Switch CI dependency scanning to grype and clean pixi.lock diffs - #89
Merged
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
peterfpeterson
left a comment
peterfpeterson
left a comment
Member
There was a problem hiding this comment.
Please add the results of pixi diff into pixi-diff-to-markdown into the PR description
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Short description of the changes:
Switches CI dependency scanning over to grype (following the neutrons template repo) so that newly disclosed CVEs in transitive build/dev tooling no longer hard-fail the pipeline, refreshes
pixi.lockto clear the current backlog ofpip-auditfindings, and markspixi.lockas non-diffable so its changesets stay clean on GitHub.Long description of the changes:
The
pip-audit"Dependency check" step fails the build any time a new vulnerability lands in a transitive dependency (even in dev/build-only tooling like twine, pip, or pillow), which has been intermittently breakingmainand the bot PRs. This mirrors what Daniel did inpyoncatqtand what the python_project_template now does: add grype as the forward-looking scanner while keepingpip-auditas-is.Changes:
.github/workflows/test_and_deploy.yml— ported thepackagejob to the template pattern:permissions:block withsecurity-events: writeso grype can upload its SARIF results to GitHub code scanning (Security tab).neutrons/conda-verify@mainwithneutrons/gh-actions/pkg-install+pkg-verify, which install/verify the built conda package and expose the environment path grype needs.neutrons/gh-actions/grypescan of the installed environment. It runs withfail-build: false, so vulnerabilities are surfaced and tracked in the Security tab without failing the build.pip-audit"Dependency check" step in the tests job (unchanged).pixi.lock— regenerated withpixi updateso the currentpip-auditfindings are resolved and the builds go green again. (audit-depsnow reports "No known vulnerabilities found".).gitattributes— added-diffto thepixi.lockline so GitHub treats it as binary; this keeps lockfile updates from producing enormous, unreviewable diffs.This is intended as a precursor PR: once merged, the bot PRs (#83, #87) can be rebased onto a green
mainand merged.Lockfile changes
Generated with
pixi update --dry-run --json | pixi exec pixi-diff-to-markdown(diff ofmain'spixi.lockvs. this branch). Since this branch is based onmain, the diff still includesplot-publisher/plotly; those are removed separately in #88.pixi update — dependency changes
default
osx-arm64
linux-64
Check list for the pull request
Check list for the reviewer
Manual test for the reviewer
packagejob now runsInstall built conda package→Verify conda package→Scan installed environment with Grype.pixi.lockrenders as a binary/collapsed file in the GitHub diff view (thanks to the-diffattribute).References
Footnotes
Bold means explicit dependency. ↩ ↩2