Remove the Licenses tab the Compliance tab replaced - #37
Merged
Conversation
Trivy picks a distro advisory database from an operating-system component, not from package PURLs, so a supplier SBOM listing every rpm on an image reported zero vulnerabilities. Measured on Trivy 0.71.2: 0 findings without the component, 306 with it; SPDX behaves the same (0 -> 166) and needs the SPDXRef-OperatingSystem id prefix, not primaryPackagePurpose. Infer the distro from the packages and scan an enriched copy — the upload itself is never edited, since it backs the conformance verdict and the signature bundle. A second defect surfaced alongside: os-pkgs results are labelled with the distro, which no PURL reconstruction maps, so every distro finding was dropped as "no purl". Fall back to the PURL Trivy attaches to the finding, leaving reconstruction first so existing ecosystems are untouched. Upstream's rewrite of an existing OS version down to its major release is deliberately not ported: centos 7.9.2009, rocky 8.10, alma 9.3 and redhat 8.9 each matched identically with and without the minor.
LicensesTab / LicensesToolbar stopped being routed when ComplianceTab took over (W9-#58), but the files and their unit test stayed, so the screen still read as live. Remove them along with useLicenses, whose only caller they were. licensesApi keeps listProjectLicenses: the list endpoint is staying as a REST surface a CI job can call, and this file is where it is typed and tested. That it now has no in-app caller is stated in the file. Comments that pointed at the removed files were repointed at what they actually mirror.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LicensesTabandLicensesToolbarstopped being routed whenComplianceTabtook over (W9-#58), but the files and their unit test stayed in the tree. A reader grepping for the licenses screen found a fully-formed component with tests and no indication it was dead.Removed:
components/LicensesTab.tsx,components/LicensesToolbar.tsxtests/unit/features/projects/LicensesTab.test.tsxapi/useLicenses.ts— the tab was its only callerKept, deliberately:
api/licensesApi.tsand itslistProjectLicenses. The list endpoint is staying as a REST surface a CI job can call, this file is where that surface is typed and tested, and deleting the function alone would cascade throughLicenseListResponse,ListLicensesParams, the query serializer and their tests. That it now has no in-app caller is stated in the file rather than left to be rediscovered.Comments in
ObligationsTab,ObligationsToolbar,ComplianceTab,ReportsTab,useObligationsand four test files pointed at the removed files ("MirrorsLicensesTab"); they now name what they actually mirror, or say the thing directly.The E2E harness verbs
selectLicensesTab/expectLicensesTabReadyare untouched — they click the Compliance tab and their own doc comment already explains the historical name. Renaming them would touch a dozen spec files for no behavioural reason.Verification
npm run typecheckclean; 1981 unit tests pass across 184 files.npm run lintexits 0. The 36 warnings it prints are unchanged frommain(verified by stashing).