From 0ec675e9c567a460a66a920489c458b3fb053d70 Mon Sep 17 00:00:00 2001 From: grabowski Date: Fri, 11 Sep 2026 23:54:44 +0200 Subject: [PATCH] ci: license report from a clean venv, not the runner's site-packages --- .gitea/workflows/security.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml index c54f624..67af970 100644 --- a/.gitea/workflows/security.yml +++ b/.gitea/workflows/security.yml @@ -84,17 +84,22 @@ jobs: cache: pip cache-dependency-path: requirements.txt - - name: Install + # A fresh venv, not the runner's site-packages: the report must list the + # project's runtime deps, not whatever the runner image or a previous + # workflow happened to leave installed (semgrep once showed up here). + - name: Install into a clean venv run: | - python -m pip install --upgrade pip --root-user-action=ignore + python -m venv .lic && . .lic/bin/activate + pip install --upgrade pip --root-user-action=ignore pip install --root-user-action=ignore -r requirements.txt pip-licenses - name: Report run: | + . .lic/bin/activate pip-licenses --format=markdown --with-urls --output-file=licenses.md pip-licenses --format=json --output-file=licenses.json - echo "Copyleft licenses among runtime deps (informational):" - pip-licenses --format=plain | grep -iE 'GPL|AGPL|LGPL' || echo " none" + echo "Copyleft licenses among runtime deps (informational; LGPL is fine to link from MIT):" + pip-licenses --format=plain --ignore-packages pip-licenses | grep -iE 'GPL|AGPL|LGPL' || echo " none" - uses: actions/upload-artifact@v3 with: