pip_audit.yml

name: wisdom-service - pip-audit

on:
  push:
    # tags:
    #   - v*
    branches:
      - main
    paths:
      - .github/workflows/pip_audit.yml
      - ansible_ai_connect/**
      - pyproject.toml
      - requirements*.txt
  pull_request:
    branches:
      - main
    paths:
      - .github/workflows/pip_audit.yml
      - ansible_ai_connect/**
      - pyproject.toml
      - requirements*.txt
permissions:
  contents: read

jobs:
  selftest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: 3.11
      - name: install
        run: |
          python -m venv env/
          source env/bin/activate
          python -m pip install . -rrequirements.txt
          # See: https://github.com/advisories/GHSA-r9hx-vwmv-q579
          pip install --upgrade setuptools
      - name: Create CA symlink to use RH's certifi on ubuntu-latest
        run: |
          sudo mkdir -p /etc/pki/tls/certs
          sudo ln -s /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt
      - uses: pypa/gh-action-pip-audit@v1.0.8
        with:
          virtual-environment: env/
          ignore-vulns: |
            GHSA-g7vv-2v7x-gj9p