在写出这个问题之后,我搜索了一些并找到了 安全 ,这正是我想要的。
如果其他人正在为Django项目设置CircleCI并想要检查他们的软件包是否存在漏洞,这里是我在我的软件包中使用的配置 .circleci/config.yml :
.circleci/config.yml
version: 2 jobs: build: # build and run tests safety_check: docker: - image: circleci/python:3.6.1 steps: - checkout - run: command: | python3 -m venv env3 . env3/bin/activate pip install safety # specify requirements.txt safety check -r requirements.txt merge_master: # merge passing code into master workflows: version: 2 test_and_merge: jobs: - build: filters: branches: ignore: master - safety_check: filters: branches: ignore: master - merge_master: filters: branches: only: develop requires: - build # code is only merged if safety check passes - safety_check
要检查这是否有效,请运行 pip install insecure-package && pip freeze > requirements.txt 然后推动并观察Circle失败。
pip install insecure-package && pip freeze > requirements.txt