ci: use python-build-standalone 3.10 binary for pip-audit

Debian Bullseye only ships Python 3.9 and python3.10 is not in its repos. python-dotenv 1.2.2 (vuln fix) requires Python >=3.10. Use indygreg/python-build-standalone to get a self-contained Python 3.10.15 binary that works on any glibc Linux runner. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-21 14:00:36 -04:00
parent a85ea312c9
commit 353695f8c3
1 changed files with 5 additions and 4 deletions
@@ -57,12 +57,13 @@ jobs:

      - name: Install Python 3.10 and pip-audit
        run: |
-          apt-get update -qq && apt-get install -y -qq python3.10 python3-pip
-          python3.10 -m ensurepip --upgrade
-          python3.10 -m pip install pip-audit
+          # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary
+          curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \
+            | tar -xz -C /opt
+          /opt/python/bin/pip install pip-audit

      - name: Audit matrixbot dependencies
-        run: python3.10 -m pip_audit -r matrixbot/requirements.txt
+        run: /opt/python/bin/pip-audit -r matrixbot/requirements.txt

  secret-scan:
    name: Secret scan (gitleaks)