Added catch for empty results file in dependency track #146
Conversation
WalkthroughBumps package to 1.31.4, updates CHANGELOG compare links, changes CLI --timeout to parse as float with numeric default, updates DEFAULT_TIME_OUT to float, and adds an early-return guard in Dependency Track project-violation logic to treat empty SBOMs as updated. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Caller
participant Inspector as ProjectViolationInspector
participant DT as DependencyTrackAPI
Caller->>Inspector: is_project_updated(project)
Inspector->>DT: fetch last_import, last_occurrence, metrics
DT-->>Inspector: timestamps + metrics
alt last_occurrence ≥ last_import AND components < 1
note right of Inspector #D6EAF8: New guard — empty SBOM treated as updated
Inspector-->>Caller: return True (short-circuit)
else existing timestamp checks
Inspector-->>Caller: continue existing checks and return result
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. 📜 Recent review detailsConfiguration used: CodeRabbit UI 💡 Knowledge Base configuration:
You can enable these sources in your CodeRabbit configuration. 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
CHANGELOG.md (1)
12-15: Polish 1.31.4 changelog entry: capitalization and punctuationMinor consistency nit. Other entries typically capitalize “Dependency Track,” and ending with a period reads better.
Apply this diff:
## [1.31.4] - 2025-08-20 ### Added -- Added support for empty dependency track project policy checks +- Added support for empty Dependency Track project policy checks.src/scanoss/cli.py (1)
804-809: Timeout as float — OK. Consider using the shared constant to avoid driftParsing as float is good. To keep defaults centralized and consistent with the implementation, reference DEFAULT_TIME_OUT from the policy checker module rather than hardcoding 300.
Apply this diff in the option definition:
- --timeout', '-M', - required=False, - default=300, - type=float, + --timeout', '-M', + required=False, + default=DEFAULT_TIME_OUT, + type=float, help='Timeout (in seconds) for API communication (optional - default 300 sec)'And update the import to bring in the constant (outside the selected range):
from scanoss.inspection.dependency_track.project_violation import ( DependencyTrackProjectViolationPolicyCheck, DEFAULT_TIME_OUT, )
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (4)
CHANGELOG.md(2 hunks)src/scanoss/__init__.py(1 hunks)src/scanoss/cli.py(1 hunks)src/scanoss/inspection/dependency_track/project_violation.py(2 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
src/scanoss/inspection/dependency_track/project_violation.py (1)
src/scanoss/scanossbase.py (1)
print_msg(51-56)
🪛 LanguageTool
CHANGELOG.md
[grammar] ~12-~12: There might be a mistake here.
Context: ...ing changes... ## [1.31.4] - 2025-08-20 ### Added - Added support for empty dependen...
(QB_NEW_EN)
[grammar] ~13-~13: There might be a mistake here.
Context: ...s... ## [1.31.4] - 2025-08-20 ### Added - Added support for empty dependency track...
(QB_NEW_EN)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (3)
src/scanoss/__init__.py (1)
25-25: Version bump to 1.31.4 — OKMatches the CHANGELOG entry and aligns with the release intent. No functional impact.
CHANGELOG.md (1)
649-651: Compare links for 1.31.3 and 1.31.4 — OKLinks look correct and consistent with prior entries.
src/scanoss/inspection/dependency_track/project_violation.py (1)
34-35: Use float timeout default — OKSwitching DEFAULT_TIME_OUT to a float (300.0) is consistent with the CLI change and avoids implicit casts.
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
Summary by CodeRabbit
New Features
Bug Fixes
Chores