Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

refactor(Repository): Add RepositoryProvenance attribute #10575

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pepper-jk wants to merge 12 commits into oss-review-toolkit:main
base: main
Choose a base branch
Loading
from pepper-jk:repository-provenance-wrapper

Conversation

Copy link
Contributor

@pepper-jk pepper-jk commented Jul 9, 2025
edited
Loading

This draft includes the first changes for my personal POC for the LocalProvenance Input discussed in #8803.
As it's scope is so small, it might be good first contribution towards that goal.
If not, feel free to let me know. All feedback is welcome.

The Repository data structure seems the easiest place to allow Provenances as Analyzer and Scanner input.
This avoids refactoring the attributes of higher level data structures, such as OrtResult.
At the moment the implementation limits it to RepositoryProvence though, in order to keep its previous behavior. (削除) To that end, it also continues to expose the raw VcsInfo of the provenance as its vcs attribute. (削除ここまで)

Signed-off-by: Jens Keim jens.keim@forvia.com

jens-erdmann reacted with thumbs up emoji
@pepper-jk pepper-jk force-pushed the repository-provenance-wrapper branch from b608307 to cdc634c Compare July 31, 2025 12:34
@pepper-jk pepper-jk force-pushed the repository-provenance-wrapper branch 3 times, most recently from e01ca18 to 1107a05 Compare September 2, 2025 11:09
Copy link
Contributor Author

Just a rebase onto 66.1.0.

@pepper-jk pepper-jk force-pushed the repository-provenance-wrapper branch 2 times, most recently from 9ac6ba5 to 101b10c Compare September 11, 2025 13:25
Copy link
Contributor Author

pepper-jk commented Sep 11, 2025
edited
Loading

Okay, according to the tests, I clearly missed something.
Unfortunately, I need to finish up for the week, so I will be back at this on Monday.
If you have any feedback or input on the failing tests in the meantime, it would be greatly appreciated.

Copy link

codecov bot commented Sep 11, 2025
edited
Loading

Codecov Report

❌ Patch coverage is 0% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 57.54%. Comparing base (783c6d5) to head (c45f7ba).

Files with missing lines Patch % Lines
...ands/CreateAnalyzerResultFromPackageListCommand.kt 0.00% 5 Missing ⚠️
Additional details and impacted files
@@ Coverage Diff @@
## main #10575 +/- ##
============================================
- Coverage 57.57% 57.54% -0.03% 
 Complexity 1702 1702 
============================================
 Files 346 346 
 Lines 12829 12833 +4 
 Branches 1212 1212 
============================================
- Hits 7386 7385 -1 
- Misses 4978 4983 +5 
 Partials 465 465 
Flag Coverage Δ
funTest-docker 71.03% <ø> (+0.04%) ⬆️
test-ubuntu-24.04 42.28% <0.00%> (-0.02%) ⬇️
test-windows-2025 42.26% <0.00%> (-0.02%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Member

If you have any feedback or input on the failing tests in the meantime, it would be greatly appreciated.

I think the general problem is that older ORT results that do not contain a RepositoryProvenance still need to be deserializable. You probably need to write a custom deserializer for that...

pepper-jk reacted with thumbs up emoji

@pepper-jk pepper-jk force-pushed the repository-provenance-wrapper branch from 9090be5 to cc83150 Compare September 16, 2025 10:50
Copy link
Contributor Author

I think the general problem is that older ORT results that do not contain a RepositoryProvenance still need to be deserializable. You probably need to write a custom deserializer for that...

Thanks for the hint, adding the custom Deserializer fixed a lot of tests. Quite some progress today.

Working on fixing the other tests. Will get back to it tomorrow.

sschuberth reacted with thumbs up emoji

@pepper-jk pepper-jk force-pushed the repository-provenance-wrapper branch 4 times, most recently from 6c12714 to a799cee Compare September 17, 2025 14:25
Copy link
Contributor Author

pepper-jk commented Sep 17, 2025
edited
Loading

@sschuberth @mnonnenmacher
Not quite done yet, but feedback on the fixes for the tests so far would be awesome for tomorrow. 😃

Copy link
Member

Not quite done yet, but feedback on the fixes for the tests so far would be awesome for tomorrow. 😃

Sorry, I'll not be available tomorrow.

Copy link
Contributor Author

Not quite done yet, but feedback on the fixes for the tests so far would be awesome for tomorrow. 😃

Sorry, I'll not be available tomorrow.

Oh, my bad. I forgot. See you next week.

This comment was marked as outdated.

Copy link
Member

@pepper-jk, please rebase to get rid of a test failure.

pepper-jk reacted with thumbs up emoji

Copy link
Contributor Author

pepper-jk commented Sep 23, 2025
edited
Loading

@pepper-jk, please rebase to get rid of a test failure.

I think the failing test is unrelated. The Expat package got a security update on September 16, and Conan is delivering the new package now.

@pepper-jk pepper-jk force-pushed the repository-provenance-wrapper branch from 601b9ee to 8615132 Compare September 23, 2025 10:01
Copy link
Member

@pepper-jk, please rebase to get rid of a test failure.

I think the failing test is unrelated. The Expat package got a security update on September 16, and Conan is delivering the new package now.

That's exactly the reason why you should do the rebase 😉 We fixed that already in main.

Copy link
Contributor Author

@pepper-jk, please rebase to get rid of a test failure.

I think the failing test is unrelated. The Expat package got a security update on September 16, and Conan is delivering the new package now.

That's exactly the reason why you should do the rebase 😉 We fixed that already in main.

I am already working on the rebase as we speak. I was just checking the tests first to be sure yesterdays changes did not mess anything up.

@pepper-jk pepper-jk force-pushed the repository-provenance-wrapper branch from 8615132 to 07b78f2 Compare September 23, 2025 10:06
Copy link
Contributor Author

Rebased on 68.2.0 to check in on tests. WIll rebase on main after.

@pepper-jk pepper-jk force-pushed the repository-provenance-wrapper branch from 07b78f2 to 1230128 Compare September 23, 2025 13:10
Copy link
Contributor Author

Rebased on current main now.

Copy link
Contributor Author

As discussed in the community meeting today, the Repository should contain normalized vcsInfo and resolved revisions.

This should solve the remaining two threads. So that is what I will be working on now.

@pepper-jk pepper-jk force-pushed the repository-provenance-wrapper branch from 62104e4 to 512ec6b Compare September 25, 2025 11:04
In order to support non-VCS input for ORT, `KnownProvenance`s need to
be supported as input for `anaylzer` and `scanner`. The `Repository`
data structure appears to be the best place to facilitate this change.
This change focusses on adding a `RepositoryProvenance` attribute to
`Repository`, which allows to keep previous behavior.
For now it also exposes the raw `VcsInfo` of the `provenance` as its
`vcs` attribute.
Signed-off-by: Jens Keim <jens.keim@forvia.com>
Remove `vcs` and `vcsProcessed` attributes from `Repository`, since
the `RepositoryProvenance` `provenance` is now the main attribute.
Add `RepositoryDeserializer` to support parsing of legacy `OrtResult` files
containing the previous attributes `vcs` and `vcsProcessed`, as well as the
new format. It also needs to handle the `nestedRepositories` and `config`
attributes for both legacy and recent `OrtResult` files.
Signed-off-by: Jens Keim <jens.keim@forvia.com>
Signed-off-by: Jens Keim <jens.keim@forvia.com>
...blank
Signed-off-by: Jens Keim <jens.keim@forvia.com>
Signed-off-by: Jens Keim <jens.keim@forvia.com>
Since these files are just parsed as plain text instead of deserialized
into ORT data structures, updating them to the syntax appears to be the
only way to fix the tests from here on out.
Signed-off-by: Jens Keim <jens.keim@forvia.com>
`Repository.provenance.vcsInfo` would be even better, but KDoc appears to
not be able to follow at this attribute depth.
Signed-off-by: Jens Keim <jens.keim@forvia.com>
Signed-off-by: Jens Keim <jens.keim@forvia.com>
Comment on lines +100 to +106
// Get the [vcs]'s revision.
// Fall back to [vcsProcessed], if [vcs] has empty revision.
val resolvedRevision = vcs.revision.ifEmpty {
vcsProcess.revision.ifEmpty {
HashAlgorithm.SHA1.emptyValue
}
}
Copy link
Contributor Author

@pepper-jk pepper-jk Sep 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The EvaluatedModelReporterFunTests are currently failing, since the Deserializer can not extract a resolvedRevison from the legacy Repository data structure, as the vcs_processed only references master. See reporter-test-input.yml, which is used as input in the tests.

I assume I would need to iterate over the other nodes in the file and get the resolved_revision from a provenance, e.g. inside the scanner at L542 or the list of provenances at L438.

Since there is a findParent method, I assume it would at least be possible to iterate over other nodes from inside a Deserializer, but I have not confirmed this yet.

@sschuberth @mnonnenmacher Before I continue on this hunch, could you way in on the issue?

@pepper-jk pepper-jk force-pushed the repository-provenance-wrapper branch from baab4b2 to c45f7ba Compare September 25, 2025 15:49
Copy link
Contributor Author

Rebased onto main aka 69.0.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sschuberth sschuberth sschuberth left review comments

@mnonnenmacher mnonnenmacher Awaiting requested review from mnonnenmacher

@fviernau fviernau Awaiting requested review from fviernau

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AltStyle によって変換されたページ (->オリジナル) /