Merge pull request #4 from VectorInstitute/adding-pip-audit

Adding pip-audit

.github/workflows/code_checks.yml

@@ -27,15 +27,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4.1.1
-      - name: Install poetry
-        run: python3 -m pip install --upgrade pip && python3 -m pip install poetry
+      - name: Install and configure Poetry
+        uses: snok/install-poetry@v1
+        with:
+          virtualenvs-create: true
+          virtualenvs-in-project: true
       - uses: actions/setup-python@v5.0.0
         with:
           python-version: '3.10'
           cache: 'poetry'
       - name: Install dependencies and check code
         run: |
           poetry env use '3.10'
-          source $(poetry env info --path)/bin/activate
+          source .venv/bin/activate
           poetry install --with test --all-extras
           pre-commit run --all-files
+      - name: pip-audit (gh-action-pip-audit)
+        uses: pypa/gh-action-pip-audit@v1.0.8
+        with:
+          virtual-environment: .venv/