fix(python-security): stop reporting pip-audit transport failures as vulnerabilities

[seonghobae]

Closes #2158.

Defect

.github/workflows/python-security.yml's "Run pip-audit (hard gate on any known vulnerability)" step folded every non-zero pip-audit exit into one message — pip-audit reported known-vulnerable Python dependencies. — so a PyPI advisory-query ConnectionResetError with no findings (.github#2123@7e3b1a40c, job 103582668686) read as a security finding and sent #2157's triage looking for dependencies to remediate.

Change (one step, fail-closed preserved)

Each invocation now goes through a run_audit <label> <args…> function in the same step:

• output is tee'd to a temp log; a non-zero exit still sets status=1 (the gate stays closed on every failure);
• if the log contains Found N known vulnerabilit… — the summary pip-audit 2.10.1 (the pinned version) prints on stderr only when it has findings (pip_audit/_cli.py) — the step emits ::error::pip-audit found known-vulnerable Python dependencies in <input>;
• otherwise it emits ::error::pip-audit could not complete for <input>: <last diagnostic line>. This is an audit-service/transport failure, not a vulnerability finding; rerun the job before treating it as a security result.
• the final line says the per-input errors above carry the classification.

No retry budget is added (directive 3.1: a retry would need a provider-stated condition). The three call sites (-r normal, -r --disable-pip --no-deps for overridden locks, project manifest) and their flags are unchanged.

Verification

tests/test_python_security_pip_audit_failure_classification.py executes the real step body (extracted from the workflow, same technique as test_workflow_file_detection_pipefail_regression.py) with a fake pip-audit on PATH:

• findings shim → exit 1 + finding error, no "could not complete";
• No known vulnerabilities found + traceback + exit 1 (the python-security: pip-audit transport/exception failures are reported as "known-vulnerable Python dependencies" #2158 shape) → exit 1 + could-not-complete error naming ConnectionResetError, no "known-vulnerable";
• clean shim → exit 0, no ::error::;
• the old catch-all message is gone from the workflow.
  RED against main's step (3 of 4 fail), GREEN here (4/4). Full suite: 3082 passed, 3 skipped, 0 warnings; interrogate 100%. Local coverage shows 99% only because tests/test_noema_document_review_context.py skips the hwp-mcp fixture cases without NOEMA_HWP_MCP_SOURCE (modules from fix(noema): close document reader review gaps #2178, untouched here); the hosted gate runs with that source.

Sequencing note

#2158 suggested bundling into #1051; that PR has been idle since 2026-09-03 and its diff does not touch the failure-reporting lines, so this lands independently and should apply cleanly on either side.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 30 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 075a58a0-6c2e-46f3-8d79-3ed8ea71a580

📥 Commits

Reviewing files that changed from the base of the PR and between ebc69a4 and 0207742.

📒 Files selected for processing (2)

• .github/workflows/python-security.yml
• tests/test_python_security_pip_audit_failure_classification.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}