ci(release): add OSV pass to dependency audit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/beta.yml

@@ -27,6 +27,10 @@ jobs:
           uvx --from pip-audit pip-audit \
             --require-hashes --disable-pip --strict --progress-spinner off \
             --requirement /tmp/moviepilot-audit-standard.txt
+          # PyPI 服务校验哈希但公告覆盖不全（曾漏报 Mako PYSEC-2026-4243），再用 OSV 补查一遍。
+          uvx --from pip-audit pip-audit \
+            --vulnerability-service osv --require-hashes --disable-pip --strict --progress-spinner off \
+            --requirement /tmp/moviepilot-audit-standard.txt
 
           uv export --quiet --locked --no-default-groups --group runtime-free-threaded \
             --no-emit-project --no-hashes \
@@ -38,6 +42,9 @@ jobs:
           uvx --from pip-audit pip-audit \
             --no-deps --disable-pip --strict --progress-spinner off \
             --requirement /tmp/moviepilot-audit-free-threaded-normalized.txt
+          uvx --from pip-audit pip-audit \
+            --vulnerability-service osv --no-deps --disable-pip --strict --progress-spinner off \
+            --requirement /tmp/moviepilot-audit-free-threaded-normalized.txt
 
       - name: Release version
         id: release_version

.github/workflows/build-v3.yml

@@ -77,6 +77,10 @@ jobs:
           uvx --from pip-audit pip-audit \
             --require-hashes --disable-pip --strict --progress-spinner off \
             --requirement /tmp/moviepilot-audit-standard.txt
+          # PyPI 服务校验哈希但公告覆盖不全（曾漏报 Mako PYSEC-2026-4243），再用 OSV 补查一遍。
+          uvx --from pip-audit pip-audit \
+            --vulnerability-service osv --require-hashes --disable-pip --strict --progress-spinner off \
+            --requirement /tmp/moviepilot-audit-standard.txt
 
           uv export --quiet --locked --no-default-groups --group runtime-free-threaded \
             --no-emit-project --no-hashes \
@@ -88,6 +92,9 @@ jobs:
           uvx --from pip-audit pip-audit \
             --no-deps --disable-pip --strict --progress-spinner off \
             --requirement /tmp/moviepilot-audit-free-threaded-normalized.txt
+          uvx --from pip-audit pip-audit \
+            --vulnerability-service osv --no-deps --disable-pip --strict --progress-spinner off \
+            --requirement /tmp/moviepilot-audit-free-threaded-normalized.txt
 
       - name: Release version
         id: release_version

tests/test_release_supply_chain.py

@@ -168,6 +168,8 @@ def test_release_audits_locked_runtime_dependencies_before_building() -> None:
         assert "pip-audit==" not in audit
         for option in ("--require-hashes", "--no-deps", "--disable-pip", "--strict"):
             assert option in audit
+        # 两个运行时组都要再经 OSV 补查，PyPI 服务单独使用会漏报部分公告。
+        assert audit.count("--vulnerability-service osv") == 2
 
 
 def test_direct_url_audit_requirement_uses_version_from_matching_lock_source(tmp_path: Path) -> None: