fix(python-security): stop reporting pip-audit transport failures as vulnerabilities

[seonghobae]

Summary

• Closes python-security: pip-audit transport/exception failures are reported as "known-vulnerable Python dependencies" #2158: distinguish pip-audit vulnerability findings from audit-service/transport failures while keeping the hard gate closed on every non-zero exit.
• Supersedes fix(python-security): stop reporting pip-audit transport failures as vulnerabilities #2186 (same fix, but that branch is ~114 commits behind main and cannot land cleanly).
• Contract tests execute the real step body with a fake pip-audit on PATH (findings / ConnectionResetError / clean / catch-all gone).

Change

Each pip-audit invocation goes through run_audit <label> <args…>:

• non-zero exit still sets status=1 (fail-closed preserved);
• log contains Found N known vulnerabilit… → ::error::… found known-vulnerable …;
• otherwise → ::error::… could not complete … audit-service/transport failure … rerun ….

No retry budget (directive 3.1). Call sites and flags unchanged.

Test plan

• pytest tests/test_python_security_pip_audit_failure_classification.py (4/4)
• pytest tests/test_workflow_file_detection_pipefail_regression.py (unaffected)
• Hosted python-security / required review checks on this head

Made with Cursor

[coderabbitai]

Warning

Review limit reached

Next included review available in 4 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 38427c1f-aedc-4672-ac03-a3c53da40c7c

📥 Commits

Reviewing files that changed from the base of the PR and between a1d0034 and eba48c1.

📒 Files selected for processing (2)

• .github/workflows/python-security.yml
• tests/test_python_security_pip_audit_failure_classification.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Lead merge authorization (run_a9475d4b375c): Admin-merging ahead of queued CI.

Local evidence on head eba48c1:

• python3 -m pytest tests/test_python_security_pip_audit_failure_classification.py -q → 4 passed (2026-09-17T15:46Z)
• Worker ctx_6e300049f8b0: fix(python-security): stop reporting pip-audit transport failures as vulnerabilities #2186/python-security: pip-audit transport/exception failures are reported as "known-vulnerable Python dependencies" #2158 pip-audit transport failure classification

Merged ahead of org queue saturation.