fix: recommend when no vulnerabilities are reported#610
Merged
Conversation
Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>
Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>
Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> Co-authored-by: Claude Sonnet <noreply@anthropic.com>
Reviewer's GuideUpdates Serena project configuration, expands internal conventions documentation for registry integrations and Camel patterns, adds project memories for Serena, strengthens registry enrichment behavior when provider sources are null/empty, and adds corresponding tests. Sequence diagram for registry enrichment when provider sources are null or emptysequenceDiagram
participant RegistryEnrichmentService
participant providers
participant ProviderReport
participant SourceMap as sources
participant Source
participant SourceSummary
RegistryEnrichmentService->>providers: entrySet()
loop for each providerEntry
RegistryEnrichmentService->>ProviderReport: getValue()
alt providerReport == null
RegistryEnrichmentService-->>RegistryEnrichmentService: continue
else providerReport != null
RegistryEnrichmentService->>ProviderReport: getSources()
alt getSources() == null
RegistryEnrichmentService->>ProviderReport: sources(new HashMap)
RegistryEnrichmentService->>ProviderReport: getSources()
end
RegistryEnrichmentService->>ProviderReport: getSources()
Note right of RegistryEnrichmentService: check isEmpty()
alt sources.isEmpty()
RegistryEnrichmentService->>Source: new Source()
RegistryEnrichmentService->>Source: dependencies(new ArrayList)
RegistryEnrichmentService->>SourceSummary: new SourceSummary()
RegistryEnrichmentService->>Source: summary(SourceSummary)
RegistryEnrichmentService->>ProviderReport: getSources().put(providerEntry.key, Source)
end
RegistryEnrichmentService->>ProviderReport: getSources()
RegistryEnrichmentService->>SourceMap: entrySet()
loop for each sourceEntry
RegistryEnrichmentService->>Source: enrichUnreportedDependencies(sourceReport)
end
end
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
ruromero
changed the title
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="src/test/java/io/github/guacsec/trustifyda/integration/registry/RegistryEnrichmentServiceTest.java" line_range="215-224" />
<code_context>
assertEquals("expected-hash", capturedHash[0]);
}
+ @Test
+ void enrichCreatesSourceWhenProvidersHaveEmptySources() {
+ var providerReport = new ProviderReport();
+ providerReport.sources(new HashMap<>());
+ var report = new AnalysisReport();
+ report.providers(new HashMap<>(Map.of("provider1", providerReport)));
+
+ var tree = buildTree("pkg:pypi/amqp@5.3.1", Map.of("SHA-256", "abc123"));
+
+ service.enrichReport(report, tree, PKG_PYPI_PREFIX, alwaysRecommend);
+
+ assertFalse(providerReport.getSources().isEmpty());
+ var deps = providerReport.getSources().values().iterator().next().getDependencies();
+ assertEquals(1, deps.size());
+ assertNotNull(deps.get(0).getRecommendation());
+ }
+
+ @Test
+ void enrichCreatesSourceWhenSourcesIsNull() {
+ var providerReport = new ProviderReport();
+ var report = new AnalysisReport();
</code_context>
<issue_to_address>
**suggestion (testing):** Extend the `enrichCreatesSourceWhenSourcesIsNull` test to assert dependency creation and recommendations, mirroring the empty-sources case.
In `enrichCreatesSourceWhenSourcesIsNull`, we now create a default `Source` and enrich it with dependencies and recommendations when `sources` is null, but the test only asserts that `getSources()` is non-null/non-empty. To fully validate the behavior, please also assert that the created `Source` has exactly one dependency and that this dependency has a non-null recommendation, matching the checks in `enrichCreatesSourceWhenProvidersHaveEmptySources`. This will align coverage for the "null" and "empty" cases and verify the complete enrichment flow, not just map initialization.
Suggested implementation:
```java
assertNotNull(providerReport.getSources());
assertFalse(providerReport.getSources().isEmpty());
var deps = providerReport.getSources().values().iterator().next().getDependencies();
assertEquals(1, deps.size());
assertNotNull(deps.get(0).getRecommendation());
}
```
This edit assumes that in `enrichCreatesSourceWhenSourcesIsNull` the tree-building and `service.enrichReport(...)` invocation already occur before these assertions, similar to `enrichCreatesSourceWhenProvidersHaveEmptySources`. If the method body is currently shorter and only sets up the `providerReport`/`report` and calls `enrichReport`, you should ensure that:
1. `enrichCreatesSourceWhenSourcesIsNull` builds a tree (e.g. via `buildTree("pkg:pypi/amqp@5.3.1", Map.of("SHA-256", "abc123"))`), and
2. Passes that tree into `service.enrichReport(report, tree, PKG_PYPI_PREFIX, alwaysRecommend);`
so that the new dependency/recommendation assertions are meaningful and consistent with the "empty sources" test.
</issue_to_address>
### Comment 2
<location path=".serena/memories/project_overview.md" line_range="7" />
<code_context>
+Trustify Dependency Analytics is a Java/Quarkus backend service for dependency analysis.
+It accepts SBOMs (CycloneDX/SPDX), queries vulnerability providers (Trustify), resolves
+licenses via deps.dev, and returns analysis results as JSON, HTML (self-contained React app
+via Freemarker), or multipart/mixed.
+
+## Tech Stack
</code_context>
<issue_to_address>
**nitpick (typo):** Consider using the official spelling "FreeMarker" for the template engine name.
Here this refers to the FreeMarker templating engine; please change `Freemarker` to `FreeMarker` to match the official name.
Suggested implementation:
```
licenses via deps.dev, and returns analysis results as JSON, HTML (self-contained React app
via FreeMarker), or multipart/mixed.
```
```
- **UI**: React 18 + PatternFly 5 + TypeScript (compiled into FreeMarker template)
```
</issue_to_address>
### Comment 3
<location path=".serena/memories/project_overview.md" line_range="17" />
<code_context>
+- **ORM**: Hibernate ORM with Panache, PostgreSQL, Flyway
+- **Cache**: Redis
+- **Build**: Maven, Spotless (Google Java Format), Frontend Maven Plugin (Node/Yarn for UI)
+- **Testing**: JUnit 5, REST Assured, WireMock 3.4.2, HTMLUnit
+- **API Models**: `trustify-da-api-model` artifact (version 2.0.7) provides generated model classes
+- **UI**: React 18 + PatternFly 5 + TypeScript (compiled into Freemarker template)
</code_context>
<issue_to_address>
**nitpick (typo):** Align the spelling of "HTMLUnit" with the official project name "HtmlUnit".
Please change `HTMLUnit` to `HtmlUnit` here to match the upstream project’s official capitalization and keep the documentation accurate.
```suggestion
- **Testing**: JUnit 5, REST Assured, WireMock 3.4.2, HtmlUnit
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Signed-off-by: Ruben Romero Montes <rromerom@redhat.com> Co-authored-by: Claude Sonnet <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to #607 and update serena and conventions files
Summary by Sourcery
Update Serena project configuration and developer conventions while enhancing registry enrichment behavior and tests.
Enhancements:
Documentation:
Tests:
Chores: