Skip to content

Conversation

@CasperWA
Copy link
Contributor

@CasperWA CasperWA commented Oct 1, 2025

Description

This is something I missed to update in the recently merged PR for updating dependencies (#411).

AI summary

This pull request updates the project's dependency management and CI workflow to improve security auditing and dependency handling. The main changes include configuring Dependabot to monitor additional directories, updating CI requirements, and enhancing the pip-audit step in the workflow.

Dependency management improvements:

  • Updated .github/dependabot.yml to monitor both the root directory and .github/utils for Python dependencies, ensuring that all relevant requirements files are kept up to date.
  • Added pip-tools==7.5.0 to .github/utils/requirements_ci.txt to support deterministic dependency compilation in CI.

CI workflow enhancements:

  • Modified the ci_tests.yml workflow to install dependencies from .github/utils/requirements_ci.txt instead of using editable installs, and added a step to generate a complete requirements file for pip-audit using pip-compile.
  • Updated the pip-audit step to use the generated requirements file as input, improving the accuracy and coverage of dependency vulnerability checks.

Type of change

  • Bug fix.
  • New feature.
  • Documentation update.

Checklist for the reviewer

This checklist should be used as a help for the reviewer.

  • Is the change limited to one issue?
  • Does this PR close the issue?
  • Is the code easy to read and understand?
  • Do all new feature have an accompanying new test?
  • Has the documentation been updated as necessary?

@CasperWA CasperWA requested a review from Copilot October 1, 2025 08:01
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR enhances dependency management and CI workflow security by configuring pip-audit to analyze a comprehensive requirements file and improving Dependabot monitoring coverage.

  • Replaces editable package installs with requirements-based installation in CI
  • Implements pip-compile to generate a complete requirements file for pip-audit analysis
  • Expands Dependabot monitoring to include .github/utils directory

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
.github/workflows/ci_tests.yml Updates CI to use requirements file installation and adds pip-compile step for comprehensive pip-audit analysis
.github/utils/requirements_ci.txt Introduces pip-tools dependency for CI requirements compilation
.github/dependabot.yml Expands Dependabot monitoring to cover additional Python dependency directories

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@CasperWA CasperWA requested a review from Treesarj October 1, 2025 08:02
@CasperWA CasperWA merged commit 8e2efe0 into master Oct 1, 2025
8 checks passed
@CasperWA CasperWA deleted the cwa/update-pip-audit-for-generated-repo branch October 1, 2025 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants