Exempt editable packages

Is your feature request related to a problem? Please describe.

We use pip-audit in the Manticore CI to check for security issues in our dependencies. This is fine for most of our development, but when we try to create a new release of Manticore, pip-audit fails. The problem is that the release PR we’re trying to check contains an incremented version number, but that version of Manticore hasn’t been published on PyPI yet, so pip-audit can’t check it for issues. Example

Describe the solution you’d like

Locally installed packages should be ignored when checking for security issues, since they may not have been published on PyPI.

Describe alternatives you’ve considered

I looked at removing the --strict flag, but this seems like a poor choice for running in a CI environment. The --local flag seems to make pip-audit only look at local packages.

Additional context The relevant lines from our ci.yml:

    - name: Run pip-audit
      run: |
        python -m pip install .
        pip-audit --strict --desc

[di]

I’ll leave this open to track whether we want to exempt editible packages (and have updated the title accordingly).

[ehennenfent]

This is correct; we want to audit only the packages Manticore depends on, and not Manticore itself. #81 would work for our purposes. I wouldn’t mind having an option to ignore packages installed via pip install -e <directory>, but if that’s out of scope for pip-audit, we can close in favor of #81.