Update generate CI workflow for pip-audit #412
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This is something I missed to update in the recently merged PR for updating dependencies (#411).
AI summary
This pull request updates the project's dependency management and CI workflow to improve security auditing and dependency handling. The main changes include configuring Dependabot to monitor additional directories, updating CI requirements, and enhancing the pip-audit step in the workflow.
Dependency management improvements:
.github/dependabot.ymlto monitor both the root directory and.github/utilsfor Python dependencies, ensuring that all relevant requirements files are kept up to date.pip-tools==7.5.0to.github/utils/requirements_ci.txtto support deterministic dependency compilation in CI.CI workflow enhancements:
ci_tests.ymlworkflow to install dependencies from.github/utils/requirements_ci.txtinstead of using editable installs, and added a step to generate a complete requirements file for pip-audit usingpip-compile.Type of change
Checklist for the reviewer
This checklist should be used as a help for the reviewer.