MITLibraries / carbon

93%

main: 94%

LAST BUILD ON BRANCH IN-1256-pip-audit

branch: IN-1256-pip-audit

CHANGE BRANCH

x

Reset

• IN-1256-pip-audit
• IN-1333-article-feed-date-scoped
• IN-1573-2025-12-maintenance
• IN-884-refactor-config-loading
• IN-885-app-stabilization-linters
• IN-885-app-stablization
• IN-886-use-new-data-warehouse-secret
• IN-887-use-new-symplectic-ftp-params
• IN-889-configure-sentry
• IN-905-refine-var-names-and-docstrings
• IN-906-include-engine-creation-in-main
• IN-907-define-feed-classes
• IN-908-build-dev-testing-framework
• IN-923-925-raise-exceptions-and-add-make-commands
• IN-924-fix-ftp-file-transfer-method
• IN-928-create-config-class
• IN-930-add-diagrams-to-readme
• aa-feed
• add-areas
• add-fields
• aws-cli-v2
• awsorg
• carbon-refactor-improvements
• case
• certified
• cli
• cli-args
• command-help
• context
• coverage
• coveralls
• create-diagram
• dependabot/docker/python-3.12-slim
• dependabot/pip/boto3-1.28.25
• dependabot/pip/boto3-1.28.30
• dependabot/pip/boto3-1.28.32
• dependabot/pip/boto3-1.28.35
• dependabot/pip/boto3-1.28.40
• dependabot/pip/boto3-1.28.44
• dependabot/pip/boto3-1.28.49
• dependabot/pip/boto3-1.28.53
• dependabot/pip/boto3-1.28.57
• dependabot/pip/boto3-1.28.62
• dependabot/pip/boto3-1.28.63
• dependabot/pip/boto3-1.28.68
• dependabot/pip/boto3-1.28.73
• dependabot/pip/boto3-1.33.11
• dependabot/pip/boto3-1.33.6
• dependabot/pip/boto3-1.34.11
• dependabot/pip/boto3-1.34.2
• dependabot/pip/boto3-1.34.7
• dependabot/pip/boto3-stubs-1.28.25
• dependabot/pip/boto3-stubs-1.28.30
• dependabot/pip/boto3-stubs-1.28.32
• dependabot/pip/boto3-stubs-1.28.35
• dependabot/pip/boto3-stubs-1.28.40
• dependabot/pip/boto3-stubs-1.28.44
• dependabot/pip/boto3-stubs-1.28.49
• dependabot/pip/boto3-stubs-1.28.53
• dependabot/pip/boto3-stubs-1.28.57
• dependabot/pip/boto3-stubs-1.28.62
• dependabot/pip/boto3-stubs-1.28.63
• dependabot/pip/boto3-stubs-1.28.68
• dependabot/pip/boto3-stubs-1.28.73
• dependabot/pip/boto3-stubs-1.33.11
• dependabot/pip/boto3-stubs-1.33.6
• dependabot/pip/boto3-stubs-1.34.11
• dependabot/pip/boto3-stubs-1.34.2
• dependabot/pip/boto3-stubs-1.34.7
• dependabot/pip/cryptography-3.2
• dependabot/pip/cryptography-41.0.4
• dependabot/pip/cryptography-41.0.6
• dependabot/pip/lxml-4.6.2
• dependabot/pip/lxml-4.6.3
• dependabot/pip/moto-4.2.0
• dependabot/pip/moto-4.2.10
• dependabot/pip/moto-4.2.11
• dependabot/pip/moto-4.2.12
• dependabot/pip/moto-4.2.2
• dependabot/pip/moto-4.2.3
• dependabot/pip/moto-4.2.4
• dependabot/pip/moto-4.2.5
• dependabot/pip/moto-4.2.6
• dependabot/pip/moto-4.2.7
• dependabot/pip/moto-4.2.8
• dependabot/pip/moto-4.2.9
• dependabot/pip/mypy-1.6.0
• dependabot/pip/mypy-1.6.1
• dependabot/pip/mypy-1.7.1
• dependabot/pip/mypy-1.8.0
• dependabot/pip/py-1.10.0
• dependabot/pip/pyyaml-5.4
• dependabot/pip/sentry-sdk-1.32.0
• dependabot/pip/sentry-sdk-1.38.0
• dependabot/pip/sentry-sdk-1.39.1
• dependabot/pip/types-setuptools-68.1.0.0
• dependabot/pip/urllib3-1.25.8
• dependabot/pip/urllib3-1.26.17
• dependabot/pip/urllib3-1.26.18
• dependabot/pip/werkzeug-3.0.1
• deploy-bucket
• deps
• deps-upgrade
• docker
• docs
• env-docs
• fargate
• field-fixes
• fix-area
• fix-release
• fix-secrets
• fixtures
• flake8
• ftp
• github-actions
• groups
• hire-date
• in-622-stage-deploy
• infra-299-add-to-faculty-date
• lambda
• lambda-package
• leave-dates
• ll-employees
• main
• maintenace-week-07-2024
• maintenance-week-07-2024
• make-help
• make-publish-fix
• makefile
• makefile-fix
• master
• mem-db
• multifeeds
• names
• orcids
• poc-maintainer-links
• post-xml
• readme
• rebuild
• refs/tags/v3.0.0
• remove-old
• req_fields
• secret-id
• ssl-session
• start-date-2
• stream-xml
• timeout
• unicle
• update_sql
• v1.1.0
• v1.2.0
• v2.0.0
• v3.1.0
• v3.1.1

Build # 14998774538

Build Type

push

github

Committed by ehanson8

Commit Message

Replace pipenv check with pip-audit

Why these changes are being introduced:

As of pipenv 2025.0.1 the use of `pipenv check` would throw
an error, indicating that the library `safety` was not installed.
It worked to run `pipenv check --auto-install` which would
temporarily install `safety`, but this was not ideal for multiple
reasons.

First, we anticipate potentially moving away from `pipenv`.

Second, it appears that `safety` is moving to a pay / subscription
model.

Third, it remains a little obfuscated what `pipenv check` is actually
doing.

As this new situation affects all builds in Github Actions CI,
we need a way to scan for vulnerabilities that ideally is not
a massive overhaul of our vulnerability scanning approach.

How this addresses that need:

`pip-audit` is a nice standalone, open-source library that
performs very similar work to `safety`.

This commit replaces `pipenv check` (which was `safety` under
the hood) with `pip-audit`.

Side effects of this change:
* Builds will be successful in Github Actions

Relevant ticket(s):
* https://mitlibraries.atlassian.net/browse/IN-1256

Run Details

320 of 345 relevant lines covered (92.75%)

0.93 hits per line