From e56eb57c7f186601dffa31fe629f63c4104eab84 Mon Sep 17 00:00:00 2001
From: Christophe Pettus <cpettus@pgexperts.com>
Date: Sun, 21 Jun 2026 02:17:03 -0700
Subject: [PATCH] ci: add report-only pip-audit job

I1: The pipeline had no dependency vulnerability scan. Add an "audit" job that
installs the package with its [dev,postgres] extras (coddpiece declares no
unconditional runtime deps, so the extras are the real audit surface) and runs
pip-audit. The pip-audit step is continue-on-error so a freshly-published
advisory can never turn the pipeline red on byte-identical code -- only
correctness jobs (test, lint, type-check) gate a merge.

Closes I1.
---
 .github/workflows/ci.yml | 33 +++++++++++++++++++++++++++++++++
 ISSUES.md                |  2 +-
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 02cc58a..ca08300 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -82,3 +82,36 @@ jobs:
           # is gated on this env var being present.
           DATABASE_URL: postgresql://postgres:postgres@localhost:5432/coddpiece_test
         run: python -m pytest tests/test_postgres.py -v
+
+  # Separate job: scan the installed dependency tree for known
+  # vulnerabilities with pip-audit. This is intentionally REPORT-ONLY
+  # (continue-on-error) so a freshly-published advisory can never turn
+  # the pipeline red on byte-identical code -- audit/perf steps inform,
+  # they don't gate. Only correctness (test, lint, type-check) blocks a
+  # merge. Re-triage findings here rather than treating them as failures.
+  audit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          # Install the package WITH its optional extras so pip-audit scans
+          # the packages coddpiece actually pulls in (pytest, ruff, mypy,
+          # psycopg). coddpiece declares no unconditional runtime deps, so
+          # without the extras the audit surface would be effectively empty.
+          pip install -e ".[dev,postgres]"
+          pip install pip-audit
+
+      # continue-on-error keeps this step non-blocking: it surfaces
+      # advisories in the job log/summary without failing the workflow.
+      - name: Audit dependencies with pip-audit
+        continue-on-error: true
+        run: pip-audit
diff --git a/ISSUES.md b/ISSUES.md
index fedbd42..20d8daa 100644
--- a/ISSUES.md
+++ b/ISSUES.md
@@ -90,7 +90,7 @@ Legend: `[ ]` open · `[x]` resolved · `[~]` won't fix / by design.
 
 ## P6 — CI / tooling
 
-- [ ] **I1 · No dependency-audit step.** Add a report-only `pip-audit` job
+- [x] **I1 · No dependency-audit step.** Add a report-only `pip-audit` job
   (non-blocking, per the repo's perf/audit-is-report-only convention) so shipped
   dependencies are scanned without gating the pipeline on advisory noise.