chore: run pip-audit on ci

[inimaz]

Description

Test to see if pip-audit can flag issues on the dependencies of the uv.lock.

[inimaz]

pip-audit alone does not manage to flag uv.lock dependency issues.
For info, there is an issue requesting uv audit astral-sh/uv#9189.

[nyudenkov]

Hi @inimaz! I'm Nikita, developer behind PySentry.
My tool natively supports uv.lock and gives more insights on vulnerabilities and packages overall (PEP792 support)
If you want to give it a try, I can make a PR for you with pysentry integrated into CI.

[SaboniAmine]

Hi @inimaz! I'm Nikita, developer behind PySentry. My tool natively supports uv.lock and gives more insights on vulnerabilities and packages overall (PEP792 support) If you want to give it a try, I can make a PR for you with pysentry integrated into CI.

Hello Nikita, sorry for the delay of response.
That could be nice to test PySentry, indeed! If this doesn't take you too much time, could you please propose a new CI task ?

[inimaz]

uv audit is out now! worth testing it instead of this

[nyudenkov]

hey, sorry for dropping off, I've got swamped
free now if there's still interest

@inimaz good to see uv audit lands
they overlap a lot, but pysentry covers a bit more ground, so it might be worth seeing both on your uv.lock :)

pysentry adds: three advisory DBs merged (PyPA, PyPI, OSV) so no single source hides a CVE; PEP 792 (flags quarantined/archived packages, can fail on quarantined); CVSS v3/v4 for severity gating. SBOM generation is coming soon too.

if you're still up for trying it, I can open a pr with small non-blocking job so you can see it next to uv audit and keep whatever fits
just tell if you're up for it :)

[inimaz]

Nice @nyudenkov !

if you're still up for trying it, I can open a pr with small non-blocking job so you can see it next to uv audit and keep whatever fits just tell if you're up for it :)

Sure please do and we can keep the discussion on that one thanks!
Btw I opened an issue on pysentry asking how to run it on the ci --> nyudenkov/pysentry#120 it might be related?

[nyudenkov]

@inimaz opened it: #1283 :)

small non-blocking job (continue-on-error) - reads uv.lock directly, SARIF to the Security tab, merges PyPA/PyPI/OSV