ci: add dependency audit workflow by PascalThuet · Pull Request #3138 · github/spec-kit

PascalThuet · 2026-06-23T21:51:52Z

Part of splitting #2442 into smaller, dedicated PRs. Rebased onto current main.

What

Add a deterministic dependency-audit job for pull requests, pushes, and manual runs.
Add a weekly live-resolution audit across Ubuntu and Windows with Python 3.11 through 3.14.
Audit a committed, fully hashed requirements snapshot with pip-audit --require-hashes.
Add a sync gate that regenerates the dependency set when relevant inputs change and fails with actionable diagnostics when the snapshot is stale.
Document the local refresh and audit commands.

Security review feedback

The audit feedback is covered by the current branch:

checkout uses full history so dependency diff bases are available;
a missing GENERATED_REQUIREMENTS value produces an explicit error;
actions/setup-python matches the repository-standard pinned SHA;
astral-sh/setup-uv now also matches the repository-standard pinned SHA;
the scheduled matrix includes Python 3.14 from the current CI lifecycle.

The existing review threads are outdated; they were intentionally left for the reviewer or PR author to resolve.

Failed workflow root cause

The previous Dependency audit check correctly detected that the committed requirements snapshot no longer matched a fresh resolution. The snapshot has been regenerated from current main and the sync gate now accepts it.

Validation

Security workflow and static workflow tests: 17 passed
Ruff on source and changed security files: passed
Full test suite: 4,446 passed, 112 skipped
Snapshot sync gate against origin/main...HEAD: passed
pip-audit against the hashed snapshot: no known vulnerabilities found
git diff --check: passed

Bandit and secret scanning remain intentionally outside this focused PR.

Disclosure: Updated on behalf of @PascalThuet by Codex (model: GPT-5, autonomous).

Copilot

Pull request overview

Adds a dedicated GitHub Actions “Security Audit” workflow to run deterministic pip-audit checks on PRs/push/manual runs (using a committed, hashed requirements snapshot) and a scheduled job that resolves/audits dependencies live across the supported OS/Python matrix. It also introduces a sync-gate script and corresponding tests/docs to keep the committed snapshot aligned with pyproject.toml.

Changes:

Added .github/workflows/security.yml with split triggers: deterministic audit for PR/push/manual + scheduled live-resolution audit matrix.
Added .github/scripts/check_security_requirements.py and a committed hashed requirements snapshot to gate PRs when dependency inputs change without regenerating the snapshot.
Added tests + CONTRIBUTING docs to enforce and document the workflow, pins, and local commands.

Show a summary per file

File	Description
`.github/workflows/security.yml`	New Security Audit workflow with deterministic and scheduled dependency-audit jobs.
`.github/scripts/check_security_requirements.py`	Sync-gate script to detect dependency input changes and verify the committed snapshot is current.
`.github/security-audit-requirements.txt`	Committed hashed requirements snapshot used for deterministic audits.
`tests/test_security_workflow.py`	Static tests guarding workflow triggers, pins, matrix, and sync-gate behavior.
`CONTRIBUTING.md`	Documentation for local security audit and snapshot refresh commands.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 5/5 changed files
Comments generated: 2

+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 2
+


+def main() -> int:
+    if not _dependency_inputs_changed():
+        return 0
+
+    generated_requirements = Path(os.environ["GENERATED_REQUIREMENTS"])
+    generated_requirements.parent.mkdir(parents=True, exist_ok=True)


mnriem

Please address Copilot feedback

Copilot

Review details

Files reviewed: 5/5 changed files
Comments generated: 2
Review effort level: Low

+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:


+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: ${{ matrix.python-version }}


mnriem · 2026-06-29T15:09:02Z

Please address Copilot feedback

Copilot

Review details

Files reviewed: 5/5 changed files
Comments generated: 0 new
Review effort level: Low

mnriem

Please address Security Audit workflow

Add a Security Audit workflow with a dependency-audit job. Push/PR/manual runs pip-audit against a committed --generate-hashes requirements snapshot (.github/security-audit-requirements.txt) for deterministic CI, while the weekly scheduled run resolves the runtime + test dependency set live across the supported Python/OS matrix to surface newly published advisories. A sync gate (.github/scripts/check_security_requirements.py) fails PRs whose dependency inputs changed without refreshing the committed snapshot, so the committed file can't silently drift from pyproject.toml. Assisted-by: Codex (model: GPT-5, autonomous)

Assisted-by: Codex (model: GPT-5, autonomous)

PascalThuet · 2026-07-20T15:49:08Z

Security audit review summary

Audit feedback addressed

Full checkout history keeps dependency diff bases available.
Missing GENERATED_REQUIREMENTS configuration now fails with an actionable message.
setup-python and setup-uv use the repository-standard pinned SHAs.
The scheduled audit matrix now covers Python 3.11, 3.12, 3.13, and 3.14 on Ubuntu and Windows.

Failed check resolution

The previous Dependency audit failure was caused by a genuinely stale committed requirements snapshot. It has been regenerated from current main, and the sync gate now accepts it.

Validation

Security/static workflow tests: 17 passed
Full suite: 4,446 passed, 112 skipped
Ruff: passed
Snapshot sync gate: passed
pip-audit: no known vulnerabilities found
git diff --check: passed

Head commit: 6c6ab78

Posted on behalf of @PascalThuet by Codex (model: GPT-5, autonomous).

PascalThuet · 2026-07-20T15:59:09Z

@mnriem

One maintenance-policy question surfaced while rebasing this PR: pyproject.toml still declares Python >=3.11, while the functional CI matrix currently tests only Python 3.13 and 3.14. The scheduled security audit covers 3.11 through 3.14.

Could you confirm whether Python 3.11 and 3.12 remain officially supported, or are merely installable without CI guarantees?

Depending on the intended policy, we could either retain 3.11–3.14 in the scheduled audit or align it with the functional CI matrix.

Separately, the rebase exposed version drift for pinned actions between workflows (setup-uv v8.2.0 versus the repository-standard v8.3.2). This PR now aligns them, but a shared consistency check or documented convention could prevent future drift

Copilot

Review details

Files reviewed: 5/5 changed files
Comments generated: 1
Review effort level: Medium

+uvx --from pip-audit==2.10.0 pip-audit --disable-pip --require-hashes -r .github/security-audit-requirements.txt --progress-spinner off
+```
+
+Run this before changing dependency metadata. Pull request, push, and manual CI audits use the committed hashed requirements file so they stay deterministic. The scheduled CI audit also resolves the runtime and `test` extra dependency set across the supported Python and OS matrix to catch newly published advisories. If dependency metadata changes, refresh the committed audit input before running pip-audit:


Assisted-by: Codex (model: GPT-5, autonomous)

PascalThuet · 2026-07-21T15:31:00Z

Addressed the latest Copilot review round.

The contributor guidance now explicitly describes the pip-audit command as auditing the committed snapshot and requires dependency changes to refresh and commit that snapshot before auditing. I also regenerated the snapshot to incorporate platformdirs 4.11.0, which fixes the current dependency-audit sync failure.

Validation: 17 security/workflow tests passed; the snapshot sync gate passed; pip-audit reported no known vulnerabilities; git diff --check passed. Markdownlint still reports two pre-existing fence-style findings at CONTRIBUTING.md:180 and CONTRIBUTING.md:194, outside this change.

Commit: 7032366caaf5e1c492d6777999882124f9e2a37f

Posted on behalf of @PascalThuet by Codex (model: GPT-5, autonomous).

PascalThuet requested a review from mnriem as a code owner June 23, 2026 21:51

mnriem requested a review from Copilot June 24, 2026 12:48

Copilot started reviewing on behalf of mnriem June 24, 2026 12:48 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

mnriem requested changes Jun 24, 2026

View reviewed changes

PascalThuet force-pushed the split/dependency-audit branch from ea424f9 to e32404e Compare June 27, 2026 13:46

mnriem requested a review from Copilot June 29, 2026 12:57

Copilot started reviewing on behalf of mnriem June 29, 2026 12:57 View session

Copilot AI reviewed Jun 29, 2026

View reviewed changes

PascalThuet requested a review from mnriem July 5, 2026 18:15

mnriem requested a review from Copilot July 7, 2026 13:48

Copilot started reviewing on behalf of mnriem July 7, 2026 13:49 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

mnriem requested changes Jul 7, 2026

View reviewed changes

PascalThuet added 5 commits July 20, 2026 17:43

ci: split dependency audit schedule matrix

ef4edcf

Assisted-by: Codex (model: GPT-5, autonomous)

ci: harden dependency audit sync checks

6403fa9

Assisted-by: Codex (model: GPT-5, autonomous)

ci: align security workflow python pin

0fa9d54

Assisted-by: Codex (model: GPT-5, autonomous)

ci: refresh dependency audit baseline

6c6ab78

Assisted-by: Codex (model: GPT-5, autonomous)

PascalThuet force-pushed the split/dependency-audit branch from 0e5ee97 to 6c6ab78 Compare July 20, 2026 15:48

PascalThuet requested a review from mnriem July 21, 2026 05:12

mnriem requested a review from Copilot July 21, 2026 15:08

Copilot started reviewing on behalf of mnriem July 21, 2026 15:09 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

docs: clarify security snapshot audit

7032366

Assisted-by: Codex (model: GPT-5, autonomous)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: add dependency audit workflow#3138

ci: add dependency audit workflow#3138
PascalThuet wants to merge 6 commits into
github:mainfrom
PascalThuet:split/dependency-audit

PascalThuet commented Jun 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

mnriem left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

mnriem commented Jun 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

mnriem left a comment

Uh oh!

PascalThuet commented Jul 20, 2026

Uh oh!

PascalThuet commented Jul 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

PascalThuet commented Jul 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

PascalThuet commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Security review feedback

Failed workflow root cause

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

mnriem left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

mnriem commented Jun 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

mnriem left a comment

Choose a reason for hiding this comment

Uh oh!

PascalThuet commented Jul 20, 2026

Security audit review summary

Audit feedback addressed

Failed check resolution

Validation

Uh oh!

PascalThuet commented Jul 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

PascalThuet commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

PascalThuet commented Jun 23, 2026 •

edited

Loading

PascalThuet commented Jul 21, 2026 •

edited

Loading