Update safety to v3

Author: Iain-S

.github/workflows/linter.yml

@@ -46,4 +46,6 @@ jobs:
       - name: Install dependencies
         run: poetry install --all-extras
 
-      - uses: pre-commit/[email protected]
+      - uses: pre-commit/[email protected]
+        env:
+          SAFETY_API_KEY: ${{ secrets.SAFETY_API_KEY }}

.pre-commit-config.yaml

@@ -30,8 +30,7 @@ repos:
         types: ['python']
       - id: safety
         name: Safety
-        # Ignore sql-alchemy and wheel vulnerabilities
-        entry: poetry run safety check --full-report -i 51668
+        entry: poetry run safety --stage cicd scan --policy-file .safety-policy.yml
         pass_filenames: false
         language: system
       - id: mypy

.safety-policy.yml

@@ -0,0 +1,50 @@
+version: '3.0'
+
+scanning-settings:
+  max-depth: 6
+  exclude: []
+  include-files: []
+  system:
+    targets: []
+
+
+report:
+  dependency-vulnerabilities:
+    enabled: true
+    auto-ignore-in-report:
+      python:
+        environment-results: true
+        unpinned-requirements: true
+      cvss-severity: []
+      vulnerabilities:
+        64459:
+          reason: Python wide vulnerability.
+          expires: '2024-12-12'
+        64396:
+          reason: Python wide vulnerability.
+          expires: '2024-12-12'
+        67599:
+          reason: Only applies if using private package repo.
+          expires: '2026-04-17'
+        51668:
+          reason: We cannot currently use SQL Alchemy v2.
+          expires: '2024-12-12'
+
+
+fail-scan-with-exit-code:
+  dependency-vulnerabilities:
+    enabled: true
+    fail-on-any-of:
+      cvss-severity:
+        - medium
+        - critical
+        - high
+      exploitability:
+        - medium
+        - critical
+        - high
+
+security-updates:
+  dependency-vulnerabilities:
+    auto-security-updates-limit:
+      - patch

docs/content/setup.md

@@ -48,7 +48,13 @@ Install the Pre-Commit hooks:
 pre-commit install
 ```
 
-and run them with:
+set an environment variable with your [safety API key](https://docs.safetycli.com/safety-docs/support/invalid-api-key-error#how-to-get-a-safety-api-key):
+
+```bash
+export SAFETY_API_KEY=your-api-key
+```
+
+and run the checks with:
 
 ```bash
 pre-commit run --all-files