NAPALM/driver-standard
1
0 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: pilot findings (pip-audit scope, SPDX license, E501 in tests) #1

Merged
christianmanivong merged 2 commits from fix/pilot-findings into main 2026-10-22 19:10:48 +00:00
Conversation 0 Commits 2 Files Changed 8
+65 -17
christianmanivong commented 2026-10-22 17:14:56 +00:00
Owner
Copy link
Copy source

Summary

What the first pilot run (NAPALM/napalm-device-types#52) showed, fixed in the standard.

Changes

  • security: pip-audit checks a venv holding only the package and its dependencies.
    The pilot failed on the runner's own pip 25.0.1 in the tools venv, not on anything
    device-types brings.
  • check reports a license given as a TOML table or a License :: classifier
    (setuptools refuses both from 2027-02-18, PEP 639); template builds with setuptools>=77.
  • E501 is off under tests/: recorded device output keeps its lines.

Related Issue

NetOrk/netork#734

Testing

94 tests, ruff, mypy strict. The new pip-audit steps reproduced locally against
device-types: 43 packages audited, none vulnerable. The template builds and passes its own suite.

## Summary What the first pilot run (NAPALM/napalm-device-types#52) showed, fixed in the standard. ## Changes - `security`: pip-audit checks a venv holding only the package and its dependencies. The pilot failed on the runner's own pip 25.0.1 in the tools venv, not on anything device-types brings. - `check` reports a license given as a TOML table or a `License ::` classifier (setuptools refuses both from 2027-02-18, PEP 639); template builds with setuptools>=77. - E501 is off under `tests/`: recorded device output keeps its lines. ## Related Issue NetOrk/netork#734 ## Testing 94 tests, ruff, mypy strict. The new pip-audit steps reproduced locally against device-types: 43 packages audited, none vulnerable. The template builds and passes its own suite.
christianmanivong added 2 commits 2026-10-22 17:14:56 +00:00
fix(check): SPDX license string; E501 off in tests (device-types pilot) 0b21f62553 
The pilot's build warned that setuptools refuses a license table and
License classifiers from 2027-02-18 (PEP 639); check now reports both and
the template builds with setuptools>=77. Recorded device output in tests
keeps its lines, so the template turns E501 off under tests/.
fix(ci): audit the package's dependencies, not the tool venv
CI / test (3.12) (pull_request) Successful in 28s
Details
CI / test (3.13) (pull_request) Successful in 26s
Details
CI / test (3.11) (pull_request) Successful in 2m31s
Details
ba133d9de3 
The device-types pilot failed pip-audit on pip 25.0.1 of the venv that also
held bandit and pip-audit. The package now goes into a venv of its own with
a current pip; its frozen set (URL installs left out) is what pip-audit
checks.
christianmanivong merged commit a4858e9a1f into main 2026-10-22 19:10:48 +00:00
christianmanivong deleted branch fix/pilot-findings 2026-10-22 19:10:48 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is broken
 enhancement
New feature or request
 tech-debt
Refactoring / cleanup / deferred debt
prio
P0
Road blocker: blocks other work, drop everything
prio
P1
Critical
prio
P2
Important and urgent
prio
P3
Important, not urgent
prio
P4
Neither important nor urgent
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
christianmanivong
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: NAPALM/driver-standard#1