{"id":22802493,"url":"https://github.com/pypa/gh-action-pip-audit","last_synced_at":"2025-04-05T04:14:27.536Z","repository":{"id":37068319,"uuid":"503119119","full_name":"pypa/gh-action-pip-audit","owner":"pypa","description":"A GitHub Action for pip-audit","archived":false,"fork":false,"pushed_at":"2025-01-06T22:18:27.000Z","size":98,"stargazers_count":73,"open_issues_count":3,"forks_count":12,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-03-29T03:11:20.163Z","etag":null,"topics":["github-actions","pip","security","supply-chain"],"latest_commit_sha":null,"homepage":"https://github.com/marketplace/actions/gh-action-pip-audit","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pypa.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-06-13T21:23:00.000Z","updated_at":"2025-02-02T09:54:24.000Z","dependencies_parsed_at":"2023-02-08T19:46:38.609Z","dependency_job_id":"aefbeb9f-eb1e-4872-8285-a48a71768b9b","html_url":"https://github.com/pypa/gh-action-pip-audit","commit_stats":{"total_commits":89,"total_committers":10,"mean_commits":8.9,"dds":0.1460674157303371,"last_synced_commit":"fee84f2320da9fa4626df0d32a61d964774fe842"},"previous_names":[],"tags_count":16,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pypa%2Fgh-action-pip-audit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pypa%2Fgh-action-pip-audit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pypa%2Fgh-action-pip-audit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pypa%2Fgh-action-pip-audit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pypa","download_url":"https://codeload.github.com/pypa/gh-action-pip-audit/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247284953,"owners_count":20913704,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["github-actions","pip","security","supply-chain"],"created_at":"2024-12-12T09:06:16.478Z","updated_at":"2025-04-05T04:14:27.511Z","avatar_url":"https://github.com/pypa.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"gh-action-pip-audit\n===================\n\n[![CI](https://github.com/pypa/gh-action-pip-audit/actions/workflows/ci.yml/badge.svg)](https://github.com/pypa/gh-action-pip-audit/actions/workflows/ci.yml)\n[![Self-test](https://github.com/pypa/gh-action-pip-audit/actions/workflows/selftest.yml/badge.svg)](https://github.com/pypa/gh-action-pip-audit/actions/workflows/selftest.yml)\n\nA GitHub Action that uses [`pip-audit`](https://github.com/pypa/pip-audit)\nto scan Python dependencies for known vulnerabilities.\n\nThis project is maintained in part by [Trail of Bits](https://www.trailofbits.com/)\nwith support from Google. This is not an official Google or Trail of Bits product.\n\n## Index\n\n* [Usage](#usage)\n* [Configuration](#configuration)\n  * [⚠️ Internal options ⚠️](#internal-options)\n* [Troubleshooting](#troubleshooting)\n* [Tips and Tricks](#tips-and-tricks)\n* [Licensing](#licensing)\n* [Code of Conduct](#code-of-conduct)\n\n## Usage\n\nSimply add `pypa/gh-action-pip-audit` to one of your workflows:\n\n```yaml\njobs:\n  selftest:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - name: install\n        run: python -m pip install .\n      - uses: pypa/gh-action-pip-audit@v1.1.0\n```\n\nOr, with a virtual environment:\n\n```yaml\njobs:\n  selftest:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - name: install\n        run: |\n          python -m venv env/\n          source env/bin/activate\n          python -m pip install .\n      - uses: pypa/gh-action-pip-audit@v1.1.0\n        with:\n          virtual-environment: env/\n```\n\nBy default, `pip-audit` will run in \"`pip list` source\" mode, meaning that it'll\nattempt to collect dependencies from the local environment. See\nthe [configuration](#configuration) documentation below for more input\nand behavioral options.\n\n## Configuration\n\n`gh-action-pip-audit` takes a variety of configuration inputs, all of which are\noptional.\n\n### `inputs`\n\n**Default**: Empty, indicating \"`pip list` source\" mode\n\nThe `inputs` setting controls what sources `pip-audit` runs on.\n\nTo audit one or more requirements-style inputs:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    inputs: requirements.txt dev-requirements.txt\n```\n\nTo audit a project that uses `pyproject.toml` for its dependencies:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    # NOTE: this can be `.`, for the current directory\n    inputs: path/to/project/\n```\n\n### `virtual-environment`\n\n**Default**: Empty, indicating no virtual environment\n\nThe `virtual-environment` setting controls the\n[virtual environment](https://docs.python.org/3/tutorial/venv.html) that this\naction loads to, if specified. The value is the top-level directory for the\nvirtual environment, which is conventionally named `env` or `venv`.\n\nDepending on your CI and project configuration, you may or may not need this\nsetting. Specifically, you only need it if you satisfy *all* of the following\nconditions:\n\n1. You are auditing an *environment* (**not** a requirements file or other\n   project metadata)\n2. Your environment is not already \"active\", i.e. `python -m pip` points to a\n   different `pip` than the one that your environment uses\n\nExample: use the virtual environment specified at `env/`, relative to the\ncurrent directory:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    virtual-environment: env/\n    # Note the absence of `input:`, since we're auditing the environment.\n```\n\n### `local`\n\n**Default**: `false`\n\nThe `local` setting corresponds to `pip-audit`'s `--local` flag, which controls\nwhether non-local dependencies are included when auditing in \"`pip list` source\"\nmode.\n\nBy default all dependencies are included; with `local: true`, only dependencies\ninstalled directly into the current environment are included.\n\nExample:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    local: true\n```\n\n### `vulnerability-service`\n\n**Default**: `PyPI`\n\n**Options**: `PyPI`, `OSV` (case insensitive)\n\nThe `vulnerability-service` setting controls which vulnerability service is used for the audit.\nIt's directly equivalent to `pip-audit --vulnerability-service=...`.\n\nTo audit with OSV instead of PyPI:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    vulnerability-service: osv\n```\n\n### `require-hashes`\n\n**Default**: `false`\n\nThe `require-hashes` setting controls whether strict hash checking is enabled.\nIt's directly equivalent to `pip-audit --require-hashes ...`.\n\nExample:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    # NOTE: only works with requirements-style inputs\n    inputs: requirements.txt\n    require-hashes: true\n```\n\n### `no-deps`\n\n**Default**: `false`\n\nThe `no-deps` setting controls whether dependency resolution is performed.\nIt's directly equivalent to `pip-audit --no-deps ...`.\n\nExample:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    # NOTE: only works with requirements-style inputs\n    inputs: requirements.txt\n    no-deps: true\n```\n\n### `summary`\n\n**Default**: `true`\n\nThe `summary` setting controls whether a GitHub\n[job summary](https://github.blog/2022-05-09-supercharging-github-actions-with-job-summaries/)\nis rendered at the end of the action.\n\nExample:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    summary: false\n  ```\n\n### `index-url`\n\n**Default**: Empty, indicating [PyPI](https://pypi.org)\n\nThe `index-url` setting specifies a base URL for an alternative PEP 503-compatible\npackage index.\n\n**This is probably not want you want.** If your goal is to add *complementary*\nindices to search (such as a corporate index with private packages), see\n[`extra-index-urls`](#extra-index-urls).\n\nExample:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    index-url: https://example.corporate.local/simple\n```\n\n### `extra-index-urls`\n\n**Default**: Empty (no extra indexes are searched by default)\n\nThe `extra-index-urls` setting specifies one or more *extra* PEP 503-compatible packages\nindexes to search when resolving dependencies. Each URL is whitespace-separated.\n\nExample:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    extra-index-urls: |\n      https://example.corporate.local/simple\n      https://prod.corporate.local/simple\n```\n\n### `ignore-vulns`\n\n**Default**: Empty (no vulnerabilities are ignored)\n\nThe `ignore-vulns` setting specifies one or more vulnerability IDs to\nignore (i.e., exclude from the results) if present. Each ID is whitespace-separated.\n\nExample\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    ignore-vulns: |\n      GHSA-XXXX-YYYYYY\n      PYSEC-AAAA-BBBBB\n```\n\n### `disable-pip`\n\n**Default**: `false`\n\nThe `disable-pip` setting disable the use of `pip` for dependency resolution. This can only be used with\nhashed requirements files or if the `no-deps` setting has been provided.\n\nExample\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    inputs: requirements.lock\n    disable-pip: true\n    no-deps: true\n```\n\n### Internal options\n\u003cdetails\u003e\n  \u003csummary\u003e⚠️ Internal options ⚠️\u003c/summary\u003e\n\n  Everything below is considered \"internal,\" which means that it\n  isn't part of the stable public settings and may be removed or changed at\n  any point. **You probably do not need these settings.**\n\n  All internal options are prefixed with `internal-be-careful-`.\n\n  #### `internal-be-careful-allow-failure`\n\n  **Default**: `false`\n\n  The `internal-be-careful-allow-failure` setting allows the job to pass, even\n  if the underlying `pip-audit` run fails (e.g. due to vulnerabilities detected).\n\n  Be very careful with this setting! Using it unwittingly will prevent the action\n  from failing your CI when `pip-audit` fails, which is probably not what you want.\n\n  Example:\n\n  ```yaml\n  - uses: pypa/gh-action-pip-audit@v1.1.0\n    with:\n      internal-be-careful-allow-failure: true\n  ```\n\n#### `internal-be-careful-extra-flags`\n**Default**: `\"\"`\n\nThe `internal-be-careful-extra-flags` setting passes the specified flags\nto `pip-audit`.\n\nExample:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    internal-be-careful-extra-flags: --not-a-real-pip-audit-flag\n```\n\n\u003c/details\u003e\n\n## Troubleshooting\n\nThis section is still a work in progress. Please help us improve it!\n\n### The action takes longer than I expect!\n\nIf you're auditing a requirements file, consider setting `no-deps: true` or\n`require-hashes: true`:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    inputs: requirements.txt\n    require-hashes: true\n```\n\nor:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    inputs: requirements.txt\n    no-deps: true\n```\n\nSee the\n[\"`pip-audit` takes longer than I expect!\"](https://github.com/pypa/pip-audit#pip-audit-takes-longer-than-i-expect)\ntroubleshooting for more details.\n\n### The action shows dependencies that aren't in my environment!\n\nIn the default (\"`pip list` source\") configuration, `pip-audit` collects all\ndependencies that are visible in the current environment.\n\nDepending on the project or CI's configuration, this can include packages installed\nby the host system itself, or other Python projects that happen to be installed.\n\nTo minimize external dependencies, you can opt into a virtual environment:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    # must be populated earlier in the CI\n    virtual-environment: env/\n```\n\nand, more aggressively, specify that only dependencies marked as \"local\"\nin the virtual environment should be included:\n\n```yaml\n- uses: pypa/gh-action-pip-audit@v1.1.0\n  with:\n    # must be populated earlier in the CI\n    virtual-environment: env/\n    local: true\n```\n\n### There's an issue with the action and I want to enable debug logging!\n\nThe action prints debug information when the `ACTIONS_STEP_DEBUG` secret is set\nto `true``. You should be able to enable this behavior by\n[following these instructions](https://docs.github.com/en/actions/managing-workflow-runs/re-running-workflows-and-jobs#re-running-all-the-jobs-in-a-workflow).\n\n## Tips and Tricks\n\n### Running against a pipenv project\n\nIf you are adding `pip-audit` to a pipenv based project, you'll first need\nto convert the `Pipfile[.lock]` to a `requirements.txt` file that `pip-audit`\ncan ingest. Use a Python tool, such as\n[`pipfile-requirements`](https://github.com/frostming/pipfile-requirements), to\nconvert your `Pipfile[.lock]` to a `requirements.txt` file and then run\n`pip-audit` GitHub Action against the generated requirements file.\n\n```yaml\njobs:\n  pip-audit:\n    steps:\n      - uses: actions/setup-python@v5\n        with:\n          python-version: 3.9  # change to your required version of Python\n\n      - name: 'Generate requirements.txt'\n        run: |\n          pipx run pipfile-requirements Pipfile.lock \u003e requirements.txt\n\n      - uses: pypa/gh-action-pip-audit@v1.1.0\n        with:\n          inputs: requirements.txt\n```\n\n## Licensing\n\n`gh-action-pip-audit` is licensed under the Apache 2.0 License.\n\n## Code of Conduct\n\nEveryone interacting with this project is expected to follow the\n[PSF Code of Conduct](https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpypa%2Fgh-action-pip-audit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpypa%2Fgh-action-pip-audit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpypa%2Fgh-action-pip-audit/lists"}