Skip to content

fix(deps): lock the releases that fix the open advisories and audit against PyPI and OSV #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mahdi-shafiei merged 2 commits into from
Oct 27, 2026
Merged

fix(deps): lock the releases that fix the open advisories and audit against PyPI and OSV #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9229fb3
fix(deps): lock the releases that fix the open advisories
mahdi-shafiei Oct 27, 2026
6474583
ci: audit the lock against both PyPI and OSV
mahdi-shafiei Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,11 @@ jobs:
linux-editable-target: ".[dev]"

# Every extra the lock resolves, in groups that respect [tool.uv] conflicts, each audited
# by a pinned pip-audit with a fresh advisory cache. Ignored advisories and their reasons
# live in [tool.substrax.audit-lock.ignore] in pyproject.toml; the action also fails on an
# ignore that no advisory matches any more.
# by a pinned pip-audit against both its PyPI and OSV services with a fresh advisory cache.
# Ignored advisories and their reasons live in [tool.substrax.audit-lock.ignore] in
# pyproject.toml; the action also fails on an ignore that no advisory matches any more.
- name: Audit the locked dependencies
uses: avitai/substrax/.github/actions/audit-lock@13e98b78127606be04437bd7c5de894fb765a28e
uses: avitai/substrax/.github/actions/audit-lock@e889be4e9fb55fe9c272e219277524630bf9d39e

# Runs after a failed audit too, so one run reports both scans; either failure fails the job.
- name: Bandit
Expand Down
Loading
Loading