Skip to content

chore: display the repository URL status of dependencies in html report instead of the analysis status #529

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

tromai
Copy link
Member

@tromai tromai commented Oct 26, 2023

Description

This Pull request fixes the issues in the HTML report of the main target where the dependencies are all displayed as AVAILABLE even though the repository URL is not available for them - see example below:

macaron analyze -rp https://github.com/apache/maven -sbom test_sbom.json

with the content of test_sbom.json as follows: test_sbom.json

image

In this example, Macaron cannot find the repository URL for the dependency component javax.inject:javax.inject. However, Macaron still tries to run all checks on that component and produce an "empty" HTML report for it. This is part of the design implemented in this PR:

  • Macaron still run the checks and produce a HTML report for all software component (including both the main target and dependencies if available) even when no repository URL is found for them (consistent with the data model where the repository is an optional field of a software component).

Therefore, it's required to correctly display the repository URL status in the status column (as shown in the example above). One of the reason why this is happening is because we are using SCMStatus enum for two purposes:

  • Show the status of repository URL for a software component (used in DependencyAnalyzer)
  • Show the status of running the analysis for a software component (used in Analyzer)

Implementation

This PR currently introduce a work-around for this issue. @behnazh-w Please let me know if it's preferred to use this work-around at the moment or implement a proper fix for it directly.

@oracle-contributor-agreement oracle-contributor-agreement bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Oct 26, 2023
@tromai tromai self-assigned this Oct 26, 2023
@tromai tromai force-pushed the display-repository-status-of-dependencies-in-html-report branch from c13360a to 5875036 Compare October 31, 2023 03:19
@tromai tromai marked this pull request as ready for review November 2, 2023 05:19
@tromai tromai requested a review from behnazh-w as a code owner November 2, 2023 05:19
Copy link
Member

@behnazh-w behnazh-w left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, It's good enough for now.

@tromai tromai merged commit 37a96bb into staging Nov 3, 2023
@tromai tromai deleted the display-repository-status-of-dependencies-in-html-report branch November 3, 2023 00:54
art1f1c3R pushed a commit that referenced this pull request Nov 29, 2024
…rt instead of the analysis status (#529)

Signed-off-by: Trong Nhan Mai <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
OCA Verified All contributors have signed the Oracle Contributor Agreement.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants