Skip to content

chore(deps): drop pip-audit, gate CI on uv audit, require uv >=0.12.15 (CLI-16) #768

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
soustruh merged 2 commits into from
Sep 16, 2026
Merged

chore(deps): drop pip-audit, gate CI on uv audit, require uv >=0.12.15 (CLI-16) #768

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4716057
chore(deps): drop pip-audit, gate CI on uv audit, require uv >=0.12.1…
soustruh Sep 15, 2026
be6f5b3
ci: run uv audit as a separate non-blocking job (CLI-16)
soustruh Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/setup-build/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ runs:
steps:
- uses: astral-sh/setup-uv@v7
with:
version: "0.11.16"
version: "0.12.15"
# Pin the interpreter explicitly (matches ci.yml / release.yml). Without it a job
# could run on whatever Python the runner ships, which may not satisfy >=3.12.
- uses: actions/setup-python@v6
Expand Down
39 changes: 33 additions & 6 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,9 +57,9 @@ jobs:
# directly instead of fetching the `uv.ndjson` version manifest from
# raw.githubusercontent.com on every run -- that fetch is rate-limited
# and flaky on shared CI egress IPs (it killed the Windows job once).
version: "0.11.16"
version: "0.12.15"
enable-cache: true
cache-dependency-glob: "uv.lock"
cache-dependency-glob: uv.lock

- uses: actions/setup-python@v6
with:
Expand Down Expand Up @@ -225,6 +225,33 @@ jobs:
# reliably misses because a diff never shows the resulting file size.
run: uv run python scripts/check_file_size.py

# ────────────────────────────────────────────────────────────────────────
# Dependency vulnerability audit (uv audit, OSV). Kept OUT of the `check`
# job on purpose: its verdict depends on the OSV advisory database at run
# time, not on the diff, so a newly disclosed CVE – or an OSV outage –
# must never turn an unrelated PR's static-analysis gate red. It runs on its
# own and is NOT a required check: a finding shows red here for visibility,
# but does not block a merge. Dependabot remains the automated fix channel.
# ────────────────────────────────────────────────────────────────────────
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5

- uses: astral-sh/setup-uv@v7
with:
version: "0.12.15"
enable-cache: true
cache-dependency-glob: uv.lock

- uses: actions/setup-python@v6
with:
python-version: "3.12"

# `uv audit --frozen` reads uv.lock directly; no `uv sync` needed.
- name: Dependency audit
run: uv audit --frozen

# ────────────────────────────────────────────────────────────────────────
# Test suite. pyproject declares `requires-python = ">=3.12"`, so the
# supported interpreters are 3.12 + 3.13 (3.10/3.11 are intentionally out of
Expand Down Expand Up @@ -265,9 +292,9 @@ jobs:

- uses: astral-sh/setup-uv@v7
with:
version: "0.11.16"
version: "0.12.15"
enable-cache: true
cache-dependency-glob: "uv.lock"
cache-dependency-glob: uv.lock

- uses: actions/setup-python@v6
with:
Expand Down Expand Up @@ -312,9 +339,9 @@ jobs:
# directly instead of fetching the `uv.ndjson` version manifest from
# raw.githubusercontent.com on every run -- that fetch is rate-limited
# and flaky on shared CI egress IPs (it killed the Windows job once).
version: "0.11.16"
version: "0.12.15"
enable-cache: true
cache-dependency-glob: "uv.lock"
cache-dependency-glob: uv.lock

- uses: actions/setup-python@v6
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ jobs:

- uses: astral-sh/setup-uv@v7
with:
version: "0.11.16"
version: "0.12.15"

- uses: actions/setup-python@v6
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release-kbagent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ jobs:
PY=$(sed -n -E 's/^version = "([^"]+)"/\1/p' pyproject.toml | head -1)
[ "$PY" = "$VERSION" ] || { echo "::error::tag v$VERSION does not match pyproject version $PY"; exit 1; }
- uses: astral-sh/setup-uv@v7
with: { version: "0.11.16" }
with: { version: "0.12.15" }
- uses: actions/setup-python@v6
with: { python-version: "3.12" }
- run: uv sync --extra server
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ jobs:
with:
# Pin uv to download the release asset directly instead of fetching the
# rate-limited uv.ndjson manifest on shared CI egress IPs (see ci.yml).
version: "0.11.16"
version: "0.12.15"

- uses: actions/setup-python@v6
with:
Expand Down
6 changes: 6 additions & 0 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -856,6 +856,7 @@ make check # CI parity: lint + format + typecheck + skill + version
make lint # Just the ruff linter
make format # Auto-format code
make typecheck # Static type check (Astral `ty`)
make audit # Audit locked dependencies for known vulnerabilities (uv audit, OSV)

@zajca zajca Sep 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed by Opus.

The "Running CI Locally" block was updated here (lines 855 and 859), but the "CI workflows" section further down was not. CONTRIBUTING.md:881-887 enumerates what the check job runs — "lint, format, ty type-check, SKILL.md freshness, version consistency, the command-sync and version-gate silent-drift gates, the serve endpoint-reference freshness check, and the error-code enum check" — and still omits the dependency audit that .github/workflows/ci.yml:73-75 now adds.

That same paragraph also asserts the job's gates "are deterministic and interpreter-independent", which no longer holds once an OSV lookup is part of it (see C001). Given how much this repo invests in keeping documentation and gates in sync, a contributor reading that section will not learn that a CI failure can now come from a dependency advisory rather than from their diff. Adding the audit to the enumeration — and noting why it can fail without any code change — keeps the section accurate.

make test # Just the test suite (no coverage)
make test-cov # Test suite + informational coverage report (term-missing)
make command-sync-check # Verify every CLI command is registered + documented
Expand Down Expand Up @@ -889,6 +890,11 @@ Two GitHub Actions workflows guard the repo:
(`-m "not integration"`; `e2e` self-skips without credentials). Coverage is
printed (`--cov ... --cov-report=term-missing`) but **informational** --
there is no `--cov-fail-under` threshold, so coverage never blocks a merge.
- **`audit` job** (one run, Python 3.12): `uv audit --frozen` against the OSV
advisory database. Deliberately separate and **not** a required check -- its
result depends on advisories published over time, not on the diff, so a
finding shows red here for visibility but never blocks a merge. Run it locally
with `make audit`. Dependabot stays the automated fix channel.
- **`build-windows` job**: real `uv build` wheel checks (issue #320).

`make check` runs the same gates as the `check` + `test` CI jobs locally and is
Expand Down
5 changes: 4 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
.DEFAULT_GOAL := help

.PHONY: help install install-server sync test test-unit test-integration test-e2e test-e2e-local test-e2e-invite test-e2e-feature test-e2e-stream test-e2e-auth test-file test-cov lint lint-fix format format-check typecheck typecheck-warn skill-check skill-gen version-sync version-check version-gate-check vnext-check vnext-resolve gate-floor-report release-scope-check changelog changelog-check check-error-codes check-sentinel-guards loc-check loc-report loc-baseline command-sync-check gen-command-reference endpoints-gen endpoints-check check clean hooks web-install web-dev-backend web-dev-frontend web-build web-clean
.PHONY: help install install-server sync test test-unit test-integration test-e2e test-e2e-local test-e2e-invite test-e2e-feature test-e2e-stream test-e2e-auth test-file test-cov lint lint-fix format format-check typecheck typecheck-warn audit skill-check skill-gen version-sync version-check version-gate-check vnext-check vnext-resolve gate-floor-report release-scope-check changelog changelog-check check-error-codes check-sentinel-guards loc-check loc-report loc-baseline command-sync-check gen-command-reference endpoints-gen endpoints-check check clean hooks web-install web-dev-backend web-dev-frontend web-build web-clean

help: ## Show this help message
@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf " \033[36m%-18s\033[0m %s\n", $$1, $$2}'
Expand Down Expand Up @@ -68,6 +68,9 @@ format-check: ## Check code formatting (no changes)
typecheck: ## Run ty type-checker (Astral). Fails on any error.
uv run ty check

audit: ## Audit locked dependencies (all groups + extras) for known vulnerabilities via OSV
uv audit --frozen

typecheck-warn: ## Run ty in warning-only mode (always exits 0; used by hooks)
@uv run ty check || true

Expand Down
4 changes: 3 additions & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,9 +171,11 @@ dev = [
"ruff>=0.16",
"ty>=0.0.33",
"bandit>=1.9.4",
"pip-audit>=2.10.0",
]

[tool.uv]
required-version = ">=0.12.15"

[tool.ty.src]
include = ["src", "tests", "scripts"]

Expand Down
Loading