MITLibraries / python-lambda-template

100%

main: 100%

LAST BUILD ON BRANCH IN-1240-pip-audit

branch: IN-1240-pip-audit

CHANGE BRANCH

x

Reset

Sync Branches

• IN-1240-pip-audit
• IN-1087-maintenance-11-2024
• IN-1298-replace-pipenv-with-uv
• IN-894-update-config-and-linting-defaults
• IN-894-update-python-version-in-dockerfile
• add-help-cmd-to-makefile
• add-sentry-integration
• create-repo-structure
• dependabot/pip/black-24.2.0
• dependabot/pip/black-24.3.0
• dependabot/pip/black-24.4.0
• dependabot/pip/black-24.4.1
• dependabot/pip/black-24.4.2
• dependabot/pip/idna-3.7
• dependabot/pip/pre-commit-3.6.1
• dependabot/pip/pre-commit-3.6.2
• dependabot/pip/pre-commit-3.7.0
• dependabot/pip/pyflakes-2.5.0
• dependabot/pip/pytest-8.0.1
• dependabot/pip/pytest-8.0.2
• dependabot/pip/pytest-8.1.0
• dependabot/pip/pytest-8.1.1
• dependabot/pip/pytest-8.2.0
• dependabot/pip/ruff-0.2.1
• dependabot/pip/ruff-0.2.2
• dependabot/pip/ruff-0.3.0
• dependabot/pip/ruff-0.3.1
• dependabot/pip/ruff-0.3.2
• dependabot/pip/ruff-0.3.3
• dependabot/pip/ruff-0.3.4
• dependabot/pip/ruff-0.3.5
• dependabot/pip/ruff-0.3.7
• dependabot/pip/ruff-0.4.0
• dependabot/pip/ruff-0.4.1
• dependabot/pip/ruff-0.4.2
• dependabot/pip/ruff-0.4.3
• dependabot/pip/sentry-sdk-1.40.2
• dependabot/pip/sentry-sdk-1.40.3
• dependabot/pip/sentry-sdk-1.40.4
• dependabot/pip/sentry-sdk-1.40.5
• dependabot/pip/sentry-sdk-1.40.6
• dependabot/pip/sentry-sdk-1.41.0
• dependabot/pip/sentry-sdk-1.42.0
• dependabot/pip/sentry-sdk-1.43.0
• dependabot/pip/sentry-sdk-1.44.0
• dependabot/pip/sentry-sdk-1.44.1
• dependabot/pip/sentry-sdk-1.45.0
• dependabot/pip/sentry-sdk-2.0.0
• dependabot/pip/sentry-sdk-2.0.1
• dependabot/pip/sentry-sdk-2.1.1
• main
• pr-template-update
• pr-template-update-checklist
• ruff-pyproject-toml-updates
• unpin-pyflakes
• update-dependabot-config
• update-pr-template
• update-readme-and-makefile

Build # 14837581812

Build Type

push

github

Committed by ghukill

Commit Message

Replace pipenv check with pip-audit

Why these changes are being introduced:

As of pipenv 2025.0.1 the use of `pipenv check` would throw
an error, indicating that the library `safety` was not installed.
It worked to run `pipenv check --auto-install` which would
temporarily install `safety`, but this was not ideal for multiple
reasons.

First, we anticipate potentially moving away from `pipenv`.

Second, it appears that `safety` is moving to a pay / subscription
model.

Third, it remains a little obfuscated what `pipenv check` is actually
doing.

As this new situation affects all builds in Github Actions CI,
we need a way to scan for vulnerabilities that ideally is not
a massive overhaul of our vulnerability scanning approach.

How this addresses that need:

`pip-audit` is a nice standalone, open-source library that
performs very similar work to `safety`.

This commit replaces `pipenv check` (which was `safety` under
the hood) with `pip-audit`.

Side effects of this change:
* Builds will be successful in Github Actions

Relevant ticket(s):
* https://mitlibraries.atlassian.net/browse/IN-1240

Run Details

18 of 18 relevant lines covered (100.0%)

1.0 hits per line