53 lines
1.3 KiB
Bash
53 lines
1.3 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
OUTPUT_DIR="${1:-artifacts}"
|
|
if [ -n "${PYTHON_BIN:-}" ]; then
|
|
PYTHON_CMD="$PYTHON_BIN"
|
|
else
|
|
PYTHON_CMD=""
|
|
for candidate in python3 python.exe python; do
|
|
if command -v "$candidate" >/dev/null 2>&1 &&
|
|
"$candidate" -c "import pip_audit" >/dev/null 2>&1; then
|
|
PYTHON_CMD="$candidate"
|
|
break
|
|
fi
|
|
done
|
|
fi
|
|
if [ -z "$PYTHON_CMD" ]; then
|
|
echo "No Python interpreter available for pip-audit." >&2
|
|
exit 1
|
|
fi
|
|
cd "$ROOT"
|
|
mkdir -p "$OUTPUT_DIR"
|
|
|
|
"$PYTHON_CMD" scripts/verify_security_exceptions.py
|
|
mapfile -t ignored_ids < <(
|
|
"$PYTHON_CMD" scripts/verify_security_exceptions.py --print-ids | tr -d '\r'
|
|
)
|
|
|
|
common_args=(
|
|
-r backend/requirements-ci.lock
|
|
--no-deps
|
|
--disable-pip
|
|
--progress-spinner off
|
|
--format json
|
|
)
|
|
|
|
# Preserve the unfiltered evidence even when known time-boxed exceptions exist.
|
|
"$PYTHON_CMD" -m pip_audit \
|
|
"${common_args[@]}" \
|
|
--output "$OUTPUT_DIR/pip-audit-full.json" || true
|
|
|
|
policy_args=()
|
|
for advisory_id in "${ignored_ids[@]}"; do
|
|
policy_args+=(--ignore-vuln "$advisory_id")
|
|
done
|
|
"$PYTHON_CMD" -m pip_audit \
|
|
"${common_args[@]}" \
|
|
"${policy_args[@]}" \
|
|
--output "$OUTPUT_DIR/pip-audit-policy.json"
|
|
|
|
echo "Python dependency audit policy passed."
|