MITLibraries / wcd2reshare

100%

main: 100%

LAST BUILD ON BRANCH IN-1243-pip-audit

branch: IN-1243-pip-audit

CHANGE BRANCH

x

Reset

Sync Branches

• IN-1243-pip-audit
• ENSY-99-repo-setup
• IN-1198-maintenance-updates-for-wcd-2-reshare-application
• add-workflows
• dependabot/pip/certifi-2022.12.7
• ecr-makefile
• ecr-makfile
• main
• oclc-number
• refs/tags/v1.0.0
• refs/tags/v1.1
• sentry
• update-caller-workflows
• update_borrowdirect_url
• v1.2
• v1.3

Build # 14845063350

Build Type

push

github

Committed by ehanson8

Commit Message

Replace pipenv check with pip-audit

Why these changes are being introduced:

As of pipenv 2025.0.1 the use of `pipenv check` would throw
an error, indicating that the library `safety` was not installed.
It worked to run `pipenv check --auto-install` which would
temporarily install `safety`, but this was not ideal for multiple
reasons.

First, we anticipate potentially moving away from `pipenv`.

Second, it appears that `safety` is moving to a pay / subscription
model.

Third, it remains a little obfuscated what `pipenv check` is actually
doing.

As this new situation affects all builds in Github Actions CI,
we need a way to scan for vulnerabilities that ideally is not
a massive overhaul of our vulnerability scanning approach.

How this addresses that need:

`pip-audit` is a nice standalone, open-source library that
performs very similar work to `safety`.

This commit replaces `pipenv check` (which was `safety` under
the hood) with `pip-audit`.

Side effects of this change:
* Builds will be successful in Github Actions

Relevant ticket(s):
* https://mitlibraries.atlassian.net/browse/IN-1240

Run Details

53 of 53 relevant lines covered (100.0%)

1.0 hits per line