fix: add --no-deps to pip install in composite actions

[buger]

Summary

• Adds --no-deps to pip install -r requirements.txt in the api-tests composite action
• Prevents pip from resolving and installing transitive dependencies not pinned in the requirements file
• Mitigates supply chain attacks via arbitrary code execution in setup.py of transitive dependencies

Notes

Other unsafe install patterns were found but are out of scope for this PR:

• go install ...@latest in gotest, govulncheck, golangci workflows
• npm install in branch-suggestion workflow

Test plan

• Verify api-tests still pass with --no-deps (all direct dependencies must be listed in requirements.txt)
• If tests fail due to missing transitive deps, add those deps explicitly to requirements.txt

🤖 Generated with Claude Code

[probelabs]

This PR enhances the security of the CI/CD pipeline by hardening dependency installation commands across multiple workflows and composite actions. The changes aim to mitigate supply chain attacks by ensuring more deterministic and safer package installations.

Files Changed Analysis

The pull request modifies 7 YAML configuration files within the .github directory. Each modification is a single-line change to a shell command inside a run step. The changes consistently apply security best practices for package management in Python, Node.js, and Go environments.

• .github/actions/tests/api-tests/action.yaml: Adds --no-deps to pip install to prevent the installation of transitive dependencies not explicitly listed in requirements.txt.
• .github/actions/tests/ui-tests/action.yaml: Adds --ignore-scripts to npm ci to prevent the execution of arbitrary scripts during installation.
• .github/workflows/branch-suggestion.yml: Adds --ignore-scripts to npm install and pins the version of @probelabs/visor.
• .github/workflows/ci-test.yml: Adds --ignore-scripts to npm ci.
• .github/workflows/golangci.yaml: Pins go install to a specific version (v0.43.0) instead of using @latest.
• .github/workflows/gotest.yaml: Pins gotestsum to a specific version (v1.13.0).
• .github/workflows/govulncheck.yaml: Pins govulncheck to a specific version (v1.1.4).

Architecture & Impact Assessment

• What this PR accomplishes: It hardens the CI/CD pipeline against supply chain vulnerabilities by enforcing stricter dependency management. This reduces the risk of malicious code execution from untrusted transitive dependencies or compromised packages.

• Key technical changes introduced:

  1. Pip: pip install -r requirements.txt is changed to pip install --no-deps -r requirements.txt.
  2. NPM: npm ci and npm install are updated to npm ci --ignore-scripts and npm install --ignore-scripts.
  3. Go: go install ...@latest is replaced with go install ...@<version> to use pinned, specific versions of tools.

• Affected system components: The changes impact several core CI/CD processes, including API tests, UI tests, linting, and vulnerability scanning. Any workflow relying on these composite actions or steps will inherit the stricter security measures.

graph TD
    subgraph "Security Hardening"
        A["pip install"] --> B["pip install --no-deps"]
        C["npm ci/install"] --> D["npm ci/install --ignore-scripts"]
        E["go install @latest"] --> F["go install @version"]
    end

    subgraph "Affected Components"
        G["api-tests action"] -.-> B
        H["ui-tests action"] -.-> D
        I["branch-suggestion workflow"] -.-> D
        J["ci-test workflow"] -.-> D
        K["golangci workflow"] -.-> F
        L["gotest workflow"] -.-> F
        M["govulncheck workflow"] -.-> F
    end

Loading

Scope Discovery & Context Expansion

While the PR title focuses on the pip install change, the scope is broader, covering npm and go dependency management as well. This indicates a systematic effort to improve security across the entire CI pipeline.

The primary impact is on build determinism and security. A potential side effect is that builds could fail if required transitive dependencies are not explicitly declared in requirements.txt or if a package legitimately relies on a post-install script. This is a deliberate trade-off for enhanced security. The next step for maintainers would be to validate that all required dependencies are explicitly listed in the respective dependency files to ensure tests continue to pass.

Metadata

• Review Effort: 2 / 5
• Primary Label: bug

---

Powered by Visor from Probelabs

Last updated: 2026-04-01T06:11:28.945Z | Triggered by: pr_updated | Commit: fd6ee1f

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

✅ Security Check Passed

No security issues found – changes LGTM.

\n\n \n\n

✅ Performance Check Passed

No performance issues found – changes LGTM.

\n\n

Quality Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/branch-suggestion.yml:34	The `npm install` command is used in this CI workflow. For more reliable and faster builds, `npm ci` is recommended as it installs dependencies directly from the `package-lock.json` file. This ensures that the exact same dependency versions are used every time, preventing unexpected issues from updated transitive dependencies. The `ci-test.yml` workflow for this same directory already uses `npm ci`. 💡 Suggestion Replace `npm install --ignore-scripts` with `npm ci --ignore-scripts` to ensure deterministic dependency installation in the CI environment. 🔧 Suggested Fix run: npm ci --ignore-scripts

---

Powered by Visor from Probelabs

Last updated: 2026-04-01T06:11:14.719Z | Triggered by: pr_updated | Commit: fd6ee1f

💡 TIP: You can chat with Visor using /visor ask <your question>