Repository navigation
feat: include package purls in JSON output - #2885
Conversation
another-rex
left a comment
There was a problem hiding this comment.
Apologies for the late review!
Im happy with the change overall, though I think the test that's added is a bit too complicated for what we're actually doing. I would say try to simplify the test or just remove it entirely.
We're currently a bit busy recently, so might be a little while before we can get this merge in, but I will try to make sure this change is in the next osv-scanner release.
|
@another-rex |
…hots # Conflicts: # cmd/osv-scanner/scan/image/__snapshots__/command_test.snap # cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2885 +/- ##
=======================================
Coverage 82.15% 82.16%
=======================================
Files 118 118
Lines 7690 7692 +2
=======================================
+ Hits 6318 6320 +2
Misses 1372 1372 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
# Conflicts: # cmd/osv-scanner/fix/__snapshots__/command_test.snap # cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
Overview
Fixes #2874.
JSON output currently includes each scanned package's name, version, and ecosystem, but not its package URL.
This PR includes the package URL when scalibr provides one.
Details
I added an optional
purlfield toPackageInfoand populate it from scalibr's package URL inbuildVulnerabilityResults.The field is omitted (omitempty) when no PURL is available.
Testing
go test ./pkg/osvscannergo test ./internal/outputgo test ./pkg/models./scripts/run_lints.shChecklist
./scripts/run_lints.sh../scripts/run_tests.sh.