LotusGuild/matrix
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

ci: upgrade pip+setuptools before audit to clear bundled CVEs
Lint / Shell (shellcheck) (push) Successful in 9s
Details
Lint / JS (eslint) (push) Successful in 6s
Details
Lint / Python (ruff) (push) Successful in 4s
Details
Lint / Python deps (pip-audit) (push) Successful in 48s
Details
Lint / Secret scan (gitleaks) (push) Successful in 8s
Details

Browse Source 
The python-build-standalone tarball ships pip 24.1.2 and setuptools
70.3.0 which have known CVEs. Upgrade them first so --local audit
only sees current, patched versions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Jared Vititoe
2026-04-21 14:06:01 -04:00
parent f6ce517a69
commit dcb38618a7
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/lint.yml
+3 -1
View File
@@ -60,9 +60,11 @@ jobs:
# Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary
curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \ curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \
| tar -xz -C /opt | tar -xz -C /opt
# Install pip-audit + the bot's requirements into the same env. # Upgrade pip+setuptools first (standalone build ships old versions with CVEs),
# then install pip-audit + the bot's requirements into the same env.
# Using --local avoids pip-audit creating an internal venv (which fails # Using --local avoids pip-audit creating an internal venv (which fails
# with ensurepip exit 127 on this standalone build). # with ensurepip exit 127 on this standalone build).
/opt/python/bin/pip install --upgrade pip setuptools
/opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt /opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt
- name: Audit matrixbot dependencies - name: Audit matrixbot dependencies