From 6fb7cca57b96d816219eb5032996f0fabd9aa519 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Fri, 17 Jun 2022 15:23:42 -0400 Subject: [PATCH] Add a `pip-audit` workflow --- .github/workflows/pip-audit.yml | 37 +++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .github/workflows/pip-audit.yml diff --git a/.github/workflows/pip-audit.yml b/.github/workflows/pip-audit.yml new file mode 100644 index 0000000..3d3c1ac --- /dev/null +++ b/.github/workflows/pip-audit.yml @@ -0,0 +1,37 @@ +name: Scan dependencies for vulnerabilities with pip-audit + +on: + push: + branches: [ "master" ] + pull_request: + branches: [ "master" ] + schedule: + - cron: "0 12 * * *" + +jobs: + pip-audit: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + - name: Install Python + uses: actions/setup-python@v4 + with: + python-version: "3.x" + + - name: Install project + run: | + python -m venv /tmp/pip-audit-env + source /tmp/pip-audit-env/bin/activate + + python -m pip install --upgrade pip + python -m pip install . + + + - name: Run pip-audit + uses: trailofbits/gh-action-pip-audit@v0.0.4 + with: + virtual-environment: /tmp/pip-audit-env +