Skip to content

Commit

Permalink
README: prep for 0.0.5
Browse files Browse the repository at this point in the history
Signed-off-by: William Woodruff <william@trailofbits.com>
  • Loading branch information
woodruffw committed Jun 30, 2022
1 parent 39d1d07 commit 6b7dc40
Showing 1 changed file with 19 additions and 19 deletions.
38 changes: 19 additions & 19 deletions README.md
Expand Up @@ -28,7 +28,7 @@ jobs:
- uses: actions/checkout@v3
- name: install
run: python -m pip install .
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
```

Or, with a virtual environment:
Expand All @@ -44,7 +44,7 @@ jobs:
python -m venv env/
source env/bin/activate
python -m pip install .
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
virtual-environment: env/
```
Expand All @@ -68,15 +68,15 @@ The `inputs` setting controls what sources `pip-audit` runs on.
To audit one or more requirements-style inputs:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
inputs: requirements.txt dev-requirements.txt
```

To audit a project that uses `pyproject.toml` for its dependencies:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
# NOTE: this can be `.`, for the current directory
inputs: path/to/project/
Expand Down Expand Up @@ -104,7 +104,7 @@ Example: use the virtual environment specified at `env/`, relative to the
current directory:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
virtual-environment: env/
# Note the absence of `input:`, since we're auditing the environment.
Expand All @@ -124,7 +124,7 @@ installed directly into the current environment are included.
Example:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
local: true
```
Expand All @@ -141,7 +141,7 @@ It's directly equivalent to `pip-audit --vulnerability-service=...`.
To audit with OSV instead of PyPI:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
vulnerability-service: osv
```
Expand All @@ -156,7 +156,7 @@ It's directly equivalent to `pip-audit --require-hashes ...`.
Example:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
# NOTE: only works with requirements-style inputs
inputs: requirements.txt
Expand All @@ -173,7 +173,7 @@ It's directly equivalent to `pip-audit --no-deps ...`.
Example:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
# NOTE: only works with requirements-style inputs
inputs: requirements.txt
Expand All @@ -191,7 +191,7 @@ is rendered at the end of the action.
Example:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
summary: false
```
Expand All @@ -210,7 +210,7 @@ indices to search (such as a corporate index with private packages), see
Example:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
index-url: https://example.corporate.local/simple
```
Expand All @@ -225,7 +225,7 @@ indexes to search when resolving dependencies. Each URL is whitespace-separated.
Example:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
extra-index-urls: |
https://example.corporate.local/simple
Expand All @@ -242,7 +242,7 @@ ignore (i.e., exclude from the results) if present. Each ID is whitespace-separa
Example

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
ignore-vulns: |
GHSA-XXXX-YYYYYY
Expand Down Expand Up @@ -272,7 +272,7 @@ Example
Example:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
internal-be-careful-allow-failure: true
```
Expand All @@ -291,7 +291,7 @@ Example
Example:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
internal-be-careful-debug: true
```
Expand All @@ -308,7 +308,7 @@ If you're auditing a requirements file, consider setting `no-deps: true` or
`require-hashes: true`:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
inputs: requirements.txt
require-hashes: true
Expand All @@ -317,7 +317,7 @@ If you're auditing a requirements file, consider setting `no-deps: true` or
or:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
inputs: requirements.txt
no-deps: true
Expand All @@ -338,7 +338,7 @@ by the host system itself, or other Python projects that happen to be installed.
To minimize external dependencies, you can opt into a virtual environment:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
# must be populated earlier in the CI
virtual-environment: env/
Expand All @@ -348,7 +348,7 @@ and, more aggressively, specify that only dependencies marked as "local"
in the virtual environment should be included:

```yaml
- uses: trailofbits/gh-action-pip-audit@v0.0.4
- uses: trailofbits/gh-action-pip-audit@v0.0.5
with:
# must be populated earlier in the CI
virtual-environment: env/
Expand Down

0 comments on commit 6b7dc40

Please sign in to comment.