From e6a43a702d96e6d7f9d75fcbbce4d179e51411a2 Mon Sep 17 00:00:00 2001 From: ytwei Date: Sat, 22 Aug 2026 22:52:36 +0800 Subject: [PATCH 1/3] Add warn-only dependency audit to CI (#11) --- .github/workflows/ci.yml | 5 +++++ SECURITY.md | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index badc3c0..a8bf0cc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,6 +35,11 @@ jobs: run: | python -m pip install --upgrade pip pip install -e ".[dev]" + - name: Dependency audit (warn-only) + continue-on-error: true + run: | + pip install pip-audit + pip-audit - name: black run: black --check aura tests - name: flake8 diff --git a/SECURITY.md b/SECURITY.md index cc9c460..a5c5051 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -31,6 +31,12 @@ Out of scope: - Third-party models, tools, or adapters you attach to AURA - User agent code running under the harness +## Dependency auditing + +The pull request and main-branch CI workflow runs `pip-audit` against the installed Python dependencies. It is configured as a warn-only check with `continue-on-error: true` for one release cycle while the project establishes a clean baseline. A dependency finding therefore does not block CI yet; maintainers may make the check required once the baseline is clean. + +A green audit does not guarantee that every dependency is free of vulnerabilities. Keep dependencies updated and report vulnerabilities in AURA itself using the private reporting process above. + ## Audit logs Session exports may contain sensitive data from your agent runs. Store `.aura/sessions/` and export files with appropriate access controls. AURA does not encrypt logs by default in v0.1. From 62553afc0326d8a650c90a633d1a394e89ad4890 Mon Sep 17 00:00:00 2001 From: Yu-Tsen Wei <59054102+frobel0520@users.noreply.github.com> Date: Sun, 23 Aug 2026 20:00:04 +0800 Subject: [PATCH 2/3] Docs: document warn-only dependency audit in CONTRIBUTING Explain the advisory pip-audit step and its non-blocking behavior in PR CI. --- CONTRIBUTING.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b57f77b..e84c7bf 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -132,7 +132,7 @@ Follow the [Code of Conduct](CODE_OF_CONDUCT.md). We welcome autonomous logical - Shared fixtures: **`tests/conftest.py`** (`aura_home`, `run_aura` for CLI subprocess tests). - Full suite is **64+ tests** across `test_core.py`, `test_core_gaps.py`, `test_v02.py`, `test_v03.py`, `test_cli.py`, `test_examples_smoke.py` — see [TESTING.md](docs/TESTING.md). -- CI runs on PRs via [`.github/workflows/ci.yml`](.github/workflows/ci.yml) (Python **3.10–3.13** matrix; gate job **`lint-test`**: pytest with coverage report, black, flake8). See [TESTING.md](docs/TESTING.md). +- CI runs on PRs via [`.github/workflows/ci.yml`](.github/workflows/ci.yml) (Python **3.10–3.13** matrix; gate job **`lint-test`**: pytest with coverage report, black, flake8). Each matrix cell also runs `pip-audit` as a warn-only dependency check; its findings or audit errors do not fail the gate or block a PR. See [TESTING.md](docs/TESTING.md) for the exact commands. - Wait for green checks before requesting review. ### CHANGELOG @@ -254,3 +254,4 @@ Contributor PRs must **not** bump version unless asked. Maintainers cut releases | `README.md` install pin examples | Optional | Thank you for helping make agent runs auditable, policy-bound, and portable. + From 753ee67674617836ffa6f1a64f8c827fa0a311c9 Mon Sep 17 00:00:00 2001 From: Yu-Tsen Wei <59054102+frobel0520@users.noreply.github.com> Date: Sun, 23 Aug 2026 20:00:59 +0800 Subject: [PATCH 3/3] Docs: document warn-only dependency audit in TESTING Document the advisory pip-audit command and its non-blocking CI behavior. --- docs/TESTING.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/docs/TESTING.md b/docs/TESTING.md index e74c243..7624208 100644 --- a/docs/TESTING.md +++ b/docs/TESTING.md @@ -22,7 +22,7 @@ black aura tests flake8 aura tests ``` -CI expectation: **pytest**, **black**, and **flake8** all pass on `aura/` and `tests/` for every supported Python version. +CI expectation: **pytest**, **black**, and **flake8** all pass on `aura/` and `tests/` for every supported Python version. The dependency audit is advisory: `pip-audit` reports findings without blocking the CI gate. ## Continuous integration @@ -41,16 +41,25 @@ Each cell runs the same steps: ```bash pip install -e ".[dev]" +pip install pip-audit +pip-audit # warn-only; does not block the CI gate black --check aura tests flake8 aura tests pytest --cov=aura --cov-report=term-missing ``` +The **Dependency audit (warn-only)** step runs `pip-audit` with +`continue-on-error: true`. A vulnerability finding or audit error is therefore +reported in the workflow logs but does not fail the matrix or block a PR from +merging. Treat the output as a prompt to investigate and update dependencies; +use the private reporting path in [SECURITY.md](../SECURITY.md) for a suspected +vulnerability in AURA itself. + The workflow also emits a gate job named **`lint-test`** that succeeds only when every matrix cell passed. That is the check to require in branch protection. **Fork PRs:** the workflow uses `permissions: contents: read` only — no repository secrets, no PyPI OIDC, no deploy environment. -**Publish workflow:** [`.github/workflows/publish-pypi.yml`](../.github/workflows/publish-pypi.yml) runs the same install/lint/test commands on a single Python 3.12 before release upload. Full 3.10–3.13 coverage is the PR CI matrix; keep the *commands* in sync until a reusable workflow lands (separate CI follow-up issue). +**Publish workflow:** [`.github/workflows/publish-pypi.yml`](../.github/workflows/publish-pypi.yml) runs the same install/lint/test commands on a single Python 3.12 before release upload. The advisory `pip-audit` step belongs to PR CI and is not a release-blocking check. Full 3.10–3.13 coverage is the PR CI matrix; keep the *commands* in sync until a reusable workflow lands (separate CI follow-up issue). **Maintainers:** after the first green `lint-test` run on `main`, enable **branch protection** → required status check **`lint-test`**. @@ -92,3 +101,4 @@ The workflow also emits a gate job named **`lint-test`** that succeeds only when 3. `flake8 aura tests` 4. CHANGELOG entry under `[Unreleased]` or release section 5. Docs updated if behavior or CLI changed +