MITLibraries / alma-sapinvoices

100%

main: 100%

LAST BUILD ON BRANCH IN-1257-pip-audit

branch: IN-1257-pip-audit

CHANGE BRANCH

x

Reset

Sync Branches

• IN-1257-pip-audit
• IN-731-add-alma-functionality
• IN-731-add-sap
• app-setup
• automation-updates
• check-multiple-vendor-types
• cli-setup
• create_sandbox_data
• dependabot/pip/bandit-1.7.5
• dependabot/pip/boto3-1.26.100
• dependabot/pip/boto3-1.26.101
• dependabot/pip/boto3-1.26.102
• dependabot/pip/boto3-1.26.103
• dependabot/pip/boto3-1.26.104
• dependabot/pip/boto3-1.26.105
• dependabot/pip/boto3-1.26.106
• dependabot/pip/boto3-1.26.107
• dependabot/pip/boto3-1.26.108
• dependabot/pip/boto3-1.26.109
• dependabot/pip/boto3-1.26.110
• dependabot/pip/boto3-1.26.111
• dependabot/pip/boto3-1.26.112
• dependabot/pip/boto3-1.26.113
• dependabot/pip/boto3-1.26.114
• dependabot/pip/boto3-1.26.115
• dependabot/pip/boto3-1.26.116
• dependabot/pip/boto3-1.26.117
• dependabot/pip/boto3-1.26.118
• dependabot/pip/boto3-1.26.119
• dependabot/pip/boto3-1.26.120
• dependabot/pip/boto3-1.26.121
• dependabot/pip/boto3-1.26.122
• dependabot/pip/boto3-1.26.91
• dependabot/pip/boto3-1.26.92
• dependabot/pip/boto3-1.26.93
• dependabot/pip/boto3-1.26.94
• dependabot/pip/boto3-1.26.95
• dependabot/pip/boto3-1.26.96
• dependabot/pip/boto3-1.26.97
• dependabot/pip/boto3-1.26.98
• dependabot/pip/boto3-1.26.99
• dependabot/pip/boto3-1.28.10
• dependabot/pip/boto3-1.28.11
• dependabot/pip/boto3-1.28.12
• dependabot/pip/boto3-1.28.13
• dependabot/pip/boto3-1.28.15
• dependabot/pip/boto3-1.28.16
• dependabot/pip/boto3-1.28.17
• dependabot/pip/boto3-1.28.18
• dependabot/pip/boto3-1.28.19
• dependabot/pip/boto3-1.28.20
• dependabot/pip/boto3-1.28.21
• dependabot/pip/boto3-1.28.22
• dependabot/pip/boto3-1.28.23
• dependabot/pip/boto3-1.28.24
• dependabot/pip/boto3-1.28.25
• dependabot/pip/boto3-1.28.26
• dependabot/pip/boto3-1.28.27
• dependabot/pip/boto3-1.28.28
• dependabot/pip/boto3-1.28.29
• dependabot/pip/boto3-1.28.30
• dependabot/pip/boto3-1.28.31
• dependabot/pip/boto3-1.28.32
• dependabot/pip/boto3-1.28.33
• dependabot/pip/boto3-1.28.34
• dependabot/pip/boto3-1.28.35
• dependabot/pip/boto3-1.28.36
• dependabot/pip/boto3-1.28.37
• dependabot/pip/boto3-1.28.38
• dependabot/pip/boto3-1.28.39
• dependabot/pip/boto3-1.28.4
• dependabot/pip/boto3-1.28.40
• dependabot/pip/boto3-1.28.41
• dependabot/pip/boto3-1.28.42
• dependabot/pip/boto3-1.28.43
• dependabot/pip/boto3-1.28.44
• dependabot/pip/boto3-1.28.45
• dependabot/pip/boto3-1.28.46
• dependabot/pip/boto3-1.28.47
• dependabot/pip/boto3-1.28.48
• dependabot/pip/boto3-1.28.49
• dependabot/pip/boto3-1.28.5
• dependabot/pip/boto3-1.28.50
• dependabot/pip/boto3-1.28.51
• dependabot/pip/boto3-1.28.52
• dependabot/pip/boto3-1.28.53
• dependabot/pip/boto3-1.28.54
• dependabot/pip/boto3-1.28.55
• dependabot/pip/boto3-1.28.56
• dependabot/pip/boto3-1.28.57
• dependabot/pip/boto3-1.28.58
• dependabot/pip/boto3-1.28.59
• dependabot/pip/boto3-1.28.6
• dependabot/pip/boto3-1.28.60
• dependabot/pip/boto3-1.28.61
• dependabot/pip/boto3-1.28.62
• dependabot/pip/boto3-1.28.63
• dependabot/pip/boto3-1.28.8
• dependabot/pip/boto3-1.28.9
• dependabot/pip/boto3-stubs-1.26.100
• dependabot/pip/boto3-stubs-1.26.101
• dependabot/pip/boto3-stubs-1.26.102
• dependabot/pip/boto3-stubs-1.26.103.post1
• dependabot/pip/boto3-stubs-1.26.104
• dependabot/pip/boto3-stubs-1.26.105
• dependabot/pip/boto3-stubs-1.26.106
• dependabot/pip/boto3-stubs-1.26.107
• dependabot/pip/boto3-stubs-1.26.108
• dependabot/pip/boto3-stubs-1.26.109
• dependabot/pip/boto3-stubs-1.26.110
• dependabot/pip/boto3-stubs-1.26.111
• dependabot/pip/boto3-stubs-1.26.112
• dependabot/pip/boto3-stubs-1.26.113
• dependabot/pip/boto3-stubs-1.26.114
• dependabot/pip/boto3-stubs-1.26.115
• dependabot/pip/boto3-stubs-1.26.116
• dependabot/pip/boto3-stubs-1.26.117
• dependabot/pip/boto3-stubs-1.26.118
• dependabot/pip/boto3-stubs-1.26.119
• dependabot/pip/boto3-stubs-1.26.120
• dependabot/pip/boto3-stubs-1.26.121
• dependabot/pip/boto3-stubs-1.26.122
• dependabot/pip/boto3-stubs-1.26.91
• dependabot/pip/boto3-stubs-1.26.92
• dependabot/pip/boto3-stubs-1.26.93
• dependabot/pip/boto3-stubs-1.26.94
• dependabot/pip/boto3-stubs-1.26.95
• dependabot/pip/boto3-stubs-1.26.96
• dependabot/pip/boto3-stubs-1.26.97.post1
• dependabot/pip/boto3-stubs-1.26.98
• dependabot/pip/boto3-stubs-1.26.99
• dependabot/pip/boto3-stubs-1.28.11
• dependabot/pip/boto3-stubs-1.28.13
• dependabot/pip/boto3-stubs-1.28.15.post1
• dependabot/pip/boto3-stubs-1.28.16
• dependabot/pip/boto3-stubs-1.28.17
• dependabot/pip/boto3-stubs-1.28.18
• dependabot/pip/boto3-stubs-1.28.19
• dependabot/pip/boto3-stubs-1.28.20
• dependabot/pip/boto3-stubs-1.28.21
• dependabot/pip/boto3-stubs-1.28.22
• dependabot/pip/boto3-stubs-1.28.23
• dependabot/pip/boto3-stubs-1.28.24
• dependabot/pip/boto3-stubs-1.28.25
• dependabot/pip/boto3-stubs-1.28.26
• dependabot/pip/boto3-stubs-1.28.28
• dependabot/pip/boto3-stubs-1.28.29
• dependabot/pip/boto3-stubs-1.28.3.post2
• dependabot/pip/boto3-stubs-1.28.30
• dependabot/pip/boto3-stubs-1.28.31
• dependabot/pip/boto3-stubs-1.28.32
• dependabot/pip/boto3-stubs-1.28.33
• dependabot/pip/boto3-stubs-1.28.34
• dependabot/pip/boto3-stubs-1.28.35
• dependabot/pip/boto3-stubs-1.28.36
• dependabot/pip/boto3-stubs-1.28.37
• dependabot/pip/boto3-stubs-1.28.38
• dependabot/pip/boto3-stubs-1.28.39
• dependabot/pip/boto3-stubs-1.28.4
• dependabot/pip/boto3-stubs-1.28.40
• dependabot/pip/boto3-stubs-1.28.41
• dependabot/pip/boto3-stubs-1.28.42
• dependabot/pip/boto3-stubs-1.28.43
• dependabot/pip/boto3-stubs-1.28.44
• dependabot/pip/boto3-stubs-1.28.45
• dependabot/pip/boto3-stubs-1.28.46
• dependabot/pip/boto3-stubs-1.28.47
• dependabot/pip/boto3-stubs-1.28.48
• dependabot/pip/boto3-stubs-1.28.49
• dependabot/pip/boto3-stubs-1.28.5
• dependabot/pip/boto3-stubs-1.28.50
• dependabot/pip/boto3-stubs-1.28.51
• dependabot/pip/boto3-stubs-1.28.52
• dependabot/pip/boto3-stubs-1.28.53
• dependabot/pip/boto3-stubs-1.28.54
• dependabot/pip/boto3-stubs-1.28.55
• dependabot/pip/boto3-stubs-1.28.56
• dependabot/pip/boto3-stubs-1.28.57
• dependabot/pip/boto3-stubs-1.28.59
• dependabot/pip/boto3-stubs-1.28.60
• dependabot/pip/boto3-stubs-1.28.61
• dependabot/pip/boto3-stubs-1.28.62
• dependabot/pip/boto3-stubs-1.28.63
• dependabot/pip/boto3-stubs-1.28.8
• dependabot/pip/boto3-stubs-1.28.9
• dependabot/pip/certifi-2023.7.22
• dependabot/pip/click-8.1.5
• dependabot/pip/click-8.1.6
• dependabot/pip/click-8.1.7
• dependabot/pip/cryptography-41.0.3
• dependabot/pip/cryptography-41.0.4
• dependabot/pip/gitpython-3.1.34
• dependabot/pip/gitpython-3.1.37
• dependabot/pip/moto-4.1.13
• dependabot/pip/moto-4.1.14
• dependabot/pip/moto-4.1.6
• dependabot/pip/moto-4.1.7
• dependabot/pip/moto-4.1.8
• dependabot/pip/moto-4.2.0
• dependabot/pip/moto-4.2.2
• dependabot/pip/moto-4.2.3
• dependabot/pip/moto-4.2.4
• dependabot/pip/moto-4.2.5
• dependabot/pip/mypy-1.0.1
• dependabot/pip/mypy-1.1.1
• dependabot/pip/paramiko-3.1.0
• dependabot/pip/pytest-7.2.2
• dependabot/pip/sentry-sdk-1.16.0
• dependabot/pip/sentry-sdk-1.17.0
• dependabot/pip/types-paramiko-3.0.0.5
• dependabot/pip/types-paramiko-3.0.0.6
• dependabot/pip/types-paramiko-3.0.0.7
• dependabot/pip/types-paramiko-3.0.0.8
• dependabot/pip/types-requests-2.28.11.16
• dependabot/pip/types-requests-2.28.11.17
• dependabot/pip/types-requests-2.31.0.2
• dependabot/pip/types-requests-2.31.0.3
• dependabot/pip/types-requests-2.31.0.4
• dependabot/pip/types-requests-2.31.0.5
• dependabot/pip/types-requests-2.31.0.6
• dependabot/pip/types-requests-2.31.0.8
• dependabot/pip/urllib3-1.26.17
• dependency-update
• handle-timeout
• main
• maintenance-06-2024
• misc-updates
• multiple-vendor-types
• refs/tags/v1.0.0
• refs/tags/v1.1
• refs/tags/v1.1.0
• refs/tags/v1.1.1
• refs/tags/v1.2.0

Build # 14999490809

Build Type

push

github

Committed by ehanson8

Commit Message

Replace pipenv check with pip-audit

Why these changes are being introduced:

As of pipenv 2025.0.1 the use of `pipenv check` would throw
an error, indicating that the library `safety` was not installed.
It worked to run `pipenv check --auto-install` which would
temporarily install `safety`, but this was not ideal for multiple
reasons.

First, we anticipate potentially moving away from `pipenv`.

Second, it appears that `safety` is moving to a pay / subscription
model.

Third, it remains a little obfuscated what `pipenv check` is actually
doing.

As this new situation affects all builds in Github Actions CI,
we need a way to scan for vulnerabilities that ideally is not
a massive overhaul of our vulnerability scanning approach.

How this addresses that need:

`pip-audit` is a nice standalone, open-source library that
performs very similar work to `safety`.

This commit replaces `pipenv check` (which was `safety` under
the hood) with `pip-audit`.

Side effects of this change:
* Builds will be successful in Github Actions

Relevant ticket(s):
* https://mitlibraries.atlassian.net/browse/IN-1257

Run Details

2 of 2 new or added lines in 2 files covered. (100.0%)

644 of 644 relevant lines covered (100.0%)

1.0 hits per line