feat: support dynamic multi-architecture discovery and iteration

cve-diff.js

@@ -24,6 +24,7 @@ const SEVERITY_BADGES = {
  */
 function loadReportsForArg(arg) {
   const cves = new Map();
+  const scannedArchs = new Set();
   const filePaths = [];
 
   for (const part of arg.split(',').map((s) => s.trim())) {
@@ -50,13 +51,19 @@ function loadReportsForArg(arg) {
     }
     if (stat.size === 0) continue;
 
-    const baseName = path.basename(filePath).toLowerCase();
+    const baseName = path.basename(filePath, '.json').toLowerCase();
     let arch = 'all';
-    if (baseName.includes('amd64')) {
+    const cveMatch = baseName.match(/^cve-([a-z0-9_.-]+)$/i);
+    if (cveMatch) {
+      arch = cveMatch[1];
+    } else if (baseName.includes('amd64')) {
       arch = 'amd64';
     } else if (baseName.includes('arm64') || baseName.includes('aarch64')) {
       arch = 'arm64';
     }
+    if (arch !== 'all') {
+      scannedArchs.add(arch);
+    }
 
     let data;
     try {
@@ -88,15 +95,17 @@ function loadReportsForArg(arg) {
     }
   }
 
+  cves.scannedArchs = scannedArchs;
   return cves;
 }
 
 /**
  * Formats a vulnerability record into a Markdown table row.
  * @param {object} v
+ * @param {Set<string>} [allScannedArchs]
  * @returns {string}
  */
-function formatVulnRow(v) {
+function formatVulnRow(v, allScannedArchs = new Set()) {
   const sev = v.Severity || 'UNKNOWN';
   const badge = SEVERITY_BADGES[sev] || `⚪ ${sev}`;
   const vid = v.VulnerabilityID || '';
@@ -106,7 +115,11 @@ function formatVulnRow(v) {
 
   const archs = v._archs || new Set(['all']);
   let archBadge;
-  if ((archs.has('amd64') && archs.has('arm64')) || archs.has('all')) {
+  if (
+    archs.has('all') ||
+    (allScannedArchs && allScannedArchs.size > 1 && archs.size === allScannedArchs.size) ||
+    (archs.has('amd64') && archs.has('arm64'))
+  ) {
     archBadge = '`all`';
   } else {
     archBadge = `\`${Array.from(archs).sort().join(', ')}\``;
@@ -171,6 +184,11 @@ function renderMarkdownDiff(baseCves, branchCves, baseName = 'main') {
     return aPkg.localeCompare(bPkg);
   }
 
+  const allScannedArchs = new Set([
+    ...(baseCves.scannedArchs || []),
+    ...(branchCves.scannedArchs || []),
+  ]);
+
   const newVulns = newKeys.map((k) => branchCves.get(k)).sort(sortVulns);
   const resolvedVulns = resolvedKeys.map((k) => baseCves.get(k)).sort(sortVulns);
 
@@ -190,7 +208,7 @@ function renderMarkdownDiff(baseCves, branchCves, baseName = 'main') {
     lines.push('| Severity | CVE | Package | Arch | Installed | Fixed In | Title |');
     lines.push('| :--- | :--- | :--- | :--- | :--- | :--- | :--- |');
     for (const v of newVulns) {
-      lines.push(formatVulnRow(v));
+      lines.push(formatVulnRow(v, allScannedArchs));
     }
   } else {
     lines.push('✅ No new vulnerabilities introduced in this build.');
@@ -202,7 +220,7 @@ function renderMarkdownDiff(baseCves, branchCves, baseName = 'main') {
     lines.push('| Severity | CVE | Package | Arch | Previously Installed | Fixed In | Title |');
     lines.push('| :--- | :--- | :--- | :--- | :--- | :--- | :--- |');
     for (const v of resolvedVulns) {
-      lines.push(formatVulnRow(v));
+      lines.push(formatVulnRow(v, allScannedArchs));
     }
   } else {
     lines.push('⚪ No existing vulnerabilities were resolved.');