[Michael Pysson (mpysson)]

Prevent optional cleanup failures from aborting Component Detection scans.

Problem

Cleanup inventories the files and directories around a manifest before and after detector processing. If a directory disappears or enumeration encounters another I/O error, the exception can escape and fail the scan.

PipReport also deletes generated report files in a finally block. An I/O or permission error during deletion can escape that block, aborting the scan even after components have been recorded.

Solution

• Handle IOException and UnauthorizedAccessException during cleanup inventory (FileComponentDetectorWithCleanup.cs:163–171).
• Skip artifact cleanup when inventory cannot be completed, rather than risk deleting pre-existing files.
• Handle the same exceptions when deleting generated PipReport files (PipReportComponentDetector.cs:348–360).
• Log the affected path, exception type, and message at debug level without exception stack traces.

Other exception types are not suppressed by these cleanup handlers. The existing reportFile.Exists and reportFile.Delete() implementation is preserved.

[Copilot]

🟡 Changes recommended

Missing regression tests for cleanup inventory errors and generated pip-report deletion failures leave scan continuity and exception-handling boundaries insufficiently verified.

2 open issues

• Add regression tests for cleanup exception handling paths · New
• Test generated-report deletion failures without scan failure · New

What changed in this PR

This PR prevents optional cleanup I/O and permission errors from aborting Component Detection scans while leaving other exception types unsuppressed.

Changes:

• Handle inventory failures and skip cleanup when the inventory is incomplete.
• Handle failures when deleting generated PipReport files.
• Log affected paths, exception types, and messages at debug level without stack traces.

File	Description
src/​Microsoft.ComponentDetection.Detectors/​pip/​PipReportComponentDetector.cs	Handles I/O and permission errors during generated-report deletion.
src/​Microsoft.ComponentDetection.Contracts/​FileComponentDetectorWithCleanup.cs	Extends inventory error handling to I/O failures and updates debug logging.

_{Review effort: Balanced}

[github-actions]

👋 Hi! It looks like you modified some files in the Detectors folder.
You may need to bump the detector versions if any of the following scenarios apply:

• The detector detects more or fewer components than before
• The detector generates different parent/child graph relationships than before
• The detector generates different devDependencies values than before

If none of the above scenarios apply, feel free to ignore this comment 🙂