fix(dependency-audit): pin pip-audit Python to 3.13 instead of floating 3.x

Merged
DO
21h ago
+21-1

Problem

dependency-audit-reusable.yml set up Python with python-version: "3.x", which now resolves to 3.15. 3.15 removed sre_constants; pip-api==0.0.34 (pinned in this repo's own hash-locked scripts/pip-audit-requirements.txt, and in some consumer repos) ships a vendored pyparsing that imports it, so pip-audit crashes:

ModuleNotFoundError: No module named 'sre_constants'

Seen on main in combsmith/broodminder-data, probably in combsmith/empower-personal-dashboard too (not verified).

Change

  • New workflow_call input python-version, default "3.13". It follows the pattern of agentshield-version in agent-shield-reusable.yml, so a caller can override it. The single setup-python step (audit-pip) now uses it.
  • Header comment records the pin next to the other pinned tool versions.
  • New bats test in test/workflows/dependency-audit/: the input default must be a concrete 3.N, and every setup-python step must use the input. I checked that the test fails against the old "3.x".
  • Checked that all 26 hash-locked wheels in scripts/pip-audit-requirements.txt resolve for cp313 / manylinux x86_64 with --only-binary :all: --require-hashes.

Rollout

This reaches callers only after the dependency-audit channel is promoted (standards/workflows/dependency-audit.yml pins @dependency-audit/v2-stable; latest release is dependency-audit/v2.9.0). No tags were moved here.

Other floating-Python spots (out of scope, not changed)

  • standards/ci-standards.md §"Python" CI example uses python-version: '3.x'. It's a generic per-repo CI template, not audit tooling. It has no consumers right now ("Repos using this pattern: none").
  • standards/workflows/copilot-setup-steps.yml only has a commented-out example that's already pinned ("3.12"). Fine as is.
  • Related: scripts/pip-audit-requirements.txt still pins pip-api==0.0.34. With Python pinned it's harmless, but bumping to 0.0.35 (as combsmith/broodminder-data#236 does) would remove the 3.15 incompatibility itself. Left for a separate PR to keep this diff small.

🤖 Generated with Claude Code