassian.net/browse/IN-1240

Pull Request Pull Request #143: IN-1240 - Replace pipenv check with pip-audit

Run Details

304 of 351 relevant lines covered (86.61%)

0.87 hits per line