Add nox target for auditing workspaces in reagard to known vulnerabilities (#347)

Author: Jannis-Mittenzwei

.github/workflows/checks.yml

@@ -117,6 +117,25 @@ jobs:
           path: .security.json
           include-hidden-files: true
 
+  Vulnerabilities:
+    name: Check Vulnerabilities (Python-${{ matrix.python-version }})
+    needs: [ Version-Check, build-matrix ]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix: ${{ fromJson(needs.build-matrix.outputs.matrix) }}
+
+    steps:
+      - name: SCM Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python & Poetry Environment
+        uses: ./.github/actions/python-environment
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Run Package vulnerabilities Check
+        run: poetry run nox -s dependency:audit
+
   Format:
     name: Format Check
     runs-on: ubuntu-latest

doc/changes/unreleased.md

@@ -1 +1,5 @@
 # Unreleased
+
+## ✨ Added
+
+* [#73](https://github.com/exasol/python-toolbox/issues/73): Added nox target for auditing work spaces in regard to known vulnerabilities

exasol/toolbox/nox/_dependencies.py

@@ -212,10 +212,20 @@ def _normalize_package_name(name: str) -> str:
     return template.format(heading=heading(), rows=rows)
 
 
+def _audit(session: Session) -> None:
+    session.run("poetry", "run", "pip-audit")
+
+
 @nox.session(name="dependency:licenses", python=False)
 def dependency_licenses(session: Session) -> None:
     """returns the packages and their licenses"""
     toml = Path("pyproject.toml")
     dependencies = _dependencies(toml.read_text())
     package_infos = _licenses()
     print(_packages_to_markdown(dependencies=dependencies, packages=package_infos))
+
+
+@nox.session(name="dependency:audit", python=False)
+def audit(session: Session) -> None:
+    """Check for known vulnerabilities"""
+    _audit(session)

exasol/toolbox/nox/tasks.py

@@ -81,6 +81,7 @@ def check(session: Session) -> None:
 
 from exasol.toolbox.nox._dependencies import (
     dependency_licenses,
+    audit
 )
 
 # isort: on

exasol/toolbox/templates/github/workflows/checks.yml

@@ -123,6 +123,25 @@ jobs:
           path: .security.json
           include-hidden-files: true
 
+  Vulnerabilities:
+    name: Check Vulnerabilities (Python-${{ matrix.python-version }})
+    needs: [ Version-Check, build-matrix ]
+    runs-on: ubuntu-latest
+    strategy:
+      matrix: ${{ fromJson(needs.build-matrix.outputs.matrix) }}
+
+    steps:
+      - name: SCM Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python & Poetry Environment
+        uses: ./.github/actions/python-environment
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Run Package vulnerabilities Check
+        run: poetry run nox -s dependency:audit
+
   Format:
     name: Format Check
     runs-on: ubuntu-latest

poetry.lock

@@ -59,6 +59,7 @@ typer = {extras = ["all"], version = ">=0.7.0"}
 bandit = {extras = ["toml"], version = "^1.7.9"}
 jinja2 = "^3.1.4"
 pip-licenses = "^5.0.0"
+pip-audit = "^2.7.3"
 
 [tool.poetry.group.dev.dependencies]
 autoimport = "^1.4.0"