Skip to content

Update generate CI workflow for pip-audit#412

Merged
CasperWA merged 1 commit into
masterfrom
cwa/update-pip-audit-for-generated-repo
Oct 1, 2025
Merged

Update generate CI workflow for pip-audit#412
CasperWA merged 1 commit into
masterfrom
cwa/update-pip-audit-for-generated-repo

Conversation

@CasperWA

@CasperWA CasperWA commented Oct 1, 2025

Copy link
Copy Markdown
Contributor

Description

This is something I missed to update in the recently merged PR for updating dependencies (#411).

AI summary

This pull request updates the project's dependency management and CI workflow to improve security auditing and dependency handling. The main changes include configuring Dependabot to monitor additional directories, updating CI requirements, and enhancing the pip-audit step in the workflow.

Dependency management improvements:

  • Updated .github/dependabot.yml to monitor both the root directory and .github/utils for Python dependencies, ensuring that all relevant requirements files are kept up to date.
  • Added pip-tools==7.5.0 to .github/utils/requirements_ci.txt to support deterministic dependency compilation in CI.

CI workflow enhancements:

  • Modified the ci_tests.yml workflow to install dependencies from .github/utils/requirements_ci.txt instead of using editable installs, and added a step to generate a complete requirements file for pip-audit using pip-compile.
  • Updated the pip-audit step to use the generated requirements file as input, improving the accuracy and coverage of dependency vulnerability checks.

Type of change

  • Bug fix.
  • New feature.
  • Documentation update.

Checklist for the reviewer

This checklist should be used as a help for the reviewer.

  • Is the change limited to one issue?
  • Does this PR close the issue?
  • Is the code easy to read and understand?
  • Do all new feature have an accompanying new test?
  • Has the documentation been updated as necessary?

@CasperWA
CasperWA requested a review from Copilot October 1, 2025 08:01

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR enhances dependency management and CI workflow security by configuring pip-audit to analyze a comprehensive requirements file and improving Dependabot monitoring coverage.

  • Replaces editable package installs with requirements-based installation in CI
  • Implements pip-compile to generate a complete requirements file for pip-audit analysis
  • Expands Dependabot monitoring to include .github/utils directory

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
.github/workflows/ci_tests.yml Updates CI to use requirements file installation and adds pip-compile step for comprehensive pip-audit analysis
.github/utils/requirements_ci.txt Introduces pip-tools dependency for CI requirements compilation
.github/dependabot.yml Expands Dependabot monitoring to cover additional Python dependency directories

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment thread {{ cookiecutter.project_slug }}/.github/dependabot.yml
@CasperWA
CasperWA requested a review from Treesarj October 1, 2025 08:02
@CasperWA
CasperWA merged commit 8e2efe0 into master Oct 1, 2025
8 checks passed
@CasperWA
CasperWA deleted the cwa/update-pip-audit-for-generated-repo branch October 1, 2025 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants