Description

Added Python dependency vulnerability scanning through pip-audit at both CI and local execution levels. A new reusable GitHub Actions workflow audits Python projects via uvx pip-audit@2.10.0, with change-detection optimization that skips audits when no dependency files changed. The workflow integrates into PR validation through a matrix job gated on discovered Python projects.

The existing dependency-review workflow gained a license allowlist of 13 OSI-approved SPDX identifiers and OSSF Scorecard display with a warning threshold. A local PowerShell wrapper (Invoke-PipAudit.ps1) mirrors the CI scanning behavior and exposes an audit:pip npm script for developer use. All new functionality includes 11 Pester tests covering discovery, audit execution, and orchestration paths.

CI Pipeline

The reusable workflow bridges the gap between uv-managed lock files and pip-audit's requirements.txt input using uv export.

• Added pip-audit.yml reusable workflow with working-directory, soft-fail, and changed-files-only inputs
• Implemented dependency-file change detection via git diff scoped to pyproject.toml, uv.lock, and requirements*.txt
• Pinned pip-audit to version 2.10.0, all actions SHA-pinned with version comments
  • actions/checkout v4.2.2, astral-sh/setup-uv v7.5.0, actions/setup-python v6.2.0, actions/upload-artifact v4.4.3
• Uploaded JSON audit results as artifacts with 30-day retention
• Set permissions: contents: read at workflow and job level

PR Validation Integration

• Wired pip-audit into pr-validation.yml as a matrix job calling the reusable workflow
• Gated on discover-python-projects output with fail-fast: false and changed-files-only: true

Dependency Review Hardening

• Added license allowlist to dependency-review.yml covering MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, BlueOak-1.0.0, CC0-1.0, Unlicense, CC-BY-4.0, CC-BY-3.0, PSF-2.0, and Python-2.0
• Enabled OSSF Scorecard display with warning threshold at level 3

Local Execution

• Added Invoke-PipAudit.ps1 with Find-PythonProjects, Invoke-PipAuditForProject, and Start-PipAudit functions
• Used try/finally for temporary requirements file cleanup in Invoke-PipAuditForProject
• Followed existing security-script conventions: comment-based help, copyright header, CIHelpers.psm1 import, dot-source guard
• Added audit:pip npm script to package.json

Testing

• Added 11 Pester tests in Invoke-PipAudit.Tests.ps1 across three describe blocks
• Covered project discovery (5 tests), audit execution (2 tests), and orchestration (4 tests)
• Used TestDrive isolation, CI annotation assertions, and dot-source testing pattern

Related Issue(s)

Closes #1020

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with prompt-builder agent and addressed all feedback
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)
• Copilot skill (.github/skills/*/SKILL.md)

Note for AI Artifact Contributors:

• Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.
• Skills: Must include both bash and PowerShell scripts. See Skills.
• Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.
• See Agents Not Accepted and Model Version Requirements.

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Sample Prompts (for AI Artifact Contributions)

Testing

All validation passed locally:

• Pester tests: 11/11 passing across Find-PythonProjects, Invoke-PipAuditForProject, and Start-PipAudit describe blocks
• PSScriptAnalyzer: Clean analysis on Invoke-PipAudit.ps1
• YAML validation: All workflow files validated
• Copyright headers: All new files include required headers

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

AI Artifact Contributions

• Used /prompt-analyze to review contribution
• Addressed all feedback from prompt-builder review
• Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Skill structure validation: npm run validate:skills
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps