Running globally installed pip-audit from within a virtualenv produces unintuitive results

[alex]

Bug description

If you have a globally installed pip-audit (e.g. from brew install pip-audit), and then run it inside a virtualenv environment, the results are confusing.

(.venv) ~/p/cryptography ❯❯❯ pip-audit 
Found 1 known vulnerability in 1 package
Name       Version ID                  Fix Versions
---------- ------- ------------------- ------------
setuptools 65.5.0  GHSA-r9hx-vwmv-q579 65.5.1
(.venv) ~/p/cryptography ❯❯❯ pip list | grep setuptools
setuptools           65.6.3
setuptools-rust      1.5.2
(.venv) ~/p/cryptography ❯❯❯ which pip-audit
/opt/homebrew/bin/pip-audit

Reproduction steps

1. brew install pip-audit
2. python -m virtualenv venv
3. venv/bin/activate
4. pip-audit

Expected behavior

Either it scans the packages installed inside the virtual environment, or at least emits a warning or an error.

Platform information

• OS name and version: macOS Ventura 13.1
• pip-audit version (pip-audit -V): pip-audit 2.4.10
• Python version (python -V or python3 -V): Python 3.10.9
• pip version (pip -V or pip3 -V): pip 22.3.1 from /Users/alex_gaynor/projects/cryptography/.venv/lib/python3.10/site-packages/pip (python 3.10)

[woodruffw]

Agreed this is a bug on our side; IMO a warning probably makes the most sense for now (since implicitly jumping into a user's virtual environment with a globally installed package may also be surprising, and may not always function correctly).

Longer term, we might want to support some kind of --venv or similar flag that conditionally enables that behavior.

[woodruffw]

Just for visibility: the source of the unintuitive behavior here is the fact that pip-audit invokes pip list ... by hopping through sys.executable (i.e., the path to the Python interpreter that spawned pip-audit itself).

This results in the following behavior:

1. Global environment, pip-audit installed globally: intuitively audits the global environment
2. Local environment, pip-audit installed locally: intuitively audits the local environment (and maybe the global environment too, if configured)
3. Local environment, pip-audit installed globally: unintuitively audits the global environment, ignoring the local environment
4. Global environment, pip-audit installed into a local environment: unexpected use pattern (indicates user confusion), but probably results in auditing just pip-audit itself and maybe the global environment, if configured

[woodruffw]

Again for visibility: a temporary workaround for the unintuitive behavior is to set PIPAPI_PYTHON_LOCATION to the path of the virtual environment's Python, e.g.

PIPAPI_PYTHON_LOCATION=$(which python) pip-audit