From 353695f8c3bedcbf7deb469b1e888976d50eaf39 Mon Sep 17 00:00:00 2001 From: Jared Vititoe Date: Tue, 21 Apr 2026 14:00:36 -0400 Subject: [PATCH] ci: use python-build-standalone 3.10 binary for pip-audit Debian Bullseye only ships Python 3.9 and python3.10 is not in its repos. python-dotenv 1.2.2 (vuln fix) requires Python >=3.10. Use indygreg/python-build-standalone to get a self-contained Python 3.10.15 binary that works on any glibc Linux runner. Co-Authored-By: Claude Sonnet 4.6 --- .gitea/workflows/lint.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml index 623e2f7..56c7777 100644 --- a/.gitea/workflows/lint.yml +++ b/.gitea/workflows/lint.yml @@ -57,12 +57,13 @@ jobs: - name: Install Python 3.10 and pip-audit run: | - apt-get update -qq && apt-get install -y -qq python3.10 python3-pip - python3.10 -m ensurepip --upgrade - python3.10 -m pip install pip-audit + # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary + curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \ + | tar -xz -C /opt + /opt/python/bin/pip install pip-audit - name: Audit matrixbot dependencies - run: python3.10 -m pip_audit -r matrixbot/requirements.txt + run: /opt/python/bin/pip-audit -r matrixbot/requirements.txt secret-scan: name: Secret scan (gitleaks)