Fix vulnerability count #7196
Fix vulnerability count #7196
Conversation
Codecov ReportPatch and project coverage have no change.
Additional details and impacted files@@ Coverage Diff @@
## main #7196 +/- ##
=========================================
Coverage 61.50% 61.50%
Complexity 1965 1965
=========================================
Files 333 333
Lines 16495 16495
Branches 2359 2359
=========================================
Hits 10146 10146
Misses 5372 5372
Partials 977 977
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
The map returned by `getVulnerabilities()` contains entries for all packages, also those that do not have any vulnerabilities. Also, the previous calculation also counted excluded packages which was not consistent with the total package count which ignores excluded packages. Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
Print the vulnerability count only for included packages to be consistent with the printed package count. Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
mnonnenmacher
force-pushed
the
fix-vulnerability-count
branch
from
76c38f9
to
ce15cc8
Compare
| @@ -140,12 +140,16 @@ class AdvisorCommand : OrtCommand( | |||
| println("The advice took $duration.") | |||
|
|
|||
| with(advisorRun.results.getVulnerabilities()) { | |||
| val totalPackageCount = ortResultOutput.getPackages(omitExcluded = true).size | |||
| val includedPackages = ortResultOutput.getPackages(omitExcluded = true).map { it.metadata.id } | |||
There was a problem hiding this comment.
The map returned by
getVulnerabilities()contains entries for all
packages, also those that do not have any vulnerabilities.
BTW, this is something that also occurred to me in the context of #6613: The advisor's retrievePackageFindings() API definition does not make clear whether the returned map should contain entries for packages that have empty defects and vulnerabilities as part of the AdvisorResult. Should it? Just to get the AdvisorDetails and AdvisorSummary returned?
There was a problem hiding this comment.
I'm not sure about this as well, in some situations like package curations we decided that it has benefits to have explicit empty results to document that something was requested.
There was a problem hiding this comment.
Discussed as part of the Kotlin developer meeting.
Please see the commit messages for details.