PR Custody

ci: guard runtime dependencies

@sjd9021checks n/achecks…codex/runtime-dependency-ci-guard → codex/onepassword-cli-service-account6 files · +776 −1updated 3w ago

GitHub

▸Description · 2 noise

Summary

add a sanity check that verifies app runtime imports are backed by direct pyproject dependencies
verify external CLI subprocess usage is backed by either a Lambda-baked binary or a direct package console script
add direct runtime dependency declarations for existing app imports/CLI usage so the check is clean in full-app mode
wire the common checks workflow to run for ci_checks, dependency manifests, and Lambda Dockerfile changes

Validation

.nox/chk_app/bin/ruff --config config/ruff.toml check ci_checks/lint_runtime_dependencies.py tests/test_lints/test_runtime_dependencies.py noxfile.py
.nox/chk_app/bin/ruff --config config/ruff.toml format ci_checks/lint_runtime_dependencies.py tests/test_lints/test_runtime_dependencies.py noxfile.py --check
.venv/bin/python -m pytest tests/test_lints/test_runtime_dependencies.py -q
.venv/bin/python ci_checks/lint_runtime_dependencies.py --all
.venv/bin/python -m compileall -q ci_checks/lint_runtime_dependencies.py tests/test_lints/test_runtime_dependencies.py

Note: local uv run nox -s snt reached ci_checks/lint_runtime_dependencies.py and it passed, but the overall local session failed on unrelated prerequisites: generated apps/_1password/config.json was absent for action_deletion, and OPENAI_API_KEY/Doppler was unavailable for lint_hardcoded_secrets_llm.

▸ 2 bot/status comments hidden

@socket-security[bot]3w ago

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

View full report

@socket-security[bot]3w ago

[!WARNING] Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

View full report

loading diff…