Parcourir la source

ci: upgrade setuptools in pip-audit jobs to clear PYSEC-2026-3447

The GitHub runner's Python toolcache ships setuptools 79.0.1, which
pip-audit flags for PYSEC-2026-3447 (fixed in 83.0.0), failing the
blocking Backend Security job. A fix version exists, so upgrade
setuptools in the install step rather than --ignore-vuln. Applied to
both ci.yml (blocking) and security.yml (scheduled scan).
maziggy il y a 1 mois
Parent
commit
dfdc1c67e6
2 fichiers modifiés avec 8 ajouts et 2 suppressions
  1. 4 1
      .github/workflows/ci.yml
  2. 4 1
      .github/workflows/security.yml

+ 4 - 1
.github/workflows/ci.yml

@@ -65,7 +65,10 @@ jobs:
 
 
       - name: Install dependencies
       - name: Install dependencies
         run: |
         run: |
-          python -m pip install --upgrade pip
+          # Upgrade setuptools too: the runner's Python toolcache ships an old
+          # setuptools that trips pip-audit (PYSEC-2026-3447, fixed in 83.0.0).
+          # A fix exists, so we upgrade rather than --ignore-vuln.
+          python -m pip install --upgrade pip setuptools
           pip install -r requirements.txt
           pip install -r requirements.txt
           pip install pip-audit
           pip install pip-audit
 
 

+ 4 - 1
.github/workflows/security.yml

@@ -125,7 +125,10 @@ jobs:
 
 
       - name: Install dependencies
       - name: Install dependencies
         run: |
         run: |
-          python -m pip install --upgrade pip
+          # Upgrade setuptools too: the runner's Python toolcache ships an old
+          # setuptools that trips pip-audit (PYSEC-2026-3447, fixed in 83.0.0).
+          # A fix exists, so we upgrade rather than --ignore-vuln.
+          python -m pip install --upgrade pip setuptools
           pip install -r requirements.txt
           pip install -r requirements.txt
           pip install pip-audit
           pip install pip-audit