feat: add ignore-vulns input to _python-security workflow#233
feat: add ignore-vulns input to _python-security workflow#233JacobPEvans merged 2 commits intomainfrom
Conversation
Allows calling repos to acknowledge specific transitive vulnerabilities that have no upstream fix available, while continuing to enforce pip-audit for all other findings. Each ignored ID is documented in the calling repo's ci-gate.yml call site with a comment linking to a tracking issue. This is per-CVE acceptance, not a blanket disable — new findings still fail the build. Triggered by mlx-benchmarks: lm-eval[api]==0.4.11 transitively depends on sqlitedict 2.1.0 (GHSA-g4r7-86gm-pgqc / CVE-2024-35515) which has no upstream patch. The CVE is local-deserialization and the dep is loaded only inside lm-eval's caching layer in CI-isolated workloads. The audit logic moved into scripts/run-pip-audit.sh because the workflow linter blocks complex inline bash. The script is fetched via sparse checkout from the same .github repo at workflow runtime.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the _python-security reusable workflow by introducing the ability to ignore specific, documented vulnerabilities. This allows teams to acknowledge and bypass known transitive dependency issues that lack upstream fixes, while maintaining strict security enforcement for all other findings. Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. The audit runs with careful eyes, / To catch the bugs that we despise. / But when a fix is nowhere near, / We add an ignore to keep it clear. Footnotes
|
Final CI Gate fix: add documented per-CVE acknowledgement for GHSA-g4r7-86gm-pgqc (sqlitedict 2.1.0 / CVE-2024-35515) — the unfixable lm-eval transitive dep flagged on every CI run. - `osv-scanner.toml`: local override config picked up by the central `_osv-scan.yml` reusable workflow. ignoreUntil set to 2026-10-25 to force a quarterly review. Reason links to tracking issue #18 and documents the exploitability surface. - `ci-gate.yml`: pass `ignore-vulns: GHSA-g4r7-86gm-pgqc` to the `_python-security.yml` reusable workflow. Same documentation pattern — comment block above the ID lists the tracking issue, source dep, and exploitability assessment. Both are narrow per-CVE acceptance, not blanket suppressions. New findings still fail the build. The new `ignore-vulns` input is added to the central workflow in JacobPEvans/.github#233 — once that merges, this PR's CI will go green. Refs: #18 (lm-eval transitive vulns tracking issue), JacobPEvans/.github#233 (central workflow input).
There was a problem hiding this comment.
Pull request overview
Adds an optional ignore-vulns input to the reusable Python security workflow and moves the pip-audit execution logic into a centralized script fetched at runtime.
Changes:
- Introduces
ignore-vulnsworkflow input and passes it through to the audit runner. - Extracts the inline audit loop into
scripts/run-pip-audit.sh. - Adds a sparse-checkout step to fetch the centralized audit script before running it.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
scripts/run-pip-audit.sh |
New Bash helper to run uv export + uvx pip-audit across directories with optional ignored vuln IDs. |
.github/workflows/_python-security.yml |
Adds ignore-vulns input, checks out central script, and executes it instead of inline Bash. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Two improvements from copilot review on PR #233: - Use a Bash array (`ignore_args+=(--ignore-vuln "$vuln")`) instead of a string with intentional word splitting. Removes the SC2086 disable and is more robust against future vulnerability IDs that might contain whitespace or special characters. - Wrap each scan iteration in a subshell with `trap 'echo "::endgroup::"' EXIT`. Guarantees the GitHub Actions log group is closed even if `uv export` or `uvx pip-audit` exits non-zero under `set -e`. The third copilot comment (pin checkout ref) follows the same unpinned pattern already in `_osv-scan.yml` and is not addressed here — that's a separate org-wide consistency change.
The previous run failed with startup_failure because `_python-security.yml@main` did not yet declare the `ignore-vulns` input that ci-gate.yml passes. That input shipped in the merged `feat: add ignore-vulns input` PR. No code changes here.
Summary
ignore-vulnsinput to the_python-security.ymlreusable workflow. Each space-separated ID is passed topip-audit --ignore-vuln.scripts/run-pip-audit.sh(workflow linter blocks complex inline bash). Fetched via sparse checkout from the same.githubrepo at runtime.Why
Calling repos can acknowledge specific transitive vulnerabilities with no upstream fix — narrow per-CVE acceptance, not blanket disable. Each ignored ID is documented in the calling repo's
ci-gate.ymlwith a comment linking to a tracking issue.Triggered by JacobPEvans/mlx-benchmarks#19:
lm-eval[api]==0.4.11transitively depends onsqlitedict 2.1.0(GHSA-g4r7-86gm-pgqc / CVE-2024-35515), no upstream patch. CVE is local-deserialization; dep is in lm-eval's caching layer only.Behavior
ignore-vulnsis optional; existing callers continue to work unchanged.Test plan