Repository: mdabrowski1990/uds (language: python)

Issue:
Extend dependency scaning - add pip-audit
# Description
As a user, I would like to have [pip-audit](https://github.com/pypa/pip-audit) as a tool for dependency scanning, so I have more trust into this package security.

# Testing
- CI\CD is running and passing

# Acceptance Criteria
- pip-audit checks are added to CI/CD pipelines and executed on every pull_request and push
- dependencies are adjusted (if needed)


Discussion / hints:

Fix patch:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 24afec9a..9ee1b299 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-name: CI
+name: Testing
 
 
 on: [push, pull_request]
@@ -28,7 +28,7 @@ jobs:
 
       - name: Install external packages used for dynamic tests
         run: |
-          pip install -r tests/requirements_for_software_tests.txt
+          pip install .[test]
 
       - name: Execute unit tests with coverage report [pytest]
         run: |
@@ -50,10 +50,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set up Python 3.11
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: 3.11
+          python-version: 3.12
 
       - name: Install project dependencies
         run: |
@@ -63,7 +63,7 @@ jobs:
 
       - name: Install external packages used for dynamic tests
         run: |
-          pip install -r tests/requirements_for_software_tests.txt
+          pip install .[test]
 
       - name: Prepare coverage uploader [CodeCov]
         run: |
@@ -127,7 +127,7 @@ jobs:
 
       - name: Install external packages used for static tests
         run: |
-          pip install -r tests/requirements_for_static_code_analysis.txt
+          pip install .[static-code-analysis]
 
       - name: Execute static code analysis [prospector]
         run: |
@@ -150,8 +150,13 @@ jobs:
 
       - name: Install external packages used for dependency scanning
         run: |
-          pip install -r tests/requirements_for_dependency_scanning.txt
+          python -m pip install --upgrade pip
+          pip install .[dependency-scan]
 
       - name: Execute dependency scanning [safety]
         run: |
           safety check -r requirements.txt
+
+      - name: Execute dependency scanning [pip-audit]
+        run: |
+          pip-audit
\ No newline at end of file
diff --git a/pyproject.toml b/pyproject.toml
index 3b251257..5a444e0f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -81,6 +81,7 @@ static-code-analysis = [
 ]
 dependency-scan = [
     "safety == 3.1.0",
+    "pip-audit == 2.7.3",
 ]
 
 


Test patch:
diff --git a/tests/requirements_for_dependency_scanning.txt b/tests/requirements_for_dependency_scanning.txt
deleted file mode 100644
index 34b1dca7..00000000
--- a/tests/requirements_for_dependency_scanning.txt
+++ /dev/null
@@ -1,1 +0,0 @@
-safety==3.1.0
\ No newline at end of file
diff --git a/tests/requirements_for_software_tests.txt b/tests/requirements_for_software_tests.txt
deleted file mode 100644
index e271c41e..00000000
--- a/tests/requirements_for_software_tests.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-mock==5.*
-pytest==8.*
-pytest-cov==5.*
-pytest-asyncio>=0.17.2
diff --git a/tests/requirements_for_static_code_analysis.txt b/tests/requirements_for_static_code_analysis.txt
deleted file mode 100644
index 0675b3c2..00000000
--- a/tests/requirements_for_static_code_analysis.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-prospector==1.10.3
-mypy==1.9.0
-vulture==2.11
-bandit==1.7.8
-pyroma==4.2
\ No newline at end of file