support pre-commit (add a small file called .pre-commit-hooks.yaml)

[chrisdlangton]

Is your feature request related to a problem? Please describe.

no

Describe the solution you'd like

add a small file called .pre-commit-hooks.yaml in the root of the project, follow this

Describe alternatives you've considered

using pre-commit running pip-audit globally installed on the system (not ideal for teams)

Additional context

join a massive ecosystem of easy-to-use hooks

[tal66]

hi, I can do this

[woodruffw]

@tal66 please do!

[tal66]

hi, so would this be good for you? :

- id: pip-audit
  name: pip-audit
  description: "Audits Python environments and dependency trees for known vulnerabilities"
  entry: pip-audit
  language: python

i put it on the main branch in my fork, and it seems to work with a dummy client that uses this config:

repos:
-   repo: https://github.com/tal66/pip-audit
    rev: v2.1.1-3-g03a3d4c
    hooks:
    -   id: pip-audit

[cooperlees]

- id: pip-audit
  name: pip-audit
  description: "Audits Python environments and dependency trees for known vulnerabilities"
  entry: pip-audit
  language: python

I think we should also pass pass_filenames: false and have users supply the args. For example:

i put it on the main branch in my fork, and it seems to work with a dummy client that uses this config:

repos:
-   repo: https://github.com/tal66/pip-audit
    rev: v2.1.1-3-g03a3d4c
    hooks:
    -   id: pip-audit

Something like:

      args: ["-r", "requirements.txt"]
      # Or
      args: ["."]

Since i tested this I just put up the PR here #256. Thanks for starting the work tho!

[tal66]

cooperlees, are you a part of their team?

[woodruffw]

He's not, but all changes are welcome. Thanks @cooperlees!

[cooperlees]

FWIW - pre-commit.ci does not like how pip-audit uses pip: pre-commit/pre-commit#2368

Will see if we need to document that it's not supported there or see if it can be fixed.

• I feel it will work in my own action. I will do a PR updating docs if needed.