Frogbot v2.24.1 changes behaviour for repositories with multiple Python packages

name: JFrog scan

on:
  push:
    branches:
      - master
  pull_request_target:
    types: [opened, synchronize]
    branches:
      - master
  schedule:
    - cron: "0 0 * * 1-5"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  scan:
    runs-on: <omitted>
    timeout-minutes: 30

    permissions:
      id-token: write
      pull-requests: write
      security-events: write
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Check for Python files
        id: python
        run: |
          if [ -f ".github/jfrog/.python-version" ]; then
            echo "Found .github/jfrog/.python-version"
            python_version=$(cat .github/jfrog/.python-version)
          elif find . -name "*.py" 2>/dev/null | grep -q .; then
            echo "Python files found"
            sub_requirements=$(find . -path "**/requirements.txt" -not -path "./requirements.txt" | head -n 1)

            if [ -f "pyproject.toml" ]; then
              echo "Found pyproject.toml"
              python_version=$(grep -E '^python' pyproject.toml || echo "No version found in pyproject.toml")
            elif [ -f "requirements.txt" ]; then
              echo "Found requirements.txt"
              python_version=$(grep -oP 'This file is autogenerated by pip-compile with [Pp]ython \K[0-9]+\.[0-9]+' requirements.txt || echo '')

              if [ -z "$python_version" ]; then
                python_version="3.11"
              fi
            elif [ -n "$sub_requirements" ]; then
              echo "Found requirements.txt in subdirectory: $sub_requirements"
              python_version=$(grep -oP 'This file is autogenerated by pip-compile with [Pp]ython \K[0-9]+\.[0-9]+' "$sub_requirements" || echo '')

              if [ -z "$python_version" ]; then
                python_version="3.11"
              fi
            elif [ -f ".python-version" ]; then
              python_version=$(cat .python-version)
            else
              python_version="Unknown"
            fi
            echo "Python version: $python_version"
          else
            python_version="Unknown"
            echo "No Python files found"
          fi

          echo "python_version=$python_version" >> $GITHUB_OUTPUT

      - name: Check for Node.js files
        id: node
        run: |
          package_json_path=$(find . -name "package.json" | head -n 1)
          sub_json_path=$(find . -name "package.json" -not -path "./package.json" | head -n 1)

          if [ -n "$package_json_path" ]; then
            echo "Node.js project found at $package_json_path"
            node_found="true"
          elif [ -n "$sub_json_path" ]; then
            echo "Node.js project found at $sub_json_path"
            node_found="true"
          else
            node_found="false"
            echo "No Node.js files found"
          fi

          echo "node_found=$node_found" >> $GITHUB_OUTPUT

      - uses: actions/setup-python@v5
        if: ${{ steps.python.outputs.python_version != 'Unknown' }}
        with:
          python-version: ${{ steps.python.outputs.python_version }}

      - uses: actions/setup-node@v4
        if: ${{ steps.node.outputs.node_found == 'true' }}
        with:
          node-version: 22

      - name: Install Yarn
        if: ${{ steps.node.outputs.node_found == 'true' }}
        run: |
          npm install --global yarn

      - name: Set JFrog base branch if master
        if: github.event_name == 'schedule' || github.event_name == 'push'
        run: echo "JF_GIT_BASE_BRANCH=master" >> $GITHUB_ENV

      - name: Installation
        if: ${{ hashFiles('.github/jfrog/pre_install.sh') != '' }}
        run: |
          ./.github/jfrog/pre_install.sh

      - name: Read Frogbot path exclusions
        if: ${{ hashFiles('.github/jfrog/path_exclusions.txt') != '' }}
        run: |
          EXCLUSIONS="*git*;*node_modules*;*target*;*venv*;*test*;$(cat .github/jfrog/path_exclusions.txt)"
          echo "JF_PATH_EXCLUSIONS=$EXCLUSIONS" >> $GITHUB_ENV

      - uses: jfrog/frogbot@v2
        with:
          oidc-provider-name: github
          oidc-audience: jfrog-github
        env:
          JF_DEPS_REPO: pypi-virtual
          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JF_MIN_SEVERITY: Critical
          JF_URL: <omitted>

        # The Frogbot success comment is just a big, froggy banner advertising this tool--which we already pay for.
      - name: Delete Frogbot success comment
        if: github.event_name == 'pull_request_target'
        uses: actions/github-script@v7
        with:
          script: |
            const prNumber = context.payload.pull_request.number;
            const comments = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber
            });

            for (const comment of comments.data) {
              if (comment.body.includes("Frogbot scanned this pull request and did not find any new security issues")) {
                await github.rest.issues.deleteComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  comment_id: comment.id
                });
                console.log(`Deleted comment ID: ${comment.id} (${context.repo.owner}/${context.repo.repo})`);
              }
            }