Problem
The Security Scan job in .github/workflows/ci.yml:135-156 runs uv tool run pip-audit, which executes pip-audit in its own ephemeral tool environment — so it audits pip-audit's own ~28 dependencies, not the project's. Verified by running the exact CI command locally: the audited set is boolean-py, cachecontrol, certifi, ..., rich, urllib3 — no fastapi, sqlalchemy, pydantic, uvicorn, mcp, or textual.
Compounding it, the job's install step is uv sync --all-extras --dev without --all-packages; a --dry-run shows it actually removes the workspace packages and their deps from the env.
Impact
The job has been green-by-construction since introduction and has never scanned a production dependency. Combined with dependabot auto-merge, dependency updates land with no real vetting.
Direction
- run: uv sync --all-packages --all-extras --dev
- run: uv run --no-sync pip-audit --skip-editable ...
or export the lockfile and run pip-audit -r requirements.txt.
Found during repo-wide audit, 2026-07-25.
Problem
The Security Scan job in
.github/workflows/ci.yml:135-156runsuv tool run pip-audit, which executes pip-audit in its own ephemeral tool environment — so it audits pip-audit's own ~28 dependencies, not the project's. Verified by running the exact CI command locally: the audited set isboolean-py, cachecontrol, certifi, ..., rich, urllib3— no fastapi, sqlalchemy, pydantic, uvicorn, mcp, or textual.Compounding it, the job's install step is
uv sync --all-extras --devwithout--all-packages; a--dry-runshows it actually removes the workspace packages and their deps from the env.Impact
The job has been green-by-construction since introduction and has never scanned a production dependency. Combined with dependabot auto-merge, dependency updates land with no real vetting.
Direction
or export the lockfile and run
pip-audit -r requirements.txt.Found during repo-wide audit, 2026-07-25.