From f78184f8de1a51e3bb4cc15850d669de83f96ef0 Mon Sep 17 00:00:00 2001 From: furedea <132188853+furedea@users.noreply.github.com> Date: Mon, 2 Nov 2026 14:47:49 +0900 Subject: [PATCH] ci: scan dependencies for known vulnerabilities with uv audit Run uv's preview audit command in the audit job so a dependency with a known OSV advisory fails CI. It audits every dependency group by default, including the non-default audit group. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a79c7aa..55c3347 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -131,6 +131,9 @@ jobs: - name: Run vulture run: uv run --group audit vulture + - name: Run uv audit + run: uv audit --preview-features audit + all-green: if: always() needs: [nix-lint, lint, typecheck, test, audit]