Latte
1a039e32ab
Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.
26 lines
737 B
Bash
Executable File
26 lines
737 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Audit the locked dependency set with pip-audit.
|
|
#
|
|
# Ignored advisories (documented waivers, see docs/security.md) are read from
|
|
# security/pip-audit-ignore.txt: one advisory id per line, '#' starts a comment.
|
|
set -euo pipefail
|
|
|
|
ignore_file="security/pip-audit-ignore.txt"
|
|
req="$(mktemp)"
|
|
trap 'rm -f "${req}"' EXIT
|
|
|
|
uv export --locked --no-hashes --no-emit-project --format requirements-txt > "${req}"
|
|
|
|
args=(-r "${req}" --strict --no-deps --disable-pip)
|
|
if [ -f "${ignore_file}" ]; then
|
|
while IFS= read -r line; do
|
|
id="${line%%#*}"
|
|
id="$(echo "${id}" | tr -d '[:space:]')"
|
|
if [ -n "${id}" ]; then
|
|
args+=(--ignore-vuln "${id}")
|
|
fi
|
|
done < "${ignore_file}"
|
|
fi
|
|
|
|
uv run pip-audit "${args[@]}"
|