From c761dede1d402ad2f87e454cc9134395025aaf7d Mon Sep 17 00:00:00 2001
From: Kevin Allioli <kevin@stackops.ch>
Date: Mon, 27 Apr 2026 12:08:06 +0200
Subject: [PATCH] ci(security): audit only declared runtime deps, not the
 runner env
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The security job ran ``pip-audit --skip-editable``, which audits every
package installed in the job's Python — pip, setuptools, wheel, and
the rest of the tooling — alongside orca's actual runtime deps. The
build then fails on advisories in that tooling: most recently
CVE-2026-3219 in ``pip 26.0.1``, which has nothing to do with orca's
supply chain.

Switch to exporting orca's declared runtime deps via
``poetry export --only main`` and audit that requirements file
directly. The audit surface now matches what users actually install
when they ``pip install orca-openstackclient``; tooling vulns in the
runner can no longer block PRs.

``poetry-plugin-export`` is pinned (``>=1.7``) because it's bundled
in poetry < 2.0 but split out in poetry 2.x — the explicit install
makes the step work on either side of that boundary.
---
 .github/workflows/ci.yml | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index defb673..366096e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -140,15 +140,21 @@ jobs:
           python-version: "3.11"
           cache: pip
 
-      - name: Install project + pip-audit
-        run: |
-          pip install -e .
-          pip install pip-audit
+      - name: Install poetry + pip-audit
+        # poetry-plugin-export is bundled in poetry < 2.0 but split out in
+        # poetry 2.x; pin it explicitly so this works on either side of
+        # that boundary.
+        run: pip install poetry "poetry-plugin-export>=1.7" pip-audit
+
+      - name: Export runtime requirements
+        # Audit only what we actually ship — orca's declared runtime deps —
+        # rather than the runner's whole environment. The previous
+        # ``pip-audit --skip-editable`` invocation walked every package
+        # installed in the job's Python (pip, setuptools, wheel, …) and
+        # failed the build on advisories in the tooling itself, e.g.
+        # CVE-2026-3219 in pip 26.0.1. Those have nothing to do with
+        # orca's supply chain.
+        run: poetry export --format requirements.txt --without-hashes --only main --output /tmp/runtime-requirements.txt
 
       - name: Audit runtime dependencies
-        # --skip-editable excludes our own package (installed via -e .) —
-        # pip-audit would otherwise try to resolve it against PyPI. We drop
-        # --strict because it would turn that skip into a fatal error;
-        # pip-audit still exits non-zero on actual CVE findings, which is
-        # what we want to fail the build on.
-        run: pip-audit --skip-editable
+        run: pip-audit --requirement /tmp/runtime-requirements.txt