chore(deps): bump the python-minor-patch group across 1 directory with 3 updates #173
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency audit | |
| on: | |
| pull_request: | |
| schedule: | |
| - cron: "0 6 * * 1" # Mondays 06:00 UTC | |
| permissions: | |
| contents: read | |
| jobs: | |
| pip-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # zizmor[artipacked]: the checkout's credentials are not needed past this step. | |
| persist-credentials: false | |
| - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 | |
| - name: Export resolved deps | |
| run: uv export --frozen --format requirements-txt --no-hashes --all-packages > requirements-audit.txt | |
| # Pinning the tool does not freeze what it knows: pip-audit fetches the advisory | |
| # database at run time, so this pins the scanner's behaviour while advisories stay | |
| # current. | |
| - name: pip-audit (informational — Dependabot files the fix PRs) | |
| run: uvx pip-audit==2.10.1 -r requirements-audit.txt | |
| continue-on-error: true | |
| # pip-audit above is informational and scheduled; this is the blocking PR gate. | |
| # It diffs the dependency graph at base vs head, which GitHub builds from uv.lock | |
| # directly — no committed manifest and no write-scoped token needed, so it covers | |
| # fork PRs too. | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| # deps.yml also runs on a Monday cron, and dependency-review-action errors out | |
| # when there is no pull request to diff. | |
| if: github.event_name == 'pull_request' | |
| permissions: | |
| contents: read | |
| pull-requests: write # comment-summary-in-pr only; scoped to this job | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # zizmor[artipacked]: the checkout's credentials are not needed past this step. | |
| persist-credentials: false | |
| - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 | |
| with: | |
| fail-on-severity: high | |
| comment-summary-in-pr: on-failure |