Close Pygments audit exception#195
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughSummary by CodeRabbit릴리스 노트
WalkthroughGitHub Actions SARIF 업로드 액션의 고정 커밋 SHA 업데이트, security-audit 워크플로우에서 pip-audit을 uv 환경에서 직접 실행하도록 간소화 및 Pygments 관련 CI 예외 제거, 문서 갱신 및 이를 검증하는 회귀 테스트 추가. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
시
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Review rate limit: 3/5 reviews remaining, refill in 18 minutes and 27 seconds. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/trivy.yml:
- Line 36: 현재 사용 중인 action pin
"github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225"이
v4.35.2 태그의 실제 SHA와 불일치합니다; 업데이트하려면 해당 action reference를 찾아
"github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225"를
v4.35.2 태그의 실제 SHA인 "7fc6561ed893d15cec696e062df840b21db27eb0"로 교체하거나(권장) 변경 이유를
주석으로 명확히 남겨 다른 SHA를 사용할 정당성을 문서화하세요.
In `@services/analysis-engine/tests/test_supply_chain_policy.py`:
- Around line 105-110: Replace the fragile substring assertions against the
uv.lock contents with a real TOML parse of the lockfile string (the
python_lockfile variable) and assert the parsed package entry for "pygments" has
version "2.20.0" and not "2.19.2"; implement by loading python_lockfile via a
TOML parser (tomllib for Python ≥3.11 or tomli as a fallback), navigate to the
packages table/list that contains package name/version entries, find the entry
where name == "pygments" and assert its version equals "2.20.0" and not "2.19.2"
(replace the current string membership checks for pygments with these parsed
checks).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: a9f93ba6-b37f-4bfe-ae5e-ae32226453ee
⛔ Files ignored due to path filters (1)
services/analysis-engine/uv.lockis excluded by!**/*.lock
📒 Files selected for processing (5)
.github/workflows/ossf-scorecard.yml.github/workflows/security-audit.yml.github/workflows/trivy.ymldocs/security/dependency-policy.mdservices/analysis-engine/tests/test_supply_chain_policy.py
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@services/analysis-engine/tests/test_supply_chain_policy.py`:
- Around line 5-7: The import block in test_supply_chain_policy.py is misordered
causing Ruff I001; reorder and group the imports per PEP8/Ruff: standard library
first (re, importlib), then third-party, then local, and sort alphabetically
within groups — specifically change the lines importing re, importlib, and Path
from pathlib so they follow alphabetical/grouped order (i.e., import importlib,
import re, from pathlib import Path or standard-library alphabetical order) to
resolve the I001 lint error.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 38ca91a9-2ef5-42c9-8498-f63f2297bea3
📒 Files selected for processing (3)
.github/workflows/ossf-scorecard.yml.github/workflows/trivy.ymlservices/analysis-engine/tests/test_supply_chain_policy.py
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@services/analysis-engine/tests/test_supply_chain_policy.py`:
- Around line 106-109: The test currently only checks dependency_policy for the
pip-audit flags, so add an assertion that verifies the workflow string also
contains the same flags to prevent false positives; specifically, in
services/analysis-engine/tests/test_supply_chain_policy.py update the test to
assert that the variable workflow includes "pip-audit --local --strict" (similar
to the existing check on dependency_policy) so the workflow and
dependency_policy are both validated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: a1552954-64ea-47bd-a790-a4cd0da063f1
📒 Files selected for processing (1)
services/analysis-engine/tests/test_supply_chain_policy.py
Owner
Author
|
@coderabbitai resolve |
✅ Actions performedComments resolved and changes approved. |
This was referenced May 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pygmentsto 2.20.0 and removes the staleGHSA-5239-wwwm-4pmqpip-audit exception.uvenvironment withpip-audit --local --strictto avoid resolver/ensurepip toolchain failures while keeping the strict gate.upload-sarifSHA pins intrivyandossf-scorecardtogithub/codeql-actionv4.35.2 while preserving immutable SHA pinning.Fixes part of #194.
Verification
uv run --project services/analysis-engine pytest services/analysis-engine/tests/test_supply_chain_policy.py -q→ 46 passedpython3 scripts/checks/verify_supply_chain.py→ passedpython3 scripts/checks/security_gates.py→ passedpython3 scripts/checks/verify_docs.py→ passeduv run --project services/analysis-engine --with pip-audit==2.8.0 pip-audit --local --strict→ No known vulnerabilities foundSecurity Notes