fix: stop setting UV_PYTHON for the caller's job

.github/dependabot.yml

@@ -34,7 +34,8 @@ updates:
         applies-to: security-updates
         patterns: ["*"]
 
-  # integration-tests/cases/* are deliberately pinned fixtures: never update them.
+  # integration-tests/cases/* are fixtures: never update them. The vulnerable ones are pinned
+  # on purpose; the clean ones are unpinned and unlocked, so CI audits the latest releases.
   # `ignore` also applies to security updates. Directories are listed explicitly per
   # ecosystem: a glob would also match cases without a manifest for that ecosystem.
   - package-ecosystem: pip # requirements.txt, poetry and pipenv cases

action.yml

@@ -46,10 +46,10 @@ runs:
       shell: bash
       run: rm -f -- "$GITHUB_WORKSPACE/results.sarif"
 
+    # No `python-version` here: it sets UV_PYTHON for the rest of the caller's job, overriding
+    # their project's Python. The audit step passes --python instead.
     - name: Set up uv
       uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
-      with:
-        python-version: '3.13'
 
     - name: Run security audit
       id: audit
@@ -69,7 +69,7 @@ runs:
         PR_NUMBER: ${{ github.event.pull_request.number }}
         INPUT_DEBUG: ${{ inputs.debug }}
         RUNNER_DEBUG: ${{ runner.debug }}
-      run: uv run --no-project --with "$GITHUB_ACTION_PATH" python -m python_security_auditing
+      run: uv run --python 3.13 --no-project --with "$GITHUB_ACTION_PATH" python -m python_security_auditing
 
     # results.sarif exists only if bandit scanned every file in this job: the first step removes
     # an earlier one, and the audit deletes it when bandit fails or skips files (an empty or

integration-tests/cases/01-requirements-flat/README.md

@@ -6,7 +6,7 @@
 
 ## What this tests
 
-- Basic `requirements.txt` with pinned safe versions
+- Basic `requirements.txt` with minimum versions (`>=`), so it audits the latest releases
 - Bandit scans the flat project directory (no src/ subdirectory)
 - pip-audit finds no vulnerabilities
 

integration-tests/cases/01-requirements-flat/requirements.txt

@@ -1,2 +1,2 @@
-requests==2.33.0
-click==8.3.3
+requests>=2.33.0
+click>=8.3.3

integration-tests/cases/02-requirements-src-bandit/requirements.txt

@@ -1,2 +1,2 @@
-httpx==0.27.0
-click==8.3.3
+httpx>=0.27.0
+click>=8.3.3

integration-tests/cases/06-uv-multi-bandit/README.md

@@ -10,7 +10,7 @@
 - MEDIUM severity threshold (lower than default HIGH) catches B324 and B506
 - `uv export` produces clean deps — no pip-audit failures
 - `pip_audit_block_on: none` ensures only bandit can fail this job
-- `uv.lock` is committed — tests the action with a pre-existing lockfile
+- `uv.lock` is **not committed**: CI generates it (`uv lock`), so the case audits the latest releases
 
 ## Intentional issues
 

integration-tests/cases/09-pipenv-flat/README.md

@@ -9,4 +9,4 @@
 - `pipenv requirements` correctly reads `Pipfile.lock` and exports deps
 - Bandit scans the flat project directory
 - No bandit issues, no vulnerable deps
-- `Pipfile.lock` is **committed** — tests the action with a pre-existing lockfile
+- `Pipfile.lock` is **not committed**: CI generates it (`pipenv install`), so the case audits the latest releases

integration-tests/cases/11-requirements-root/requirements.txt

@@ -1 +1 @@
-flask==3.1.3
+flask>=3.1.3