Usage of pip-audit for libraries

[jugmac00]

Hey, I am a bit confused on how to use pip-audit for libraries, especially when I want to check them in CI (not github). Ideally, I want to run it via pre-commit. Does the pre-commit hook install the package under test and then run pip-audit? I especially ask about libraries, where I do not have a requirements.txt.

So does

repos:
  - repo: https://github.com/pypa/pip-audit
    rev: v2.7.3
    hooks:
      - id: pip-audit

install the library, and then run pip-audit?

Thanks!

I usually use tox to run pre-commit to run my linters. For pip-audit, would it be better than to create a separate tox environment for pip-audit, as tox automatically installs the package?

Thank you!