Adding `pip-audit` fails with pre-commit.ci due to `pip` support

describe your issue

I added pip-audit to my pre-commit configuration for bandersnatch and the CI doesn’t like how it uses pip. Is there anyway we can tune the environment here or is this outside what pre-commit.ci offers? If so, should we document this and have users move back to running pre-commit in my own action/ci job?

• This all runs fine locally and I would imagine would in my own GitHub action

PR with failing action added: https://github.com/pypa/bandersnatch/pull/1116 pre-commit.ci job: https://results.pre-commit.ci/run/github/133377409/1651359348.J_Nu59G_RqyOHsV2bHdyoQ

Sorry if this is the wrong place to log issues for the .ci offering. This just seemed the best place from my quick searching etc.

pre-commit --version

Latest? Don’t know …

.pre-commit-config.yaml

https://github.com/pypa/bandersnatch/blob/pre-commit-pip-audit/.pre-commit-config.yaml#L41-L45

  - repo: https://github.com/trailofbits/pip-audit
    rev: bafa0f8
    hooks:
      -   id: pip-audit
          args: ["-r", "requirements.txt"]

pip-audit config: https://github.com/trailofbits/pip-audit/blob/main/.pre-commit-hooks.yaml

~/.cache/pre-commit/pre-commit.log (if present)

In the cloud.

[woodruffw]

pre-commit will always run it from an isolated environment so it doesn’t really make sense at all

That makes sense for the preconfigured environment case. For users who have frozen/completely hashed environments, either pip-audit -r ... --require-hashes or pip-audit -r ... --no-deps (upcoming: https://github.com/trailofbits/pip-audit/pull/255) will be roughly as fast since they don’t involve any dependency resolution.

But either way I leave it to you; there’s no significant advantage AFAICT to having pip-audit as a commit hook versus a CI task.

[asottile]

pre-commit will always run it from an isolated environment so it doesn’t really make sense at all