fix: skip pkgVulnFailure entries with unresolved package refs (#108)

[SAY-5]

Fixes #108.

addPackages skips a package when its layerRef doesn't resolve to a known layer. addPolicies then resolves rule failures via scanResult.findPackageByID(failureData.packageRef)! — the ! masked the case where the package had been skipped, so failure.pkg ended up undefined. SummaryReportPresenter.getRulePkgMessage later crashed on failure.pkg.name:

TypeError: Cannot read properties of undefined (reading 'name')
    at SummaryReportPresenter.getRulePkgMessage (SummaryReportPresenter.js:173)

The crash surfaces as a regression v6.3.4 → v6.3.5 in the wild because the new layer/package pruning paths in v6.3.5 expose more reports where a referenced package is missing.

Drop the non-null assertion, accept undefined for both pkg and the JSON vuln lookup, and continue past the failure if either can't be resolved. Same defensive shape as addPackages itself.

Added a regression test in JsonScanResultV1ToScanResultAdapter.test.ts that constructs a report whose pkgVulnFailure references a package whose layer is absent, and asserts the rule ends up with zero failures (rather than corrupt ones) — verified to fail on master and pass with this change.

npm run lint, npm run build, and npm test all green (113 passed).

[tembleking]

Closing in favor of #110, which already covers this fix and goes further.

Your null guard in the adapter (removing the ! assertions and adding continue) is included in #110 — same approach, practically identical diff. Good catch on the root cause.

Where #110 diverges:

• Root cause fix: the scan result JSON was being read by piping cat through @actions/exec stdout listeners, which can deliver incomplete data under Node.js 24's stricter stream/pipe error handling. fix: resolve TypeError in SummaryReportPresenter (issue #108) #110 replaces that with fs.readFileSync, eliminating the truncation risk entirely. Your PR treats the symptom (skip the bad data), fix: resolve TypeError in SummaryReportPresenter (issue #108) #110 also fixes why the data was bad in the first place.
• Meta-package support: scanner >= 1.25.0 emits layerless meta-packages (base OS, container image) that the adapter was silently dropping. Your PR keeps dropping them (just avoids crashing). fix: resolve TypeError in SummaryReportPresenter (issue #108) #110 makes Package.foundInLayer nullable so these packages, their vulnerabilities, and their policy failures are preserved in reports.

Thanks for the PR — the analysis in your description was spot on.