From 246774e3ebde5debd362719d55c7f765264beee6 Mon Sep 17 00:00:00 2001 From: Lotus CI Date: Wed, 28 Oct 2026 21:18:13 -0400 Subject: [PATCH] ci(pip-audit): audit on Python 3.13 instead of ignoring filelock CVEs The audit env ran Python 3.10, which can't install filelock 4.2+, so every new filelock CVE in pip-audit's own CacheControl dependency broke the job and had to be ignored by ID (11 more landed today). Audit on 3.13, which matches the bot's runtime on LXC 151 (Debian trixie), so the fixed filelock installs and the per-CVE ignores can go. Also scan discord-bridge/ for secrets. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5 --- .gitea/workflows/lint.yml | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml index 666bee6..bd05f48 100644 --- a/.gitea/workflows/lint.yml +++ b/.gitea/workflows/lint.yml @@ -82,28 +82,21 @@ jobs: steps: - uses: actions/checkout@v3 - - name: Install Python 3.10 and pip-audit + - name: Install Python 3.13 and pip-audit run: | - # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary - curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \ + # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary. + # 3.13 matches the bot's runtime on LXC 151 (Debian trixie). + curl -sSL "https://github.com/astral-sh/python-build-standalone/releases/download/20250317/cpython-3.13.2+20250317-x86_64-unknown-linux-gnu-install_only.tar.gz" \ | tar -xz -C /opt # Install bot deps + pip-audit into the same env; --local below avoids # pip-audit creating an internal venv (ensurepip fails on standalone builds) /opt/python/bin/pip install --upgrade pip setuptools - /opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt + /opt/python/bin/pip install --upgrade pip-audit -r matrixbot/requirements.txt - name: Audit matrixbot dependencies # --local scans the env without spawning a venv (required for standalone Python) # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly. - # The filelock CVEs (fixed in 4.2.1) are in pip-audit's own dependency - # (CacheControl[filecache]); the bot doesn't use filelock, and 4.2+ - # needs Python 3.11, which this 3.10 audit env can't install. - run: >- - /opt/python/bin/pip-audit --local - --ignore-vuln CVE-2026-3219 - --ignore-vuln CVE-2026-112906 --ignore-vuln CVE-2026-112907 - --ignore-vuln CVE-2026-112913 --ignore-vuln CVE-2026-112914 - --ignore-vuln CVE-2026-112937 --ignore-vuln CVE-2026-112940 + run: /opt/python/bin/pip-audit --local --ignore-vuln CVE-2026-3219 secret-scan: name: Secret scan (gitleaks) @@ -124,7 +117,7 @@ jobs: run: | # Scan application code directories — deploy/ is excluded because # it contains intentional Gitea webhook HMAC secrets in hooks-lxc*.json - for dir in matrixbot/ hookshot/ .gitea/ systemd/ cinny/ landing/; do + for dir in matrixbot/ hookshot/ .gitea/ systemd/ cinny/ landing/ discord-bridge/; do [ -d "$dir" ] || continue gitleaks detect --source "$dir" --no-git --config .gitleaks.toml \ --redact --exit-code 1