Run safety via pre-commit

Running safety from the same environment that it is supposed to scan is problematic, as malicious dependencies can modify safety to hide vulnerabilities. This is CVE-2020-5252. Safety can be run manually with: poetry export --with=dev -E container -E freeipa-vault | safety check -r -
yrro · Feb 18, 2023 · ff28f39 · ff28f39
1 parent e9d2486
commit ff28f39
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 151 deletions.
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -23,3 +23,7 @@ repos:
     additional_dependencies:
     - Flake8-pyproject
     language_version: python3
+- repo: https://github.com/Lucas-C/pre-commit-hooks-safety
+  rev: v1.3.1
+  hooks:
+  - id: python-safety-dependencies-check
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -19,7 +19,6 @@ ipaclient = {version = "^4.8.9", optional = true}
 
 [tool.poetry.group.dev.dependencies]
 httpie = "^3.2.1"
-safety = "^2.0.0"
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]