[trustify-ci-bot]

The openapi.yaml of trustify has changed

Summary by Sourcery

Synchronize the client API contract with the latest Trustify OpenAPI definition, including correlation capabilities, ingestion endpoints, frontend metadata, and deprecations.

New Features:

• Add OpenAPI definitions for document ingestion from URLs and uploads, plus comprehensive correlation querying, verdict, configuration, freshness, preview, and refresh APIs.
• Expose frontend configuration metadata and expanded correlation-related response schemas in the generated client specification.

Enhancements:

• Mark legacy importer, SBOM advisory, vulnerability analysis, and advisory status APIs as deprecated in favor of newer interfaces.
• Update importer, OSV configuration, vulnerability, weakness, pagination, and related API schemas to match the latest Trustify contract.

Tests:

• Update read-only context tests for the newly exposed frontend configuration field.

Chores:

• Synchronize the Trustify OpenAPI client specification with the latest server API.

[sourcery-ai]

Sorry @trustify-ci-bot[bot], you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 17 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The OpenAPI client contract is synchronized with a substantially expanded trustd API: it adds document ingestion and frontend configuration, introduces the complete correlation engine surface and models, and updates existing importer, vulnerability, advisory, crypto, and deprecated API definitions.

Sequence diagram for URL document ingestion

sequenceDiagram
    participant Client
    participant Trustd
    participant RemoteURL
    participant Ingestion

    Client->>Trustd: uploadDocumentFromUrl
    Trustd->>RemoteURL: Download document
    RemoteURL-->>Trustd: Document content
    Trustd->>Ingestion: Ingest document
    Ingestion-->>Trustd: Ingestion result
    Trustd-->>Client: 201 Document ingested

Loading

Sequence diagram for correlation query and verdict resolution

sequenceDiagram
    participant Client
    participant Trustd
    participant Correlation
    participant Evidence

    Client->>Trustd: queryCorrelation
    Trustd->>Correlation: Resolve identifier matches
    Correlation->>Evidence: Select evidence and calculate confidence
    Evidence-->>Correlation: Verdicts and explanations
    Correlation-->>Trustd: QueryResult
    Trustd-->>Client: 200 QueryResult

Loading

Flow diagram for correlation freshness refresh

flowchart TD
    Start[Correlation data may be stale]
    Overview[getCorrelationFreshness]
    List[listCorrelationFreshnessSboms]
    StartCorrelation[startCorrelationRefresh]
    Job[RefreshJob]
    Status[getCorrelationRefresh]
    Current[SBOM evidence is current]

    Start --> Overview
    Overview --> List
    List --> StartCorrelation
    StartCorrelation --> Job
    Job --> Status
    Status --> Current

Loading

File-Level Changes

Change	Details	Files
Add ingestion, upload, and frontend configuration API definitions to the OpenAPI contract.	Add advisory and generic document ingestion endpoints, including URL-based ingestion, format hints, labels, issuer, and related responses. Expose frontend OIDC configuration through the well-known response and add the FrontendInfo schemas. Add the shared URL-ingestion request schema.	client/openapi/trustd.yaml
Introduce the correlation engine API surface and its supporting data models.	Add endpoints for advisory statements, confidence, freshness, configuration options, previews, provider aliases, identifier queries, refresh jobs, SBOM verdicts, and verdict counts. Define schemas for correlation results, evidence, confidence, provider resolution, freshness, refresh jobs, verdicts, identifiers, and resolution explanations. Add pagination and authorization/capability-disabled response contracts across correlation operations.	client/openapi/trustd.yaml
Update existing API contracts for deprecations, expanded resources, and importer behavior.	Mark legacy SBOM advisory, vulnerability analysis, importer listing, and advisory status fields as deprecated with migration guidance. Restore and extend crypto, dataset, vulnerability, weakness, and upload path definitions alongside the new correlation paths. Add paginated v4 importer listing and revise OSV importer configuration to use direct repository, branch, and path fields. Expand vulnerability/weakness listing parameters and add new weakness and vulnerability detail contracts.	client/openapi/trustd.yaml
Expand and refine reusable schemas to match the updated server API.	Add assertion, statement, matching-range, score, remediation, provider, and context enums and objects. Add correlation option, preview, query, refresh, verdict, and SBOM summary schemas. Update importer, remediation, advisory, and existing response schemas with descriptions, deprecation metadata, and revised fields.	client/openapi/trustd.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.50%. Comparing base (5c7bd10) to head (51eb1f8).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1408      +/-   ##
==========================================
+ Coverage   62.47%   62.50%   +0.03%     
==========================================
  Files         257      257              
  Lines        6057     6057              
  Branches     2036     2036              
==========================================
+ Hits         3784     3786       +2     
+ Misses       2036     2034       -2     
  Partials      237      237              

Flag	Coverage Δ
e2e	70.52% <ø> (+0.04%)	⬆️
unit	27.89% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sourcery-ai]

Sourcery assessment

Approved.

[trustify-ci-bot]

Successfully created backport PR for release/0.7.z:

• chore(openapi): [main] update client/openapi/trustd.yaml [Backport release/0.7.z] #1411