From ed78a17109ceebb076aad15fc6e19d9dd63c4913 Mon Sep 17 00:00:00 2001 From: IK Date: Thu, 10 Sep 2026 18:18:09 +0700 Subject: [PATCH] A11: Replace pip audit with real pip-audit tool and remove error suppression Bug: CI used 'pip audit ... || true' which: 1. Relied on pip-audit being pre-installed (not guaranteed) 2. Suppressed all errors with '|| true', hiding security issues Fix: - Install pip-audit explicitly in CI workflow - Remove '|| true' to fail on security vulnerabilities - Use requirements-lock.txt instead of requirements.txt for reproducibility - Check both production and dev dependencies This ensures: - Security audit actually runs and fails on vulnerabilities - Locked dependencies are used for consistent results - No silent failures masking security issues --- .gitea/workflows/ci.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index e0b92e6..4496e09 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -68,11 +68,14 @@ jobs: - uses: actions/setup-python@v5 with: python-version: "3.12" - - name: Check Python dependencies for security issues + cache: pip + - name: Install pip-audit and check dependencies run: | pip install --upgrade pip - pip install -r apps/api/requirements.txt - pip audit --requirement apps/api/requirements.txt || true + pip install pip-audit + pip-audit --requirement apps/api/requirements-lock.txt + # Also check dev dependencies + pip-audit --requirement apps/api/requirements-dev-lock.txt compose-e2e: runs-on: ubuntu-latest