Skip to content

Conversation

@Pymetheus
Copy link
Owner

Description

Simplify the security workflow by removing the astral-sh/setup-uv steps and the uv sync/export flow. Instead of installing individual packages, the workflow now runs pip install -e . --group dev and pip freeze > requirements.txt to produce a requirements.txt file for Snyk scanning. This reduces duplication and uses the project's dev extras for dependency installation.
This change assures Snyk has all required dependencies.

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Code refactoring
  • Performance improvement
  • Test addition or update

Related Issue

Snyk was silently failing with exit code 2, as dependency installation with uv was not sufficient

Changes Made

  • updated security workflow with pip install -e . --group dev and pip freeze > requirements.txt for Snyk scanning

Testing

Describe how you tested your changes:

  • Unit tests pass
  • Integration tests pass
  • Manual testing performed

Screenshots (if applicable)

Add screenshots to help explain your changes.

Checklist

  • My code follows the project's style guidelines
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have updated the documentation accordingly
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

Additional Context

Add any other context about the PR here.

Simplify the security workflow by removing the astral-sh/setup-uv steps and the uv sync/export flow. Instead of installing individual packages, the workflow now runs `pip install -e . --group dev` and `pip freeze > requirements.txt` to produce a requirements.txt file for Snyk scanning. This reduces duplication and uses the project's dev extras for dependency installation.
@github-actions github-actions bot added the ci Types: CI/CD workflow or pipeline changes label Feb 8, 2026
@codecov
Copy link

codecov bot commented Feb 8, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@Pymetheus Pymetheus merged commit 5612a09 into main Feb 8, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci Types: CI/CD workflow or pipeline changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant