feat: add uv audit --preview as third approach for comparison #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Vulnerability Audit | |
| on: | |
| schedule: | |
| # Run weekly on Mondays at 9:00 UTC | |
| - cron: "0 9 * * 1" | |
| workflow_dispatch: | |
| # Also run on PRs that change dependencies | |
| pull_request: | |
| paths: | |
| - "uv.lock" | |
| - "pyproject.toml" | |
| # Temporary: trigger on push to test the workflow | |
| push: | |
| branches: | |
| - feature/vulnerability-audit-poc | |
| jobs: | |
| # Approach 1: pip-audit (PyPA official tool) | |
| # Audits the installed environment after uv sync. | |
| # Pros: official PyPA tool, well-maintained, GitHub Action available | |
| # Cons: requires installing deps first (slower), doesn't read uv.lock directly | |
| pip-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install uv and Python | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: uv.lock | |
| - name: Install the project | |
| run: uv sync --locked --dev --all-extras | |
| - name: Run pip-audit | |
| run: uv run --with pip-audit pip-audit --strict --vulnerability-service osv --desc | |
| # Approach 2: uv-secure (reads uv.lock directly) | |
| # Pros: fast (no install needed), reads uv.lock natively, supports severity filtering | |
| # Cons: newer/less established, community tool | |
| uv-secure: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v7 | |
| - name: Run uv-secure | |
| run: uvx uv-secure uv.lock | |
| # Approach 3: uv audit (native uv command, still in preview as of 0.11.2) | |
| # Pros: native to uv (no extra tools), reads uv.lock directly, uses OSV database | |
| # Cons: requires --preview flag, may change before stable | |
| uv-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v7 | |
| - name: Run uv audit | |
| run: uv audit --preview |