fix: handle unavailable open vulnerability score (IN-1241) - #2113
Open
gaspergrom wants to merge 2 commits into
Open
fix: handle unavailable open vulnerability score (IN-1241)#2113gaspergrom wants to merge 2 commits into
gaspergrom wants to merge 2 commits into
Conversation
getOpenVulnRow rendered a false 'no open vulnerabilities' positive when openVulnScore was null (Gerrit repos, excluded repos, or repos with no vuln data), instead of the blocked/no-data state used by sibling signal rows. Signed-off-by: Gašper Grom <gasper.grom@gmail.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Handles unavailable open-vulnerability scores without displaying false positive results.
Changes:
- Returns
no-datawhenopenVulnScoreis null. - Adds a Vitest regression test for the null-score case.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
frontend/config/health-breakdown-templates.ts |
Handles unavailable vulnerability scores. |
frontend/config/health-breakdown-templates.test.ts |
Tests the unavailable-score behavior. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Signed-off-by: Gašper Grom <gasper.grom@gmail.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
Suppressed comments (2)
Previously missed (1) — in code that hasn't changed since the last review.
frontend/config/health-breakdown-templates.test.ts:4
- Use the repository's required TypeScript license-header format. The frontend checklist specifies two leading
//lines, which is also the format used by the existing test suite (for example,frontend/setup/caching.test.ts:1-2).
This issue also appears on line 14 of the same file.
/*
Copyright (c) 2026 The Linux Foundation and each contributor.
SPDX-License-Identifier: MIT
*/
frontend/config/health-breakdown-templates.test.ts:14
- This case does not exercise the null-score condition because
!openVulnAvailableis already true and short-circuits the new||expression. Set availability to true so the test would fail if the explicitopenVulnScore === nullguard were removed.
openVulnAvailable: null,
| // --- Security signals --- | ||
|
|
||
| export const getOpenVulnRow = (signals: HealthBreakdownResults): SignalRow => { | ||
| if (!signals.openVulnAvailable || signals.openVulnScore === null) { |
| } | ||
| if (category === 'security') { | ||
| const availableSignals: string[] = []; | ||
| if (signals?.openVulnAvailable) availableSignals.push('open vulnerability data'); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
getOpenVulnRow()now treats the open-vulnerabilities signal as blocked (status: 'no-data') when eithersignals.openVulnScoreis null ORsignals.openVulnAvailableis falsy, matching the pattern already used by sibling signal functions (getResponsivenessRow(),getBusFactorRow(),getOrgDiversityRow()).openVulnAvailable: boolean | nulltoHealthBreakdownResults— a repo that has never completed a vulnerability scan was previously scored a false-positive "clean"10.openVulnAvailable: false), and scanned-and-clean (openVulnAvailable: true).Cross-repo dependency
This PR reads a new
openVulnAvailablefield from theproject_insights_health_breakdownTinybird endpoint. That field is added by crowd.dev#4509 (adds anopenVulnAvailablecoverage flag through the fullhealth_score_v2_securitypipe chain, based on thevulnerability_scansdatasource).Deploy order: the crowd.dev Tinybird pipe change must be deployed to staging and production before this PR is deployed — until then, the field is simply absent from the API response and
getOpenVulnRowfalls back to its existing null-score check, so this PR is safe to merge independently but should not go live ahead of the pipe deploy.Both the Tinybird deploy and end-to-end QA verification are intentionally deferred to a follow-up session.