Repository navigation
fix(dependency-audit): pin pip-audit Python to 3.13 instead of floating 3.x - #1431
Conversation
…ng 3.x setup-python "3.x" now resolves to 3.15, which removed sre_constants. The hash-locked tooling pins pip-api 0.0.34, whose vendored pyparsing imports it, so pip-audit crashes for every caller. Pin a concrete minor via a new `python-version` input (default "3.13", same pattern as agent-shield's `agentshield-version`) and add a bats test that rejects a floating version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
dev-lead is withholding action on this item. It is labeled To re-enable automated pickup: remove the |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-30T03:41:41Z. |
|
Problem
dependency-audit-reusable.ymlset up Python withpython-version: "3.x", which now resolves to 3.15. 3.15 removedsre_constants;pip-api==0.0.34(pinned in this repo's own hash-lockedscripts/pip-audit-requirements.txt, and in some consumer repos) ships a vendored pyparsing that imports it, sopip-auditcrashes:Seen on main in combsmith/broodminder-data, probably in combsmith/empower-personal-dashboard too (not verified).
Change
workflow_callinputpython-version, default"3.13". It follows the pattern ofagentshield-versioninagent-shield-reusable.yml, so a caller can override it. The singlesetup-pythonstep (audit-pip) now uses it.test/workflows/dependency-audit/: the input default must be a concrete3.N, and everysetup-pythonstep must use the input. I checked that the test fails against the old"3.x".scripts/pip-audit-requirements.txtresolve for cp313 / manylinux x86_64 with--only-binary :all: --require-hashes.Rollout
This reaches callers only after the
dependency-auditchannel is promoted (standards/workflows/dependency-audit.ymlpins@dependency-audit/v2-stable; latest release isdependency-audit/v2.9.0). No tags were moved here.Other floating-Python spots (out of scope, not changed)
standards/ci-standards.md§"Python" CI example usespython-version: '3.x'. It's a generic per-repo CI template, not audit tooling. It has no consumers right now ("Repos using this pattern: none").standards/workflows/copilot-setup-steps.ymlonly has a commented-out example that's already pinned ("3.12"). Fine as is.scripts/pip-audit-requirements.txtstill pinspip-api==0.0.34. With Python pinned it's harmless, but bumping to 0.0.35 (as fix(deps): bump pip-api to 0.0.35 so pip-audit runs on Python 3.15 broodminder-data#236 does) would remove the 3.15 incompatibility itself. Left for a separate PR to keep this diff small.🤖 Generated with Claude Code