check-vulnerabilities fails in obscure way if expected file missing
- Dominant language
- Python
- Stars
- 19
- Forks
- 7
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 67
Description
### 🔍 Before submitting the issue
- [x] I have searched among the existing issues
- [x] I am using a Python virtual environment
### 🐞 Description of the bug
Following the instructions to run check_vulnerabilities.py locally, I did not notice that the download of `.safety-ignore.yml` from the repo renamed the file by removing the leading `.`.
When I ran `python check_vulnerabilities.py --run-local` the output suggested that the `safety` execution had completed successfully. All that was printed at that stage was "Safety check performed" and the script went on to run the bandit executable. The script only failed at a later stage because it could not find the `info_safety.json` file that safety should have written.
When I ran safety directly at the command line, using the same arguments as in the `subprocess.run` call in the script, a useful error message was printed that allowed me to diagnose what had gone wrong.
The issue is the silent failure of the safety step with a final error that is not obviously related to the root cause.
### 📝 Steps to reproduce
Follow the instructions provided in the documentation, but rename `.safety-ignore.yml` to something different.
### 💻 Which operating system are you using?
Windows
### 📀 Which ANSYS version are you using?
Not relevant to this issue.
### 🐍 Which Python version are you using?
3.13
### 📦 Installed packages
```shell
annotated-doc==0.0.4
annotated-types==0.7.0
anyio==4.13.0
Authlib==1.7.2
bandit==1.9.4
certifi==2026.4.22
cffi==2.0.0
charset-normalizer==3.4.7
click==8.4.1
colorama==0.4.6
cryptography==49.0.0
dparse==0.6.4
filelock==3.29.0
h11==0.16.0
httpcore==1.0.9
httpx==0.28.1
idna==3.15
Jinja2==3.1.6
joblib==1.5.3
joserfc==1.6.5
markdown-it-py==4.2.0
MarkupSafe==3.0.3
marshmallow==4.3.0
mdurl==0.1.2
nltk==3.9.4
packaging==26.2
pycparser==3.0
pydantic==2.13.4
pydantic_core==2.46.4
PyGithub==2.9.1
Pygments==2.20.0
PyJWT==2.13.0
PyNaCl==1.6.2
PyYAML==6.0.3
regex==2026.5.9
requests==2.34.2
rich==15.0.0
ruamel.yaml==0.19.1
safety==3.8.1
safety-schemas==0.0.16
shellingham==1.5.4
stevedore==5.8.0
tenacity==9.1.4
tomlkit==0.15.0
tqdm==4.67.3
truststore==0.10.4
typer==0.25.1
typing-inspection==0.4.2
typing_extensions==4.15.0
urllib3==2.7.0
```
Contributor guide
Research direction
Start by reading check_vulnerabilities.py, focusing on the safety subprocess.run call and the later lookup of info_safety.json. Reproduce the issue with .safety-ignore.yml renamed, then compare the script's output with running safety directly. Done means a missing expected file or failed safety step produces a useful, immediate error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, python
- Domain
- ci-cd
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100