config: ignore the unreachable pygments advisory and gate on the rest

Author: ttw225

.github/workflows/security-audit.yaml

@@ -18,11 +18,10 @@ on:
 
 jobs:
   audit:
-    # Non-blocking (continue-on-error) because pygments PYSEC-2026-2987
-    # cannot be fixed while pelican caps pygments<2.20.0 — see issue #219.
-    # Make this job blocking once that finding is resolved or ignored.
+    # Advisories we knowingly accept are listed in IGNORED_VULNERABILITIES in
+    # tasks.py, each with the condition for dropping it. A red job here means
+    # a finding nobody has triaged yet.
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - name: Check out
         uses: actions/checkout@v7

tasks.py

@@ -67,6 +67,16 @@
 ]
 
 
+# Advisories we accept, with the condition for dropping each. See issue #219.
+#
+# PYSEC-2026-2987: ReDoS in the Pygments ADL lexer. Fixed in Pygments 2.20.0,
+# which Pelican's pygments<2.20.0 cap puts out of reach. This blog has no ADL
+# content. Drop when Pelican relaxes the cap or the advisory is withdrawn.
+IGNORED_VULNERABILITIES = [
+    "PYSEC-2026-2987",
+]
+
+
 @task
 def clean(context: Context) -> None:
     """Remove generated files"""
@@ -215,7 +225,8 @@ def format(context: Context) -> None:
 @task
 def security_check(context: Context) -> None:
     """Run pip-audit on dependencies"""
-    context.run("""uv run pip-audit""")
+    ignored = " ".join(f"--ignore-vuln {vuln}" for vuln in IGNORED_VULNERABILITIES)
+    context.run(f"uv run pip-audit {ignored}")
 
 
 @task