feat: add dual-side diagnostic overview and fail-safe gating #10

Critical: None. The PR significantly improves robustness by validating the existence and integrity of SBOMs and vulnerability reports, moving away from "soft failures" that often masked misconfigurations.
Testing: No new test files were added, but the logic changes are validated via updated bash/node workflows.
Improvement: The implementation is solid. Future improvements could include consolidating the error reporting logic further, but the current approach of explicit gating is clear and effective.
Nitpick: None. The code is clean and adheres to the existing project style.

The implementation of diagnostic overviews and gating prevents silent failures and correctly forces the pipeline to halt when critical data (SBOMs or vulnerability reports) is missing. This is a correct and necessary change for production-ready differential scanning.

**Summary** * **Critical:** None. The PR significantly improves robustness by validating the existence and integrity of SBOMs and vulnerability reports, moving away from "soft failures" that often masked misconfigurations. * **Testing:** No new test files were added, but the logic changes are validated via updated bash/node workflows. * **Improvement:** The implementation is solid. Future improvements could include consolidating the error reporting logic further, but the current approach of explicit gating is clear and effective. * **Nitpick:** None. The code is clean and adheres to the existing project style. The implementation of diagnostic overviews and gating prevents silent failures and correctly forces the pipeline to halt when critical data (SBOMs or vulnerability reports) is missing. This is a correct and necessary change for production-ready differential scanning.

Philipp added 1 commit 2026-09-13 20:35:04 +02:00

feat: add use-inbuild-sbom input defaulting to false

Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 35s

Details

86a00c54dc

AutoReview approved these changes

2026-09-13 20:35:09 +02:00

Dismissed

AutoReview left a comment

Summary

Critical: None.
Testing: No new test files were added. The changes introduce explicit validation and error handling in the shell script and cve-diff.js, effectively acting as a test for the integrity of the diagnostic pipeline.
Improvement: The implementation is robust. It moves from soft-failing to hard-gating, which is essential for CI reliability. The added diagnostic output in the logs will significantly improve debugging for end-users.
Nitpick: None.

This PR addresses critical observability gaps by implementing diagnostic overviews and fail-safe gates. The changes ensure that missing SBOMs or failed scans result in an explicit error rather than a potentially misleading "empty" report. I concur with the previous approval status.

Status: APPROVED (Re-affirming previous approval as the logic is sound and necessary).

**Summary** * **Critical:** None. * **Testing:** No new test files were added. The changes introduce explicit validation and error handling in the shell script and `cve-diff.js`, effectively acting as a test for the integrity of the diagnostic pipeline. * **Improvement:** The implementation is robust. It moves from soft-failing to hard-gating, which is essential for CI reliability. The added diagnostic output in the logs will significantly improve debugging for end-users. * **Nitpick:** None. This PR addresses critical observability gaps by implementing diagnostic overviews and fail-safe gates. The changes ensure that missing SBOMs or failed scans result in an explicit error rather than a potentially misleading "empty" report. I concur with the previous approval status. **Status:** APPROVED (Re-affirming previous approval as the logic is sound and necessary).

Philipp added 1 commit 2026-09-13 20:40:51 +02:00

docs: add comparison between built-in Syft SBOMs and direct Trivy scanning

Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m36s

Details

e97c5b1fc9

AutoReview approved these changes

2026-09-13 20:40:55 +02:00

AutoReview left a comment

Summary

Critical: None. The PR significantly improves robustness by validating the existence and integrity of SBOMs and vulnerability reports, moving away from "soft failures" that often masked misconfigurations.
Testing: No new test files were added, but the logic changes are validated via updated bash/node workflows.
Improvement: The implementation is solid. Future improvements could include consolidating the error reporting logic further, but the current approach of explicit gating is clear and effective.
Nitpick: None. The code is clean and adheres to the existing project style.

The implementation of diagnostic overviews and gating prevents silent failures and correctly forces the pipeline to halt when critical data (SBOMs or vulnerability reports) is missing. This is a correct and necessary change for production-ready differential scanning. The previous reviews correctly identified these improvements as robust and necessary.

**Summary** * **Critical:** None. The PR significantly improves robustness by validating the existence and integrity of SBOMs and vulnerability reports, moving away from "soft failures" that often masked misconfigurations. * **Testing:** No new test files were added, but the logic changes are validated via updated bash/node workflows. * **Improvement:** The implementation is solid. Future improvements could include consolidating the error reporting logic further, but the current approach of explicit gating is clear and effective. * **Nitpick:** None. The code is clean and adheres to the existing project style. The implementation of diagnostic overviews and gating prevents silent failures and correctly forces the pipeline to halt when critical data (SBOMs or vulnerability reports) is missing. This is a correct and necessary change for production-ready differential scanning. The previous reviews correctly identified these improvements as robust and necessary.

Philipp merged commit abe45ffb02 into main

2026-09-13 20:52:55 +02:00

Philipp deleted branch feat-diagnostic-overview-and-gating

2026-09-13 20:52:55 +02:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Philipp/cve-differential#10