From 534740c640bf4cb7f41f9d45950636ece0365a93 Mon Sep 17 00:00:00 2001 From: Andy Griesbeck Date: Tue, 28 Apr 2026 16:46:04 +0200 Subject: [PATCH] ci: add --disable-pip --no-deps --skip-editable to pip-audit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release-on-tag workflow runs on the hetzner runner image, which does not ship python3.12-venv. Without --disable-pip, pip-audit tries to spin up an internal venv to resolve the requirements file and crashes with: 'The virtual environment was not created successfully because ensurepip is not available.' The CI workflow runs on ubuntu-latest (which has venv) so it never hit this. Adding the flags so the audit works on every runner — the exported requirements are already pinned, so pip-audit doesn't need to resolve anything; it just looks each package up in the OSV database. Same flags the worker SDK already uses for the same reason. --- Makefile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 6f7064b..5863c4c 100644 --- a/Makefile +++ b/Makefile @@ -27,7 +27,13 @@ audit: # `--no-dev` requirements first scopes the scan to what actually ships. # Use `make audit-dev` to scan the dev environment as well. uv export --no-dev --no-emit-project --format requirements-txt -o /tmp/neops-remote-lab-prod-reqs.txt - uv run pip-audit -r /tmp/neops-remote-lab-prod-reqs.txt \ + # `--disable-pip --no-deps --skip-editable` keeps pip-audit from + # trying to spin up an internal venv to resolve the requirements + # file. Runners without `python3.12-venv` (e.g. our hetzner image) + # fail without these flags. The exported requirements already pin + # every package, so resolution is unnecessary. + uv run pip-audit --disable-pip --no-deps --skip-editable \ + -r /tmp/neops-remote-lab-prod-reqs.txt \ --strict --progress-spinner=off --vulnerability-service osv audit-dev: