feat: add code actions, fix ostest & feature flags [IDE-1493] #1054
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bastiandoetsch
temporarily deployed
to
Standard
GitHub Actions
Inactive
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
bastiandoetsch
force-pushed
the
feat/IDE-1493_add-risk-score-and-fix-issues
branch
from
19fd1c6 to
45337df
Compare
bastiandoetsch
temporarily deployed
to
Standard
GitHub Actions
Inactive
* test: seperate DIs for TestUnifiedTestApiSmokeTest Previously di.Init() was being called twice in the test. The test have been moved to sub-tests, this way each test only calls it once. * test: make test more robust * test: refactor out duplicate test logic * chore: add test generated files to .gitignore * test: make compare a smoke test Add more test failed to run diags
# Conflicts: # application/server/unified_test_api_smoke_test.go
bastiandoetsch
had a problem deploying
to
Standard
GitHub Actions
Failure
bastiandoetsch
had a problem deploying
to
Standard
GitHub Actions
Failure
bastiandoetsch
temporarily deployed
to
Standard
GitHub Actions
Inactive
bastiandoetsch
temporarily deployed
to
Standard
GitHub Actions
Inactive
# Conflicts: # application/server/server_smoke_test.go # infrastructure/oss/cli_scanner.go
bastiandoetsch
temporarily deployed
to
Standard
GitHub Actions
Inactive
bastiandoetsch
temporarily deployed
to
Standard
GitHub Actions
Inactive
- files that are not in workspace folders caused a n nil deference, as the folder was nil and subsequent calls were not taking that scenario into account.
bastiandoetsch
temporarily deployed
to
Standard
GitHub Actions
Inactive
rrama
approved these changes
Dec 1, 2025
Contributor
rrama
left a comment
rrama
left a comment
There was a problem hiding this comment.
Small nit picks and a couple of questions, but nothing blocking getting this merged in.
| repoDir := "1" | ||
| absoluteCloneRepoDir := filepath.Join(tempDir, repoDir) | ||
|
|
||
| if useRootDirDirectly { |
Contributor
There was a problem hiding this comment.
Nit pick: Doing an if and an else would be cleaner.
| t.Setenv("SNYK_LOG_LEVEL", "debug") | ||
| c.SetLogLevel(zerolog.LevelDebugValue) | ||
| t.Setenv("SNYK_LOG_LEVEL", "info") | ||
| c.SetLogLevel(zerolog.LevelInfoValue) |
| comparisons = append(comparisons, collectOssIdentifiersComparisons(title, unified.Identifiers, legacy.Identifiers)...) | ||
|
|
||
| if unified.Description != legacy.Description { | ||
| if unified.Description[0:20] != legacy.Description[0:20] { |
Contributor
There was a problem hiding this comment.
Should leave a comment explaining that the descriptions are being cut off in the unified scans. We should link to the JIRA bug for it.
| s.mutex.Lock() | ||
| result := s.orgToFlag[org] | ||
| s.orgToFlag.Set(org, orgFlags, imcache.WithExpiration(time.Minute)) | ||
| result := orgFlags |
Contributor
There was a problem hiding this comment.
Q: Should this not be a clone, like above?
| return issues, nil | ||
| } | ||
|
|
||
| problem, err := getProblem(trIssue) |
Contributor
There was a problem hiding this comment.
Nit pick: Was having it in a function not nicer?
| if err != nil { | ||
| return nil, fmt.Errorf("failed to get and convert primary problem: %w", err) | ||
| } | ||
| func processIssue(ctx context.Context, trIssue testapi.Issue, logger zerolog.Logger, affectedFilePath types.FilePath, filePath types.FilePath, workDir types.FilePath) *snyk.Issue { |
Contributor
There was a problem hiding this comment.
Nit pick: Calling it trIssue is not immediately clear that "tr" stands for "test result". Can we call it unifiedIssue?
| if len(dependencyPath) == 0 { | ||
| return nil | ||
| } | ||
| depPathPackageName := strings.Split(dependencyPath[1], "@")[0] |
Contributor
There was a problem hiding this comment.
Nit pick: We should probably make the dependency paths be a struct of package name and version with a String() method, as opposed to doing splitting here.
| path = append(path, pkg.Name+"@"+pkg.Version) | ||
| for _, upgradePath := range upgradeAction.UpgradePaths { | ||
| path := upgradePath.DependencyPath | ||
| if len(path) > 0 && path[1].Name == depPathPackageName { |
Contributor
There was a problem hiding this comment.
Q: What is this solving, I couldn't figure out what the bug is without this additional check.
| // If we have upgrade dependencyPath data from the API, use it | ||
| if len(upgradePath) > 1 { | ||
| // Add all packages from upgrade path except the root (skip index 0) | ||
| // Add all packages from upgrade dependencyPath except the root (skip index 0) |
Contributor
There was a problem hiding this comment.
Nit pick: Find and replace fail?
…k-score-and-fix-issues
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR refactors the OSS vulnerability processing and feature flag infrastructure, adds risk score display functionality, and improves code maintainability through better separation of concerns.
OSS Issue Processing Refactoring:
addCodeActionsAndLenses()helper function for better testability and reuseossIssueto standalone functions (GetExtendedMessage,createCveLink,createCweLink,createFixedIn,CreateIssueURL,GetCodeActions,AddSnykLearnAction,AddQuickFixAction) - removing tight coupling to the ossIssue structgetAffectedFilePath()helper to reduce code duplicationgetFileContent()into shared utility functionProcessScanResults()signature by using context for dependency injectionGetRemediation()- now only handles upgrade pathsRisk Score Feature (IDE-1493):
RiskScorefield toOssIssueDatastructdetails.html) to conditionally display risk score when non-zeroUseExperimentalRiskScoreandUseExperimentalRiskScoreInCLIto control risk score functionalityFeature Flag Infrastructure Overhaul:
map[string]withimcache.Cachefor both feature flags and SAST settings storageWithProvider()option for cleaner dependency injection and improved testabilityPopulateFolderConfig()now automatically persists folder config viastoredconfig.UpdateFolderConfig()New()constructor with optionsTest Infrastructure Improvements:
Code + Rangeas matching key instead of relying on OssIssueData internal fieldsOther Changes:
Files Changed: 26 files (+549/-588 lines)
Checklist
make generate)make lint-fix)