selftest.yml

name: Self-test

on:
  push:
    branches:
      - main
  pull_request:
  workflow_dispatch:

jobs:
  selftest-requirements:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: ./
        id: pip-audit
        with:
          inputs: ./test/vulnerable.txt
          no-deps: true
          # NOTE: We intentionally allow failure here, since the self-test
          # explicitly uses a vulnerable requirements file.
          internal-be-careful-allow-failure: true
      - name: assert expected output
        env:
          PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.summary-output-base64 }}"
        run: |
          grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")

  selftest-environment:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: make the environment vulnerable
        run: |
          python -m pip install --no-deps --requirement ./test/vulnerable.txt
      - uses: ./
        id: pip-audit
        with:
          # NOTE: We intentionally allow failure here, since the self-test
          # explicitly uses a vulnerable requirements file.
          internal-be-careful-allow-failure: true
      - name: assert expected output
        env:
          PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.summary-output-base64 }}"
        run: |
          grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")

  selftest-virtualenv:
    strategy:
      matrix:
        local: [true, false]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: make a virtual environment vulnerable
        run: |
          python -m venv env
          ./env/bin/python -m pip install --upgrade pip wheel
          ./env/bin/python -m pip install --no-deps --requirement ./test/vulnerable.txt
      - uses: ./
        id: pip-audit
        with:
          virtual-environment: env/
          local: ${{ matrix.local }}
          # NOTE: We intentionally allow failure here, since the self-test
          # explicitly uses a vulnerable requirements file.
          internal-be-careful-allow-failure: true
      - name: assert expected output
        env:
          PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.summary-output-base64 }}"
        run: |
          grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")

  selftest-pyproject:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: ./
        id: pip-audit
        with:
          # should attempt to discover test/pyproject/pyproject.toml
          inputs: test/pyproject/
          # NOTE: We intentionally allow failure here, since the self-test
          # explicitly uses a vulnerable requirements file.
          internal-be-careful-allow-failure: true
      - name: assert expected output
        env:
          PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.summary-output-base64 }}"
        run: |
          grep -E 'pyyaml\s+\|\s+5.1' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")

  selftest-pipaudit-fail:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: ./
        id: pip-audit
        with:
          # we do not care about pip-audit's actual output in this test, we just need a file to pass
          # in so as to not exercise `pip list` mode.
          inputs: ./test/empty.txt
          # pass in a fake flag here to reliably trigger the failure we're looking for.
          internal-be-careful-extra-flags: --not-a-real-pip-audit-flag
          internal-be-careful-allow-failure: true
      - name: assert expected output
        env:
          PIP_AUDIT_OUTPUT: "${{ steps.pip-audit.outputs.summary-output-base64 }}"
        run: |
          grep 'pip-audit did not return any output' <<< $(base64 -d <<< "${PIP_AUDIT_OUTPUT}")