# Fix pip-audit "requires either a requirements file or an installed environment"

## TL;DR
pip-audit needs a package inventory to scan, and you gave it neither a requirements file nor a live environment. Point it at your requirements file with the -r flag, or run it inside the virtual environment where your packages are installed. Either input unblocks the scan.

```text
pip-audit: "ERROR: pip-audit requires either a requirements file or an installed environment"
```

## Steps

1. Confirm which input you intended to scan. If your project has a requirements file, use it directly.
   - Run: ls requirements.txt
   - Expected: the file exists in your project root.

2. Scan using the requirements file.
   - Run: pip-audit -r requirements.txt
   - Expected: pip-audit outputs a findings report instead of the startup error.

3. If you want to scan the installed environment instead, activate the virtual environment first, then run pip-audit with no source flags.
   - Run: source venv/bin/activate, then pip-audit
   - Expected: pip-audit scans the packages installed in the active environment.

4. If neither works, verify pip-audit itself is functional with a known-good requirements file.
   - Run: echo "requests==2.25.0" > /tmp/test-req.txt && pip-audit -r /tmp/test-req.txt
   - Expected: pip-audit runs and reports (or clears) the known-old requests version, proving the tool works.

## Use this when
- pip-audit exits immediately with the "requires either a requirements file or an installed environment" error
- A CI job runs pip-audit in a container where the virtualenv was not activated
- An agent ran pip-audit from the wrong working directory with no requirements file present

## Not for this skill when
- pip-audit runs but reports FixResolutionImpossible (that is a resolver conflict, not a missing input)
- The requirements file exists but pip-audit cannot parse it (check the file format instead)
- You need to scan a lockfile format pip-audit does not support (use the tool's supported inputs list)

## Variant phrasings
- pip-audit no requirements file error
- pip-audit needs a requirements file or installed environment
- pip-audit error when run outside a virtualenv

## Why it happens
pip-audit does not scan source code or directories; it scans a package inventory. That inventory comes from exactly two places: a requirements file you name with -r, or the packages installed in the current Python environment. If you run it bare in a system Python with no packages and no -r flag, there is nothing to scan, so it refuses to start rather than reporting a false "clean".

## Edge cases
- You activated the venv but the shell runs a different pip-audit: check which pip-audit and make sure it resolves inside the venv.
- Your deps live in pyproject.toml only: generate a requirements file first with pip freeze or your lockfile tool, then point pip-audit at it.
- CI installs deps in one step and runs pip-audit in another: the two steps must share the same environment or the file must be passed explicitly.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pCCeP6Z2VxUyXFwz66bbDw