📦🔒️ Ignore known pip vulnerability in security audits

Add --ignore-vuln flag for GHSA-4xh5-x5gv-qwph across all pip-audit
commands in CI workflows and justfile. This vulnerability affects pip
itself (not a pinned requirement) and is already fixed in recent Python
versions.

Author: tsvikas

project_name/.github/workflows/ci.yml.jinja

@@ -90,7 +90,15 @@ jobs:
       - name: Run deptry
         run: uv run --no-sync --with deptry deptry src/
       - name: Run pip-audit
-        run: uv run --no-sync --with pip-audit pip-audit --skip-editable
+        run: >-
+          uv run --no-sync --with pip-audit pip-audit --skip-editable
+          --ignore-vuln GHSA-4xh5-x5gv-qwph
+        # pip-audit ignored vuln:
+        # GHSA-4xh5-x5gv-qwph:
+        #   vuln is in pip, which is not a pinned requirwement
+        #   vuln is fixed in recent python versions
+        #   see https://github.com/pypa/pip/issues/13607
+
 
   test:
     strategy:

project_name/.github/workflows/weekly-ci.yml.jinja

@@ -101,7 +101,14 @@ jobs:
       - name: List packages
         run: uv pip list
       - name: Run pip-audit
-        run: uv run --no-sync --with pip-audit pip-audit --skip-editable
+        run: >-
+          uv run --no-sync --with pip-audit pip-audit --skip-editable
+          --ignore-vuln GHSA-4xh5-x5gv-qwph
+        # pip-audit ignored vuln:
+        # GHSA-4xh5-x5gv-qwph:
+        #   vuln is in pip, which is not a pinned requirwement
+        #   vuln is fixed in recent python versions
+        #   see https://github.com/pypa/pip/issues/13607
       - name: Create failure issue
         if: failure()
         uses: actions/github-script@v8

project_name/justfile.jinja

@@ -81,7 +81,13 @@ lint:
   uv run ruff check
   uv run dmypy run
   uv run --all-extras --all-groups --with deptry deptry src/
-  uv run --all-extras --all-groups --with pip-audit pip-audit --skip-editable
+  uv run --all-extras --all-groups --with pip-audit pip-audit --skip-editable \
+    --ignore-vuln GHSA-4xh5-x5gv-qwph
+  # pip-audit ignored vuln:
+  # GHSA-4xh5-x5gv-qwph:
+  #   vuln is in pip, which is not a pinned requirwement
+  #   vuln is fixed in recent python versions
+  #   see https://github.com/pypa/pip/issues/13607
   uv run pre-commit run --all-files
 
 # Run Pylint (slow, not used in other tasks)