jared 8effb24761 ci: fix pip-audit — restore --local, explicitly ignore pip's own CVE ...

-r requirements.txt causes pip-audit to spawn an internal venv which
calls ensurepip, failing with exit 127 on the standalone Python build.
--local avoids the venv. CVE-2026-3219 is in pip itself (not our deps)
so we ignore it explicitly with --ignore-vuln.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-26 15:46:16 -04:00

..

workflows

ci: fix pip-audit — restore --local, explicitly ignore pip's own CVE

2026-04-26 15:46:16 -04:00