Frogbot not creating pull requests after scan-repository task succeeds

Describe the bug

I'm using JFrog Frogbot for scanning vulnerabilities on Gitlab repository. Currently, frogbot is unable to create automatic pull requests after the scan-repository command is completed successfully even though there are vulnerabilities reported in the "scan-pull-request" task. I also tried replicating the behavior by downgrading a package to a vulnerable version (affected version) and triggered "scan-repository" task in order to test automatic pull request creation by Frogbot. Unfortunately I don't see any pull requests created and logs says no changes to commit (full logs attached). Maybe something wrong with the configuration I have.
Could you please help me troubleshoot the issue? I have included all the relevant logs and frogbot config files in this issue report.
BTW, there are no existing pull requests with vulnerabilities open as it mentions in the logs.
Thanks!

Current behavior

Frogbot downloaded successfully!
10:10:42 [Info] Frogbot version: 2.21.13
10:10:42 [Info] Running Frogbot "scan-repository" command
[Info] Not entitled for JAS, skipping advance security scans...
10:10:45 [Info] Preforming 1 SCA scans:
[
{
"Target": "/tmp/jfrog.cli.temp.-1728295844-3614675312",
"Technology": "poetry",
"Descriptors": [
"/tmp/jfrog.cli.temp.-1728295844-3614675312/pyproject.toml"
]
}
]
10:10:45 [Info] Calculating Poetry dependencies...
10:10:48 [Info] [Thread 0] Running SCA scan for /tmp/jfrog.cli.temp.-1728295844-3614675312 vulnerable dependencies in /tmp/jfrog.cli.temp.-1728295844-3614675312 directory...
10:10:48 [Info] Scanning 20 poetry dependencies...
10:10:49 [Info] Waiting for scan to complete on JFrog Xray...
10:10:54 [Info] Xray scan completed
10:10:54 [Info] -----------------------------------------------------------------
10:10:54 [Info] Starting aggregated dependencies fix
10:10:54 [Info] There were no changes to commit after fixing vulnerabilities.
Note: Frogbot currently cannot address certain vulnerabilities in some package managers, which may result in the absence of changes
10:10:54 [Info] The existing pull request is in sync with the latest scan, and no further updates are required.
10:10:54 [Info] Frogbot "scan-repository" command finished successfully

Reproduction steps

No response

Expected behavior

Frogbot detects vulnerabilities after running "scan-repository" task for a repo and creates pull requests automatically with fixable versions and relevant changes.

JFrog Frogbot version

2.21.13

Package manager info

poetry.lock and Poetry (version 1.8.3)

Git provider

GitLab

JFrog Frogbot configuration yaml file

Git repositories in the same organization.

• params:

  Git parameters

  git:
  # [Mandatory]
  # Name of the git repository to scan
  repoName: mygitlabrepo

  # [Mandatory]
  # List of branches to scan
  branches:
    - main
  
  # [Optional]
  # Template for the branch name generated by Frogbot when creating pull requests with fixes.
  # The template must include {BRANCH_NAME_HASH}, to ensure that the generated branch name is unique.
  # The template can optionally include the {IMPACTED_PACKAGE} and {FIX_VERSION} variables.
  branchNameTemplate: 'frogbot-{BRANCH_NAME_HASH}'
  
  # [Optional]
  # Template for the commit message generated by Frogbot when creating pull requests with fixes
  # The template can optionally include the {IMPACTED_PACKAGE} and {FIX_VERSION} variables.
  commitMessageTemplate: 'Upgrade {IMPACTED_PACKAGE} to {FIX_VERSION}'
  
  # [Optional]
  # Template for the pull request title generated by Frogbot when creating pull requests with fixes.
  # The template can optionally include the {IMPACTED_PACKAGE} and {FIX_VERSION} variables.
  pullRequestTitleTemplate: '[🐸 Frogbot] Upgrade {IMPACTED_PACKAGE} to {FIX_VERSION}'
  
  # [Optional]
  # Avoid adding extra info to pull request comments. that isn't related to the scan findings.
  # avoidExtraMessages: false
  
  # [Optional]
  # Add a title to pull request comments generated by Frogbot.
  # pullRequestCommentTitle: ""
  
  # [Optional, Default: false]
  # If true, Frogbot creates a single pull request with all the fixes.
  # If false, Frogbot creates a separate pull request for each fix.
  aggregateFixes: true
  
  # [Optional, Default: eco-system+frogbot@jfrog.com]
  # Set the email of the commit author
  # emailAuthor: ""
  

  Frogbot scanning parameters

  scan:
  # [Default: false]
  # Frogbot displays all existing vulnerabilities, including the ones that were not added by the pull request
  includeAllVulnerabilities: true

  # [Default: true]
  # Frogbot does not fail the task if security issues are found and this parameter is set to false
  failOnSecurityIssues: false
  
  # [Default: false]
  # Handle vulnerabilities with fix versions only
  # fixableOnly: true
  
  # [Optional]
  # Set the list of allowed licenses
  # The full list of licenses can be found in:
  # https://github.com/jfrog/frogbot/blob/master/docs/licenses.md
  # allowedLicenses:
  #   - MIT
  #   - Apache-2.0
  
  # [Optional]
  # Set the minimum severity for vulnerabilities that should be fixed and commented on in pull requests
  # The following values are accepted: Low, Medium, High or Critical
  minSeverity: 'Low'
  
  # [Optional]
  # List of email addresses to receive emails about secrets that has been detected in a pull request scan.
  # Applies only to servers that are entitled to JFrog Advanced Security.
  # emailReceivers:
  #  - user@company.com
  
  # List of subprojects / project dirs inside the Git repository
  projects:
    # [Mandatory if the two conditions below are met]
    # 1. The project uses poetry to download its dependencies
    # 2. The `installCommand` variable isn't set in your frogbot-config.yml file.
    #
    # The command that installs the project dependencies (e.g "nuget restore")
    - installCommand: 'poetry install'
  
      # [Default: root directory]
      # List of relative path's to the projects directories in the git repository
      workingDirs:
        - '.'
  
      # [Optional]
      # Name of a Virtual Repository in Artifactory to resolve (download) the project dependencies from
      # repository: 'gitlab-artf'
  

  JFrog Platform parameters

  jfrogPlatform:

  [Optional]

  JFrog project key. Learn more about it here

  jfrogProjectKey: ""

  [Optional]

  Xray Watches. Learn more about it here

  watches:

  - ""

Operating system type and version

macOS 14.6

JFrog Xray version

No response

Start by reproducing the scan-repository task with the supplied GitLab configuration, pyproject.toml, and poetry.lock, then inspect the attached logs around dependency fixing and pull-request creation. Done means identifying why a successful scan with reported vulnerabilities produces no changes or pull request, with the result covered by an appropriate regression test.