Repository navigation
Conversation
The pip-audit workflow is advisory — it audits dependencies and opens a
`security-updates` PR for the fixes. Its `Apply package updates` step runs the
generated `apply_security_upgrades.sh`, which does `uv lock -P pkg==ver ...` for
the recommended upgrades. When those recommended pins can't be co-resolved
against the project constraints, `uv lock` exits non-zero ("No solution found
when resolving dependencies") and the whole workflow goes red — a false alarm,
since there's no code defect and the job's only output is a report + an
optional PR.
Make the auto-upgrade non-fatal: on an unresolvable `uv lock`, emit a
::warning:: instead of failing. The vulnerability report is still generated, the
Create Pull Request step still opens a PR when uv.lock actually changed, and the
repo stays green. Resolvable upgrades are unaffected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
pip-auditworkflow has been red onmaster(and across the vEcoli-family repos: vEcoli_Plasmid, vEcolisRNA, vEcoli-spatial-voronoi, which share this workflow).It's an advisory job — audit dependencies, then open a
security-updatesPR with the fixes. Thepip-auditscan itself is already non-fatal (|| true). But the Apply package updates step runs the generatedapply_security_upgrades.sh, which doesuv lock -P pkg==ver …for the recommended upgrades. When those recommended pins can't be co-resolved against the project's constraints,uv lockexits non-zero —— and the whole workflow goes red. That's a false alarm: there's no code defect, and the job's only outputs are a report and an optional PR.
Fix
Make the auto-upgrade non-fatal: on an unresolvable
uv lock, emit a::warning::instead of failing the step. The vulnerability report is still generated, the Create Pull Request step still opens a PR whenuv.lockactually changed, and the repo stays green. Resolvable upgrades are unaffected (they still apply and still PR).This is the root-source fix; the same change should be propagated to the three sibling repos that copy this workflow.