#!/usr/bin/env bash
# Audit the locked dependency set with pip-audit.
#
# Ignored advisories (documented waivers, see docs/security.md) are read from
# security/pip-audit-ignore.txt: one advisory id per line, '#' starts a comment.
set -euo pipefail

ignore_file="security/pip-audit-ignore.txt"
req="$(mktemp)"
trap 'rm -f "${req}"' EXIT

uv export --locked --no-hashes --no-emit-project --format requirements-txt > "${req}"

args=(-r "${req}" --strict --no-deps --disable-pip)
if [ -f "${ignore_file}" ]; then
  while IFS= read -r line; do
    id="${line%%#*}"
    id="$(echo "${id}" | tr -d '[:space:]')"
    if [ -n "${id}" ]; then
      args+=(--ignore-vuln "${id}")
    fi
  done < "${ignore_file}"
fi

uv run pip-audit "${args[@]}"