feat: integrate security audits into pre-commit and CI/CD with backend pip-audit migration #74

Merged

darkhelm merged 5 commits from feat/security-audit-precommit-cicd into main 2026-07-13 22:20:10 -04:00

Conversation 0 Commits 5 Files Changed 15 +519 -69

darkhelm commented 2026-07-13 14:47:26 -04:00

Owner

Copy Link

Summary

This PR integrates security-focused checks into the existing quality gates and aligns local workflows with CI/CD execution.

What changed

• Added Bandit to pre-commit backend checks.
• Integrated eslint-plugin-security into the existing frontend ESLint setup used by pre-commit.
• Added dedicated audit tasks:
  • backend audit via pip-audit
  • frontend audit via yarn npm audit
• Updated CI/CD workflow to include and gate on frontend/backend audit jobs.
• Switched backend vulnerability scanning from Safety to pip-audit to avoid interactive/auth requirements in CI.
• Updated backend dependency set and lockfile to resolve test dependency conflicts and keep the environment solvable.
• Marked backend integration API tests with the integration marker so marker-based unit/integration separation works consistently.

Validation

• Pre-commit hooks run and pass after formatting/autofixes.
• Branch commit created successfully after hook-driven file updates.
• Branch pushed to remote and tracking is configured.

Notes

• pip-audit now executes from backend context (for example via uv --directory backend run ...), matching project layout.
• Remaining reported vulnerabilities depend on upstream package fix availability/constraints and may require follow-up once publishable fix versions are consumable.

Follow-ups (optional)

• Add a curated pip-audit ignore policy for non-actionable/transient advisories with rationale.
• Open a focused follow-up PR for remaining dependency advisories once upstream fixes are practically installable.

## Summary This PR integrates security-focused checks into the existing quality gates and aligns local workflows with CI/CD execution. ## What changed - Added Bandit to pre-commit backend checks. - Integrated eslint-plugin-security into the existing frontend ESLint setup used by pre-commit. - Added dedicated audit tasks: - backend audit via pip-audit - frontend audit via yarn npm audit - Updated CI/CD workflow to include and gate on frontend/backend audit jobs. - Switched backend vulnerability scanning from Safety to pip-audit to avoid interactive/auth requirements in CI. - Updated backend dependency set and lockfile to resolve test dependency conflicts and keep the environment solvable. - Marked backend integration API tests with the integration marker so marker-based unit/integration separation works consistently. ## Validation - Pre-commit hooks run and pass after formatting/autofixes. - Branch commit created successfully after hook-driven file updates. - Branch pushed to remote and tracking is configured. ## Notes - pip-audit now executes from backend context (for example via uv --directory backend run ...), matching project layout. - Remaining reported vulnerabilities depend on upstream package fix availability/constraints and may require follow-up once publishable fix versions are consumable. ## Follow-ups (optional) - Add a curated pip-audit ignore policy for non-actionable/transient advisories with rationale. - Open a focused follow-up PR for remaining dependency advisories once upstream fixes are practically installable.

copilotcoder was assigned by darkhelm 2026-07-13 14:47:27 -04:00

darkhelm added 1 commit 2026-07-13 14:47:33 -04:00

feat: integrate security audits across pre-commit and CI c2ff0a1699

darkhelm changed title from eat: integrate security audits into pre-commit and CI/CD with backend pip-audit migration to feat: integrate security audits into pre-commit and CI/CD with backend pip-audit migration 2026-07-13 14:49:20 -04:00

darkhelm added 1 commit 2026-07-13 15:50:37 -04:00

fix: harden renovate datasource access and registry reliability 8c925d2b39

darkhelm added 1 commit 2026-07-13 17:33:22 -04:00

perf: reduce renovate datasource latency and timeout impact fd46194673

darkhelm added 1 commit 2026-07-13 21:39:58 -04:00

perf: split renovate into low-memory manager batches 9f9d2dbf45

darkhelm added 1 commit 2026-07-13 21:52:29 -04:00

chore: include quick renovate check script update 343966d8e6

darkhelm merged commit f627ef018a into main 2026-07-13 22:20:10 -04:00

darkhelm referenced this issue from a commit 2026-07-13 22:20:16 -04:00

feat: integrate security audits into pre-commit and CI/CD with backend pip-audit migration (#74)

darkhelm deleted branch feat/security-audit-precommit-cicd 2026-07-13 22:20:26 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

afk

Autonomous-friendly issue

algorithm

Selection logic

api

API contract

backend

Backend related

database

Database related

devex

Developer experience

docs

Documentation

epic

Top-level planning item

frontend

Frontend related

hitl

Requires human-in-the-loop decision

ingestion

Ingestion/sync

ops

Operations

performance

Performance

realtime

Realtime/eventing

release

Release readiness

security

Security

task

Implementation ticket

testing

Testing

ui

UI/UX

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

copilotcoder darkhelm renovate-bot repository-bot

No Assignees copilotcoder

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DarkHelm.org/plex-playlist#74