Repository navigation
test(cdx): cover deployment context, scope mappers, format helpers and merge gaps - #331
Conversation
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
0x73746F66
left a comment
0x73746F66
left a comment
There was a problem hiding this comment.
Reuse review: test-only (internal/cdx). Exercises ApplyDeploymentContext, scope mappers and format helpers on the shared cdx.BOM (vdb-cyclonedx) model; no local model copies. No changes needed.
0x73746F66
left a comment
0x73746F66
left a comment
There was a problem hiding this comment.
Reuse review: no reinvented Vulnetix patterns found. The change stays inside the package it covers, uses stdlib/testify helpers already used by the repo's tests, and adds no new client, auth, config-schema or shared-package duplicate (checked internal/testutils and sibling repos). Rebased onto current main locally: go vet and go test pass for every touched package. The earlier red checks (CodeQL Analyze, Install a release with verified provenance, Lockfile) were GitHub API rate-limit failures, not code failures; this will be re-run on a rebased head before merge.
…d merge gaps Deployment context Empty/String/Apply/FromBOM including sorted tags, re-apply replacing rather than duplicating, and nil/empty no-ops; the local scope to CycloneDX scope and environment mappers; FormatSpec, ValidSpecVersions and every NormalizeFormat alias; mergeComponentGaps, mergeVulnerabilities, appendPropIfMissing and ExportCompRefs. Coverage 55.9% -> 65.9%. Closes #298
aa49ed8 to
33e3e08
Compare
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
Closes #298
What
New
internal/cdx/deployment_format_test.go(stdlib, small hand-built BOMs like the existing tests):Empty(zero, empty tag map, each field),String(set fields only, tags sorted, empty tag values dropped, stable across calls),ApplyDeploymentContext->DeploymentContextFromBOMround trip, re-apply replaces rather than duplicates, nil BOM / empty context are no-ops, only set fields are written;DeploymentContextFromBOMon nil BOM, nil metadata, unrelated properties and a tag property with no key.mapLocalScopeToCDXandnativeScopeToEnvironmentover every scope constant plus empty/unknown;ExportCompRefs.FormatSpec,ValidSpecVersions, and everyNormalizeFormatalias (case-insensitive), the raw forms and the default.mergeComponentGaps(fills only empty fields, unions hashes/authors/external refs/properties keeping existing first),mergeVulnerabilities(dedupe on id + bom-ref + affects, including repeats within the incoming list),appendPropIfMissing.BuildDependenciesis left to its existing callers' tests; the card's item 5 (lsp helpers) is out of this package as the card notes.Verified
go test -cover ./internal/cdx/: pass, 55.9% -> 65.9%.gofmtclean.