From 2535bf419f4defbb9424272787206d6f0b983662 Mon Sep 17 00:00:00 2001 From: Jeff West Date: Sun, 17 May 2026 07:30:25 -0500 Subject: [PATCH] fix(ci): install pip into the uv venv so pip-audit can introspect it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit First post-merge pip-audit run failed with: /home/runner/.../.venv/bin/python: No module named pip uv sync creates a venv without pip (uv has its own resolver), but pip-audit shells out to pip to enumerate installed packages. Adding `uv pip install pip` after the sync seeds it. Confirmed `continue-on-error: true` does mark the job as failed even though it doesn't gate the workflow — leaving that intact since the intent is "surface CVEs visibly, not block." Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/pip-audit.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pip-audit.yml b/.github/workflows/pip-audit.yml index 828e67c..1474ee6 100644 --- a/.github/workflows/pip-audit.yml +++ b/.github/workflows/pip-audit.yml @@ -28,7 +28,11 @@ jobs: run: uv python install 3.12 - name: Install dependencies - run: uv sync + run: | + uv sync + # `uv sync` does not seed `pip` into the venv (uv has its own + # resolver). pip-audit needs `pip` to introspect installed packages. + uv pip install pip - name: Run pip-audit uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 # v1.1.0