fix: move security package to fresh installation

Author: TomKaltofen

.github/workflows/security-scan.yaml

@@ -21,25 +21,12 @@ jobs:
       with:
         python-version: "3.10"
 
-    - name: Install dependencies
+    - name: Install tox
       run: |
         python -m pip install --upgrade pip
-        python -m pip install tox
-
-    - name: Get package name and latest release version
-      id: get_info
-      run: |
-        PACKAGE_NAME=$(grep -E '^name = ' pyproject.toml | head -1 | sed 's/name = "\(.*\)"/\1/')
-        echo "package_name=$PACKAGE_NAME" >> $GITHUB_OUTPUT
-        echo "Package name: $PACKAGE_NAME"
-
-        LATEST_VERSION=$(curl -s https://api.github.com/repos/${{ github.repository }}/releases/latest | jq -r '.tag_name' | sed 's/^v//')
-        echo "version=$LATEST_VERSION" >> $GITHUB_OUTPUT
-        echo "Latest version: $LATEST_VERSION"
+        python -m pip install uv
+        uv tool install tox --with tox-uv
 
     - name: Run security scan with tox
-      env:
-        PACKAGE_NAME: ${{ steps.get_info.outputs.package_name }}
-        PACKAGE_VERSION: ${{ steps.get_info.outputs.version }}
       run: tox -e security
-      timeout-minutes: 10
+      timeout-minutes: 2

.github/workflows/test.yml

@@ -29,3 +29,4 @@ jobs:
 
       - name: Run tox
         run: tox
+        timeout-minutes: 2

.gitignore

@@ -206,3 +206,6 @@ cython_debug/
 marimo/_static/
 marimo/_lsp/
 __marimo__/
+
+# mloda-plugin-template
+security-reports/

docs/github-workflows.md

@@ -22,7 +22,7 @@ This project uses three GitHub Actions workflows to automate testing, security s
 - Scheduled: Every Monday at 9:00 AM UTC
 - Manual dispatch (can be triggered from any branch)
 
-**Purpose:** Performs CVE vulnerability scanning on the latest published release using pip-audit via tox. The workflow fetches the latest release version from GitHub and scans it for known vulnerabilities.
+**Purpose:** Performs CVE vulnerability scanning on the local package using pip-audit via tox. The workflow builds the package and scans its dependencies for known vulnerabilities.
 
 **Requirements:** None. Uses only the default `GITHUB_TOKEN` with read permissions.
 

tox.ini

@@ -13,28 +13,21 @@ commands =
     bandit -c pyproject.toml -r -q .
 
 [testenv:security]
-# CVE scanning environment - downloads specific version of published package
-skip_install = False
-usedevelop = False
+# CVE scanning environment - builds and scans the local package
+usedevelop = true
+extras = dev
 deps =
     pip-audit
-allowlist_externals = sh, rm, mkdir
-setenv =
-    PACKAGE_NAME = {env:PACKAGE_NAME:placeholder-my-plugin}
-    PACKAGE_VERSION = {env:PACKAGE_VERSION:0.2.2}
+allowlist_externals = sh, mkdir
 commands =
     mkdir -p security-reports
 
-    sh -c "pip uninstall -y {env:PACKAGE_NAME} || true"
-
-    sh -c "pip install {env:PACKAGE_NAME}=={env:PACKAGE_VERSION}"
-
     sh -c "pip list"
 
-    # Run CVE scan
-    sh -c "pip-audit --desc --format=json --output=security-reports/pip-audit-version.json || pip-audit --desc"
+    # Run CVE scan on installed dependencies
+    sh -c "pip-audit --desc --format=json --output=security-reports/pip-audit.json || pip-audit --desc"
 
     # Display summary
     sh -c "echo '=== CVE Scan Summary ==='"
     sh -c "echo 'Tool: pip-audit (Apache 2.0 licensed)'"
-    sh -c "echo 'Report: security-reports/pip-audit-version.json'"
+    sh -c "echo 'Report: security-reports/pip-audit.json'"