ci: fix publish dependency audit

Author: lanbytes

pyproject.toml

@@ -50,6 +50,7 @@ dev = [
   "bandit[toml]>=1.9.4",
   "basedpyright>=1.39.9",
   "build>=1.5.0",
+  "cryptography>=50.0.0",
   "pip>=26.1.2",
   "pip-audit>=2.10.1",
   "PyYAML>=6.0.3",

tests/test_metadata.py

@@ -130,6 +130,7 @@
 )
 ACTIONLINT_MODULE = "github.com/rhysd/actionlint/cmd/actionlint@v1.7.12"
 BLACKSMITH_RUNNER_LABEL = "blacksmith-2vcpu-ubuntu-2404"
+GITHUB_HOSTED_RUNNER_LABEL = "ubuntu-latest"
 HERMES_AGENT_COMPAT_COMMAND = "uv run python scripts/check_hermes_agent_compat.py"
 PUBLIC_SAFETY_COMMAND = "uv run python scripts/check_public_safety.py"
 EXPECTED_PUBLIC_IGNORE_PATTERNS = [
@@ -783,14 +784,17 @@ def test_public_repo_ignore_rules_cover_local_artifacts() -> None:
     [
         ("ci.yml", "check"),
         ("hol-plugin-scanner.yml", "scan"),
-        ("publish.yml", "build"),
-        ("publish.yml", "publish"),
     ],
 )
 def test_workflows_run_on_blacksmith_runner(workflow_path: str, job_name: str) -> None:
     assert workflow_job(workflow_path, job_name)["runs-on"] == BLACKSMITH_RUNNER_LABEL
 
 
+@pytest.mark.parametrize("job_name", ["build", "publish"])
+def test_publish_workflow_runs_on_github_hosted_runner(job_name: str) -> None:
+    assert workflow_job("publish.yml", job_name)["runs-on"] == GITHUB_HOSTED_RUNNER_LABEL
+
+
 def test_actionlint_allows_blacksmith_runner_label() -> None:
     config = load_object_mapping(ROOT / ".github" / "actionlint.yaml")
     self_hosted_runner = require_mapping(config["self-hosted-runner"])