LotusGuild/matrix
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci(pip-audit): audit on Python 3.13 instead of ignoring filelock CVEs #45

Merged
jared merged 1 commits from ci/pip-audit-py313 into main 2026-10-28 21:21:38 -04:00
Conversation 0 Commits 1 Files Changed 1
+7 -14
1 changed files with 7 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/lint.yml
+7 -14
View File
@@ -82,28 +82,21 @@ jobs:
steps: steps:
- uses: actions/checkout@v3 - uses: actions/checkout@v3
- name: Install Python 3.10 and pip-audit - name: Install Python 3.13 and pip-audit
run: | run: |
# Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary.
curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \ # 3.13 matches the bot's runtime on LXC 151 (Debian trixie).
curl -sSL "https://github.com/astral-sh/python-build-standalone/releases/download/20250317/cpython-3.13.2+20250317-x86_64-unknown-linux-gnu-install_only.tar.gz" \
| tar -xz -C /opt | tar -xz -C /opt
# Install bot deps + pip-audit into the same env; --local below avoids # Install bot deps + pip-audit into the same env; --local below avoids
# pip-audit creating an internal venv (ensurepip fails on standalone builds) # pip-audit creating an internal venv (ensurepip fails on standalone builds)
/opt/python/bin/pip install --upgrade pip setuptools /opt/python/bin/pip install --upgrade pip setuptools
/opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt /opt/python/bin/pip install --upgrade pip-audit -r matrixbot/requirements.txt
- name: Audit matrixbot dependencies - name: Audit matrixbot dependencies
# --local scans the env without spawning a venv (required for standalone Python) # --local scans the env without spawning a venv (required for standalone Python)
# CVE-2026-3219 is in pip itself, not our code — ignore it explicitly. # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly.
# The filelock CVEs (fixed in 4.2.1) are in pip-audit's own dependency run: /opt/python/bin/pip-audit --local --ignore-vuln CVE-2026-3219
# (CacheControl[filecache]); the bot doesn't use filelock, and 4.2+
# needs Python 3.11, which this 3.10 audit env can't install.
run: >-
/opt/python/bin/pip-audit --local
--ignore-vuln CVE-2026-3219
--ignore-vuln CVE-2026-112906 --ignore-vuln CVE-2026-112907
--ignore-vuln CVE-2026-112913 --ignore-vuln CVE-2026-112914
--ignore-vuln CVE-2026-112937 --ignore-vuln CVE-2026-112940
secret-scan: secret-scan:
name: Secret scan (gitleaks) name: Secret scan (gitleaks)
@@ -124,7 +117,7 @@ jobs:
run: | run: |
# Scan application code directories — deploy/ is excluded because # Scan application code directories — deploy/ is excluded because
# it contains intentional Gitea webhook HMAC secrets in hooks-lxc*.json # it contains intentional Gitea webhook HMAC secrets in hooks-lxc*.json
for dir in matrixbot/ hookshot/ .gitea/ systemd/ cinny/ landing/; do for dir in matrixbot/ hookshot/ .gitea/ systemd/ cinny/ landing/ discord-bridge/; do
[ -d "$dir" ] || continue [ -d "$dir" ] || continue
gitleaks detect --source "$dir" --no-git --config .gitleaks.toml \ gitleaks detect --source "$dir" --no-git --config .gitleaks.toml \
--redact --exit-code 1 --redact --exit-code 1