test: add unit tests for cve-diff and fallback for in-build sbom scans

test/cve-diff.test.js

@@ -0,0 +1,111 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const {
+  loadReportsForArg,
+  formatVulnRow,
+  renderMarkdownDiff,
+  renderFullSummary,
+} = require('../cve-diff.js');
+
+const FIXTURES_DIR = path.join(__dirname, 'fixtures');
+
+test('loadReportsForArg loads valid reports and extracts multi-arch metadata', () => {
+  const targetDir = path.join(FIXTURES_DIR, 'target');
+  const cves = loadReportsForArg(targetDir);
+
+  assert.equal(cves.size, 2);
+  assert.ok(cves.has('CVE-2023-0001:::glibc'));
+  assert.ok(cves.has('CVE-2023-0002:::openssl'));
+
+  const glibc = cves.get('CVE-2023-0001:::glibc');
+  assert.equal(glibc.Severity, 'CRITICAL');
+  assert.deepEqual(Array.from(glibc._archs).sort(), ['amd64', 'arm64']);
+  assert.deepEqual(Array.from(cves.scannedArchs).sort(), ['amd64', 'arm64']);
+
+  const openssl = cves.get('CVE-2023-0002:::openssl');
+  assert.equal(openssl.Severity, 'HIGH');
+  assert.deepEqual(Array.from(openssl._archs), ['amd64']);
+});
+
+test('loadReportsForArg handles reports with missing or null Results array without crashing', () => {
+  const emptyDir = path.join(FIXTURES_DIR, 'empty');
+  const cves = loadReportsForArg(emptyDir);
+
+  assert.equal(cves.size, 0);
+});
+
+test('renderMarkdownDiff produces correct introduced, resolved, and unchanged sets', () => {
+  const targetDir = path.join(FIXTURES_DIR, 'target');
+  const headDir = path.join(FIXTURES_DIR, 'head');
+
+  const baseCves = loadReportsForArg(targetDir);
+  const branchCves = loadReportsForArg(headDir);
+
+  const diff = renderMarkdownDiff(baseCves, branchCves, 'main');
+
+  // Introduced: CVE-2023-0003 (curl)
+  assert.ok(diff.includes('New Vulnerabilities Introduced (1)'));
+  assert.ok(diff.includes('CVE-2023-0003'));
+  assert.ok(diff.includes('`curl`'));
+
+  // Resolved: CVE-2023-0001 (glibc)
+  assert.ok(diff.includes('Resolved / Removed Vulnerabilities (1)'));
+  assert.ok(diff.includes('CVE-2023-0001'));
+  assert.ok(diff.includes('`glibc`'));
+
+  // Unchanged count
+  assert.ok(diff.includes('| ⚪ **Unchanged Vulnerabilities** | 1 |'));
+
+  // Multi-arch is present in fixtures (amd64, arm64), so Arch column should be shown
+  assert.ok(diff.includes('| Arch |'));
+});
+
+test('renderMarkdownDiff hides Arch column when single architecture is scanned', () => {
+  const targetSingle = path.join(FIXTURES_DIR, 'target', 'cve-amd64.json');
+  const headSingle = path.join(FIXTURES_DIR, 'head', 'cve-amd64.json');
+
+  const baseCves = loadReportsForArg(targetSingle);
+  const branchCves = loadReportsForArg(headSingle);
+
+  const diff = renderMarkdownDiff(baseCves, branchCves, 'main');
+
+  assert.ok(!diff.includes('| Arch |'));
+  assert.ok(diff.includes('New Vulnerabilities Introduced (1)'));
+  assert.ok(diff.includes('Resolved / Removed Vulnerabilities (1)'));
+});
+
+test('renderFullSummary outputs summary table and lists all vulnerabilities', () => {
+  const headDir = path.join(FIXTURES_DIR, 'head');
+  const headCves = loadReportsForArg(headDir);
+
+  const summary = renderFullSummary(headCves);
+
+  assert.ok(summary.includes('### 🛡️ Security Scan Report'));
+  assert.ok(summary.includes('| Total Vulnerabilities | **2** |'));
+  assert.ok(summary.includes('CVE-2023-0002'));
+  assert.ok(summary.includes('CVE-2023-0003'));
+});
+
+test('formatVulnRow properly formats badge, architecture tag, and escape pipes', () => {
+  const vuln = {
+    Severity: 'CRITICAL',
+    VulnerabilityID: 'CVE-2023-0001',
+    PrimaryURL: 'https://avd.aquasec.com/nvd/cve-2023-0001',
+    PkgName: 'glibc',
+    InstalledVersion: '2.31',
+    FixedVersion: '2.32',
+    Title: 'A vulnerability with | pipe symbol',
+    _archs: new Set(['amd64']),
+  };
+
+  const allArchs = new Set(['amd64', 'arm64']);
+  const rowWithArch = formatVulnRow(vuln, allArchs, true);
+
+  assert.ok(rowWithArch.includes('🔴 CRITICAL'));
+  assert.ok(rowWithArch.includes('`amd64`'));
+  assert.ok(rowWithArch.includes('\\|')); // Pipe escaped
+
+  const rowWithoutArch = formatVulnRow(vuln, allArchs, false);
+  assert.ok(!rowWithoutArch.includes('`amd64`'));
+});

test/fixtures/empty/cve-amd64.json

@@ -0,0 +1,8 @@
+{
+  "SchemaVersion": 2,
+  "ArtifactName": "debian:bullseye-slim",
+  "ArtifactType": "spdx",
+  "Metadata": {
+    "OS": null
+  }
+}

test/fixtures/head/cve-amd64.json

@@ -0,0 +1,30 @@
+{
+  "SchemaVersion": 2,
+  "ArtifactName": "debian:bookworm-slim",
+  "ArtifactType": "container_image",
+  "Results": [
+    {
+      "Target": "debian:bookworm-slim (debian 12)",
+      "Class": "os-pkgs",
+      "Type": "debian",
+      "Vulnerabilities": [
+        {
+          "VulnerabilityID": "CVE-2023-0002",
+          "PkgName": "openssl",
+          "InstalledVersion": "1.1.1n-0+deb11u4",
+          "FixedVersion": "1.1.1n-0+deb11u5",
+          "Severity": "HIGH",
+          "Title": "Timing attack in OpenSSL"
+        },
+        {
+          "VulnerabilityID": "CVE-2023-0003",
+          "PkgName": "curl",
+          "InstalledVersion": "7.88.1-10",
+          "FixedVersion": "7.88.1-10+deb12u1",
+          "Severity": "MEDIUM",
+          "Title": "Buffer overflow in curl"
+        }
+      ]
+    }
+  ]
+}

test/fixtures/head/cve-arm64.json

@@ -0,0 +1,22 @@
+{
+  "SchemaVersion": 2,
+  "ArtifactName": "debian:bookworm-slim",
+  "ArtifactType": "container_image",
+  "Results": [
+    {
+      "Target": "debian:bookworm-slim (debian 12)",
+      "Class": "os-pkgs",
+      "Type": "debian",
+      "Vulnerabilities": [
+        {
+          "VulnerabilityID": "CVE-2023-0003",
+          "PkgName": "curl",
+          "InstalledVersion": "7.88.1-10",
+          "FixedVersion": "7.88.1-10+deb12u1",
+          "Severity": "MEDIUM",
+          "Title": "Buffer overflow in curl"
+        }
+      ]
+    }
+  ]
+}

test/fixtures/target/cve-amd64.json

@@ -0,0 +1,36 @@
+{
+  "SchemaVersion": 2,
+  "ArtifactName": "debian:bullseye-slim",
+  "ArtifactType": "container_image",
+  "Metadata": {
+    "OS": {
+      "Family": "debian",
+      "Name": "11"
+    }
+  },
+  "Results": [
+    {
+      "Target": "debian:bullseye-slim (debian 11)",
+      "Class": "os-pkgs",
+      "Type": "debian",
+      "Vulnerabilities": [
+        {
+          "VulnerabilityID": "CVE-2023-0001",
+          "PkgName": "glibc",
+          "InstalledVersion": "2.31-13+deb11u5",
+          "FixedVersion": "2.31-13+deb11u6",
+          "Severity": "CRITICAL",
+          "Title": "Memory corruption in glibc"
+        },
+        {
+          "VulnerabilityID": "CVE-2023-0002",
+          "PkgName": "openssl",
+          "InstalledVersion": "1.1.1n-0+deb11u4",
+          "FixedVersion": "1.1.1n-0+deb11u5",
+          "Severity": "HIGH",
+          "Title": "Timing attack in OpenSSL"
+        }
+      ]
+    }
+  ]
+}

test/fixtures/target/cve-arm64.json

@@ -0,0 +1,22 @@
+{
+  "SchemaVersion": 2,
+  "ArtifactName": "debian:bullseye-slim",
+  "ArtifactType": "container_image",
+  "Results": [
+    {
+      "Target": "debian:bullseye-slim (debian 11)",
+      "Class": "os-pkgs",
+      "Type": "debian",
+      "Vulnerabilities": [
+        {
+          "VulnerabilityID": "CVE-2023-0001",
+          "PkgName": "glibc",
+          "InstalledVersion": "2.31-13+deb11u5",
+          "FixedVersion": "2.31-13+deb11u6",
+          "Severity": "CRITICAL",
+          "Title": "Memory corruption in glibc"
+        }
+      ]
+    }
+  ]
+}