Merge pull request 'ci(pip-audit): audit on Python 3.13 instead of ignoring filelock CVEs' (#45) from ci/pip-audit-py313 into main

.gitea/workflows/lint.yml

@@ -82,28 +82,21 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - name: Install Python 3.10 and pip-audit
+      - name: Install Python 3.13 and pip-audit
         run: |
-          # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary
-          curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \
+          # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary.
+          # 3.13 matches the bot's runtime on LXC 151 (Debian trixie).
+          curl -sSL "https://github.com/astral-sh/python-build-standalone/releases/download/20250317/cpython-3.13.2+20250317-x86_64-unknown-linux-gnu-install_only.tar.gz" \
             | tar -xz -C /opt
           # Install bot deps + pip-audit into the same env; --local below avoids
           # pip-audit creating an internal venv (ensurepip fails on standalone builds)
           /opt/python/bin/pip install --upgrade pip setuptools
-          /opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt
+          /opt/python/bin/pip install --upgrade pip-audit -r matrixbot/requirements.txt
 
       - name: Audit matrixbot dependencies
         # --local scans the env without spawning a venv (required for standalone Python)
         # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly.
-        # The filelock CVEs (fixed in 4.2.1) are in pip-audit's own dependency
-        # (CacheControl[filecache]); the bot doesn't use filelock, and 4.2+
-        # needs Python 3.11, which this 3.10 audit env can't install.
-        run: >-
-          /opt/python/bin/pip-audit --local
-          --ignore-vuln CVE-2026-3219
-          --ignore-vuln CVE-2026-112906 --ignore-vuln CVE-2026-112907
-          --ignore-vuln CVE-2026-112913 --ignore-vuln CVE-2026-112914
-          --ignore-vuln CVE-2026-112937 --ignore-vuln CVE-2026-112940
+        run: /opt/python/bin/pip-audit --local --ignore-vuln CVE-2026-3219
 
   secret-scan:
     name: Secret scan (gitleaks)
@@ -124,7 +117,7 @@ jobs:
         run: |
           # Scan application code directories — deploy/ is excluded because
           # it contains intentional Gitea webhook HMAC secrets in hooks-lxc*.json
-          for dir in matrixbot/ hookshot/ .gitea/ systemd/ cinny/ landing/; do
+          for dir in matrixbot/ hookshot/ .gitea/ systemd/ cinny/ landing/ discord-bridge/; do
             [ -d "$dir" ] || continue
             gitleaks detect --source "$dir" --no-git --config .gitleaks.toml \
               --redact --exit-code 1