* feat(ci): add Python dependency scanning to OSV-Scanner workflow
Add lockfiles and scanning for Python dependencies in the initializers
and python_api. This extends the nightly OSV-Scanner workflow to cover
Python in addition to Go.
- Generate requirements-lock.txt files via pip-compile for:
- cmd/initializers/dataset/
- cmd/initializers/model/
- api/python_api/
- Add osv-scan-python job with SARIF scanning and auto-fix
- Add validate-lockfile.yaml to ensure lockfiles stay in sync on PRs
- Handle both direct and transitive dependency upgrades
Closes#3528
Signed-off-by: Fiona-Waters <[email protected]>
* fix(ci): address review feedback on Python OSV-Scanner workflow
- Fix validate-lockfile false positives by stripping header comments
before diffing (pip-compile embeds output filename in header)
- Regenerate lockfiles in clean Python 3.12 venv with --strip-extras
to include all transitive deps and silence pip-tools deprecation warning
- Fix PR body table formatting: use Markdown table rows instead of
bullet items in both Go and Python auto-fix jobs
- Escape dots in package names for grep/sed regex safety
Signed-off-by: Fiona-Waters <[email protected]>
* fix(ci): address review feedback on OSV-Scanner Python workflow
- Replace shell grep/sed with Python helper script using
packaging.requirements.Requirement for exact name matching,
fixing prefix collision (requests vs requests-oauthlib),
constraint dropping, and extras stripping
- Skip entry when package not found in lockfile after pip-compile
instead of recording a false version
- Bump actions/setup-python from v5 to v6 for consistency
Signed-off-by: Fiona-Waters <[email protected]>
* fix(ci): pin pip-tools version in CI workflows
Pin pip-tools to 7.4.1 in osv-scanner and validate-lockfile workflows
to mitigate supply-chain risk in workflows with elevated permissions.
Signed-off-by: Fiona-Waters <[email protected]>
* fix(deps): update lockfiles for certifi 2026.5.20
Signed-off-by: Fiona-Waters <[email protected]>
---------
Signed-off-by: Fiona-Waters <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
