add audit and malware checks to this repo and the templates for new reposp - #180
add audit and malware checks to this repo and the templates for new reposp#180sierra-moxon wants to merge 3 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Adds dependency “cooldown” and automated dependency security checks to both the copier template and generated repositories, centered around uv’s exclude-newer, malware blocking during installs, and (for generated projects) uv audit.
Changes:
- Add
uvdependency cooldown (exclude-newer = "7 days") to the templatepyproject.toml.jinjaand this repo’spyproject.toml. - Add dependency audit workflows:
uv audit+ malware-gated sync for generated repos, and malware-gated sync for this copier repo. - Add Dependabot cooldown settings and introduce a weekly
uvecosystem update configuration in the template.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| template/pyproject.toml.jinja | Adds [tool.uv] exclude-newer cooldown configuration to generated projects. |
| template/.github/workflows/dependency-audit.yaml | New generated-repo workflow for CVE auditing and malware-gated dependency syncing. |
| template/.github/dependabot.yml | Adds 7-day cooldown for Actions updates and configures weekly uv updates with cooldown. |
| pyproject.toml | Adds [tool.uv] exclude-newer cooldown configuration for this copier repo’s dependency resolution. |
| .github/workflows/dependency-audit.yml | New workflow to malware-gate dependency sync for this copier repo. |
| .github/dependabot.yml | Adds 7-day cooldown for Actions updates in this copier repo. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Step 1: Scan the lockfile for known vulnerabilities (CVEs). | ||
| - name: Audit lockfile for CVEs | ||
| run: uv audit | ||
|
|
||
| # Step 2: Sync the environment. With UV_MALWARE_CHECK enabled, a package | ||
| # flagged by an OSV malware advisory triggers an immediate non-zero exit. | ||
| # | ||
| # The malware gate only blocks malware already published as an OSV | ||
| # advisory; there is a window between a malicious upload and its advisory. | ||
| # That gap is covered by uv's dependency cooldown (`exclude-newer`), which | ||
| # is set to a 7-day window in pyproject.toml: | ||
| # | ||
| # [tool.uv] | ||
| # exclude-newer = "7 days" | ||
| - name: Verify environment sync (anti-malware gate) | ||
| run: uv sync --frozen --group dev |
dalito
left a comment
dalito
left a comment
There was a problem hiding this comment.
@sierra-moxon - Thanks for proposing this improvement. For the actions, it is a good idea as they run automatic. For the pyproject.toml file I would prefer to not set the delay. It would be quite surprising if a user could not update to new linkml releases once they are out due to a delay configuration parameter most users will have never heart of.
|
FYI: GitHub has added a default cool-down period for dependencies of at least 3 days on July, 14th. |
Generated projects (template/):
Copier repo itself:
is CVE scanning of the template repo's own dev/test tooling worth introducing a [project] table to take advantage of uv audit despite this not being a package?
These changes echo changes in: linkml/linkml#3650