[AUTO-INF-5] CI missing dependency vulnerability scanning — no pip-audit or safety checks for CVEs #10333

New issue

Open

opened 2026-04-18 08:48:32 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-18 08:48:32 +00:00

Owner

Metadata

Commit message: feat(ci): add dependency vulnerability scanning job to ci.yml
Branch name: feat/auto-inf-5-add-dependency-scanning

Background and Context

The CI pipeline in .forgejo/workflows/ci.yml includes a security job that runs security_scan and dead_code detection via nox, but there is no explicit job for scanning Python dependencies for known vulnerabilities (CVEs).

Current security job coverage:

nox -s security_scan - Runs code security scanning (likely bandit or similar)
nox -s dead_code - Detects unused code
Missing: Dependency vulnerability scanning (pip-audit, safety, or similar)

Why this matters:

Dependencies may have known CVEs that are not caught by code-level security scanning
The uv lock file may contain vulnerable versions of transitive dependencies
Issue #10259 already identified that CI is missing uv lock --check gate for stale lockfiles
A complete security posture requires both code scanning AND dependency scanning

Expected Behavior

Add a new CI job or extend the existing security job to include dependency vulnerability scanning:

Option A: Extend existing security job

security:
    runs-on: docker
    steps:
        # ... existing steps ...
        - name: Run dependency vulnerability scan via pip-audit
          run: |
              pip install pip-audit
              pip-audit --desc --fix-available
        # ... or use safety ...
        - name: Run dependency vulnerability scan via safety
          run: |
              pip install safety
              safety check --json

Option B: Create dedicated dependency-scan job

dependency-scan:
    runs-on: docker
    needs: [lint, typecheck]  # Fast checks first
    steps:
        - uses: actions/checkout@v4
        - name: Install pip-audit
          run: pip install pip-audit
        - name: Scan dependencies for CVEs
          run: pip-audit --desc --fix-available

Acceptance Criteria

CI pipeline includes dependency vulnerability scanning (pip-audit, safety, or equivalent)
Scanning is performed on the locked dependency set (from uv.lock)
Known CVEs in dependencies cause the CI run to fail
The scan output is clear and actionable (includes CVE IDs, severity, remediation)
The job is integrated into the quality gate chain (e.g., status-check depends on it)
Documentation is updated to explain the dependency scanning process
All existing CI jobs continue to function correctly

Subtasks

Decide between extending security job or creating new dependency-scan job
Choose scanning tool (pip-audit recommended for uv compatibility, or safety)
Implement the scanning step in .forgejo/workflows/ci.yml
Add appropriate needs dependencies to ensure fast checks run first
Update status-check job to include the new scanning job in its needs list
Test the implementation by introducing a known vulnerable dependency and verifying CI fails
Document the dependency scanning process in docs/development/ci-cd.md
Run full nox to verify no regressions

Definition of Done

This issue should be closed when:

Dependency vulnerability scanning is implemented in the CI pipeline
The scanning job is integrated into the quality gate chain
A test run with a known vulnerable dependency provably fails the CI
The fix is merged to the main branch via a PR that passes all required CI checks
Documentation is updated

Duplicate Check

Check	Query / Source	Result
Check 1	Open issues searched for `dependency scan`, `vulnerability scan`, `pip-audit`, `safety`	Found #10259 about `uv lock --check` but NOT about dependency vulnerability scanning
Check 2	Closed issues searched for same keywords	No matches found
Check 3	Cross-area: #10259 "CI missing uv lock --check gate"	Addresses stale lockfile detection, NOT vulnerability scanning
Check 4	Cross-area: #10240 "build and helm CI jobs have no needs dependencies"	Does not mention dependency scanning
Check 5	Cross-area: #9783 "Reduce CI execution time"	Does not mention dependency scanning

Conclusion: No duplicate found. This is a genuinely new, specific, actionable finding.

Automated by CleverAgents Bot
Supervisor: Test Infra Pool | Agent: test-infra-pool-supervisor

## Metadata - **Commit message:** `feat(ci): add dependency vulnerability scanning job to ci.yml` - **Branch name:** `feat/auto-inf-5-add-dependency-scanning` ## Background and Context The CI pipeline in `.forgejo/workflows/ci.yml` includes a `security` job that runs `security_scan` and `dead_code` detection via nox, but there is no explicit job for scanning Python dependencies for known vulnerabilities (CVEs). **Current security job coverage:** - `nox -s security_scan` - Runs code security scanning (likely bandit or similar) - `nox -s dead_code` - Detects unused code - Missing: Dependency vulnerability scanning (pip-audit, safety, or similar) **Why this matters:** - Dependencies may have known CVEs that are not caught by code-level security scanning - The `uv lock` file may contain vulnerable versions of transitive dependencies - Issue #10259 already identified that CI is missing `uv lock --check` gate for stale lockfiles - A complete security posture requires both code scanning AND dependency scanning ## Expected Behavior Add a new CI job or extend the existing `security` job to include dependency vulnerability scanning: **Option A: Extend existing security job** ```yaml security: runs-on: docker steps: # ... existing steps ... - name: Run dependency vulnerability scan via pip-audit run: | pip install pip-audit pip-audit --desc --fix-available # ... or use safety ... - name: Run dependency vulnerability scan via safety run: | pip install safety safety check --json ``` **Option B: Create dedicated dependency-scan job** ```yaml dependency-scan: runs-on: docker needs: [lint, typecheck] # Fast checks first steps: - uses: actions/checkout@v4 - name: Install pip-audit run: pip install pip-audit - name: Scan dependencies for CVEs run: pip-audit --desc --fix-available ``` ## Acceptance Criteria - [ ] CI pipeline includes dependency vulnerability scanning (pip-audit, safety, or equivalent) - [ ] Scanning is performed on the locked dependency set (from `uv.lock`) - [ ] Known CVEs in dependencies cause the CI run to fail - [ ] The scan output is clear and actionable (includes CVE IDs, severity, remediation) - [ ] The job is integrated into the quality gate chain (e.g., `status-check` depends on it) - [ ] Documentation is updated to explain the dependency scanning process - [ ] All existing CI jobs continue to function correctly ## Subtasks - [ ] Decide between extending `security` job or creating new `dependency-scan` job - [ ] Choose scanning tool (pip-audit recommended for uv compatibility, or safety) - [ ] Implement the scanning step in `.forgejo/workflows/ci.yml` - [ ] Add appropriate `needs` dependencies to ensure fast checks run first - [ ] Update `status-check` job to include the new scanning job in its `needs` list - [ ] Test the implementation by introducing a known vulnerable dependency and verifying CI fails - [ ] Document the dependency scanning process in `docs/development/ci-cd.md` - [ ] Run full `nox` to verify no regressions ## Definition of Done This issue should be closed when: 1. Dependency vulnerability scanning is implemented in the CI pipeline 2. The scanning job is integrated into the quality gate chain 3. A test run with a known vulnerable dependency provably fails the CI 4. The fix is merged to the main branch via a PR that passes all required CI checks 5. Documentation is updated ### Duplicate Check | Check | Query / Source | Result | |-------|---------------|--------| | Check 1 | Open issues searched for `dependency scan`, `vulnerability scan`, `pip-audit`, `safety` | Found #10259 about `uv lock --check` but NOT about dependency vulnerability scanning | | Check 2 | Closed issues searched for same keywords | No matches found | | Check 3 | Cross-area: #10259 "CI missing uv lock --check gate" | Addresses stale lockfile detection, NOT vulnerability scanning | | Check 4 | Cross-area: #10240 "build and helm CI jobs have no needs dependencies" | Does not mention dependency scanning | | Check 5 | Cross-area: #9783 "Reduce CI execution time" | Does not mention dependency scanning | **Conclusion:** No duplicate found. This is a genuinely new, specific, actionable finding. --- **Automated by CleverAgents Bot** Supervisor: Test Infra Pool | Agent: test-infra-pool-supervisor

HAL9000 referenced this issue

2026-04-18 08:57:24 +00:00

[AUTO-INF-POOL] Status: Test Infrastructure Analysis (Cycle 1) #10348

HAL9000 referenced this issue

2026-04-18 09:20:39 +00:00

[AUTO-INF-POOL] Status: Test Infrastructure Analysis (Cycle 1) #10348

HAL9000 referenced this issue

2026-04-18 10:00:24 +00:00

[AUTO-INF-POOL] Cycle 3 Status — Test Infrastructure Analysis Complete #10469