ci: harden dependency audit sync checks

Assisted-by: Codex (model: GPT-5, autonomous)

Author: PascalThuet

.github/scripts/check_security_requirements.py

@@ -67,7 +67,15 @@ def main() -> int:
     if not _dependency_inputs_changed():
         return 0
 
-    generated_requirements = Path(os.environ["GENERATED_REQUIREMENTS"])
+    generated_requirements_env = os.environ.get("GENERATED_REQUIREMENTS", "").strip()
+    if not generated_requirements_env:
+        print(
+            "GENERATED_REQUIREMENTS must be set to the temporary output file path.",
+            file=sys.stderr,
+        )
+        return 1
+
+    generated_requirements = Path(generated_requirements_env)
     generated_requirements.parent.mkdir(parents=True, exist_ok=True)
 
     subprocess.run(

.github/security-audit-requirements.txt

@@ -2,9 +2,9 @@ annotated-doc==0.0.4 \
     --hash=sha256:571ac1dc6991c450b25a9c2d84a3705e2ae7a53467b5d111c24fa8baabbed320 \
     --hash=sha256:fbcda96e87e9c92ad167c2e53839e57503ecfda18804ea28102353485033faa4
     # via typer
-click==8.4.1 \
-    --hash=sha256:482be17c6991b8c19c5429a1e995d9b0efdbb63172824c41f99965dc0ade8ec2 \
-    --hash=sha256:918b5633eddf6b41c32d4f454bf0de810065c74e3f7dbf8ee5452f8be88d3e96
+click==8.4.2 \
+    --hash=sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6 \
+    --hash=sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76
     # via specify-cli (pyproject.toml)
 colorama==0.4.6 ; sys_platform == 'win32' \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
@@ -247,7 +247,7 @@ shellingham==1.5.4 \
     --hash=sha256:7ecfff8f2fd72616f7481040475a65b2bf8af90a56c89140852d1120324e8686 \
     --hash=sha256:8dbca0739d487e5bd35ab3ca4b36e11c4078f3a234bfce294b0a0291363404de
     # via typer
-typer==0.26.7 \
-    --hash=sha256:5c87cfbc5d34491c5346ebf49c23e18d56ccb863268d3a8d592b26087c2f5e58 \
-    --hash=sha256:e314a34c617e419c091b2830dda3ea1f257134ff593061a8f5b9717ab8dddb3a
+typer==0.26.8 \
+    --hash=sha256:3512ca79ac5c11113414b36e80281b872884477722440691c89d1112e321a49c \
+    --hash=sha256:c244a6bd558886fe3f8780efb6bdd28bb9aff005a94eedebaa5cb32926fe2f7e
     # via specify-cli (pyproject.toml)

.github/workflows/security.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          fetch-depth: 2
+          fetch-depth: 0
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0

tests/test_security_workflow.py

@@ -124,10 +124,10 @@ def test_dependency_audit_uses_committed_requirements_for_prs_and_pushes(self):
         assert "uv.lock" not in protection_text
         assert "/tmp/" not in protection_text
 
-    def test_dependency_audit_checkout_fetches_previous_commit(self):
+    def test_dependency_audit_checkout_fetches_full_history_for_diff_base(self):
         checkout = _step("dependency-audit", "Checkout")
 
-        assert checkout["with"]["fetch-depth"] == 2
+        assert checkout["with"]["fetch-depth"] == 0
 
     def test_security_workflow_triggers(self):
         triggers = _workflow_triggers()
@@ -253,6 +253,22 @@ def fake_run(command, **kwargs):
         assert "--output-file" in compile_commands[0]
         assert str(generated_requirements) in compile_commands[0]
 
+    def test_sync_script_reports_missing_generated_requirements_env(
+        self, monkeypatch, capsys
+    ):
+        sync_script = _load_sync_script()
+        monkeypatch.delenv("GENERATED_REQUIREMENTS", raising=False)
+
+        def fake_run(command, **_kwargs):
+            if command[0] == "git":
+                return subprocess.CompletedProcess(command, 0, stdout="pyproject.toml\n", stderr="")
+            raise AssertionError("compile should not run without GENERATED_REQUIREMENTS")
+
+        monkeypatch.setattr(sync_script.subprocess, "run", fake_run)
+
+        assert sync_script.main() == 1
+        assert "GENERATED_REQUIREMENTS must be set" in capsys.readouterr().err
+
     def test_sync_script_fails_when_generated_requirements_differ(
         self, monkeypatch, tmp_path, capsys
     ):