fix(SEC-004): stop shipping pytest in the production image - #122
Merged
Merged
Conversation
`requirements.txt` declared `pytest` as a runtime dependency under a "Test runner." heading. The Dockerfile installs `requirements.txt` and nothing else, so the test runner and its dependency tree were baked into the deployed image - on both the Render web service and the daily-scan cron. It was already declared in `requirements-dev.txt`, so this was a duplicate that bought nothing and only widened the production surface. Remove it, and add a policy guard so it cannot drift back. The guard checks the whole class of developer tooling (pytest, pytest-cov, ruff, bandit, pip-audit, mypy, pre-commit) and asserts each one is absent from requirements.txt AND still present in requirements-dev.txt - so the fix cannot be "solved" by deleting the dependency outright either. Verified by re-adding pytest to requirements.txt and watching the guard fail. The existing `constraints.txt` pin for pytest is untouched and still correct: constraints only pin versions for whatever is actually being installed, and CI installs both requirements files. Closes #121 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
DoRmAmMu1997
commented
Sep 8, 2026
DoRmAmMu1997
left a comment
DoRmAmMu1997
left a comment
Owner
Author
There was a problem hiding this comment.
Review finding: the development-tool guard matches only bare requirement lines, so versioned, commented, marked, and normalized spellings can bypass it (for example pytest==9.1.1 and pytest_cov). The production removal itself is correct. Strengthen name extraction and test both runtime exclusion and development presence, with beginner-friendly explanations.
Evidence: tests/test_supply_chain_policy.py at the reviewed head. This is a policy-test gap, not an existing production vulnerability.
Normalize project names across versions, extras, markers, comments and equivalent punctuation; exercise both runtime exclusion and development presence through the real guard. Explain the original failure and the policy boundary in beginner-friendly docstrings. Co-authored-by: Codex <codex@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #121.
The production image installed pytest through the runtime requirements. Keep it in development requirements and enforce both sides of that separation: verification tools must be absent from runtime inputs and present in development inputs.
The guard now compares normalized project names, so versions, extras, environment markers, inline comments, case, and equivalent dot/underscore/hyphen spellings cannot hide a declaration. Regressions exercise the real guard with in-memory requirements text. Google-style helper documentation and Beginner notes explain the failure cases.
Validation:
The original pytest-removal change is retained. Optional indicator dependency maintenance is tracked separately in the approved modernization plan.
Original PR developed with Claude Code; this follow-up is co-authored by Codex.