Conversation
Problem: When scanning an RPM with a CVE affecting multiple files (e.g., openssl with 3 affected files: .c, .t, .eml), only the first C source file showed fix patterns. Test files and other formats were completely hidden from the report even though they had valid fixes. Root Cause: The _filter_review_snippets() function in cve_checker_report.py was too aggressive, filtering out: 1. Any file with /test/ in the path 2. Any file not ending in .c/.h/.cpp extensions This meant test files (.t) and data files (.eml) were excluded entirely, even when they were legitimately affected by the CVE and had fix patterns. Solution: 1. Modified _filter_review_snippets() to only exclude build-system files (CMakeLists.txt, Makefile, .cmake, .mk) while preserving all source files including tests and non-C/C++ files. 2. Improved _extract_snippets_from_patch() in code_agent_graph_defs.py to ensure one snippet per affected file is extracted first before adding additional snippets from files with multiple hunks. This prevents a single file with many changes from consuming all snippet slots. Impact: Users will now see fix patterns for ALL affected files regardless of file type (C, Perl, email, Python, etc.), making it clear what was actually fixed in each file. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
…terns Co-Authored-By: Tamar Weisskopf <tweissko@redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
…rce only Applied consistent filtering to show only primary C/C++ source code files, excluding test files and build configuration from both sections. Co-Authored-By: Tamar Weisskopf <tweissko@redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Tests the _is_source_code_file and _filter_to_source_code_files functions with the actual TC-5274 example case. Co-Authored-By: Tamar Weisskopf <tweissko@redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
PR Review — TC-5274
Nice cleanup: extracting the predicate into _is_source_code_file / _filter_to_source_code_files and applying it to both affected_files and review snippets removes the duplication and fixes the reported inconsistency. Snippet-filter behavior is preserved exactly, and the empty-result fallback is a sensible guard. A couple of things worth addressing below.
Important
/test/exclusion misses top-leveltest/directories, and the test gives false confidence. The"/test/" in file_pathcheck requires a leading slash, so a top-leveltest/foo.c(exactly how OpenSSL lays out its C test suite) is not matched, ends with.c, and is classified as source. The added assertion_is_source_code_file("test/recipes/80-test_cms.t") is Falsepasses only because.tisn't a source extension — the/test/branch is never actually exercised. A path liketest/bad_dtls_frag.cwould slip through. Considerfile_path.startswith("test/") or "/test/" in file_path, plus a test with a top-leveltest/*.cpath. (See inline comment.)
Suggestions
- Test coverage gaps: no cases for
CMakeLists/Makefileexclusion,.cpp/.cc/.cxxextensions, a top-leveltest/*.cfile, or the empty-result fallback (_filter_to_source_code_filesreturning the original list). The fallback is behaviorally important — if it regresses, reports could silently go empty — yet it's untested. Prefer plainassert-based pytest style over the trailingprint(...), and avoid thesys.path.insertmutation (it leaks into other tests) if a normal import /conftest.pycan be used.
| if "CMakeLists" in file_path or "Makefile" in file_path: | ||
| return False | ||
|
|
||
| if "/test/" in file_path: |
There was a problem hiding this comment.
"/test/" in file_path requires a leading slash, so a top-level test/*.c (e.g. OpenSSL's test/foo.c) is not excluded — it ends with .c and is treated as source, contradicting the "excluding test files" intent. Suggest if file_path.startswith("test/") or "/test/" in file_path: and add a test covering a top-level test/*.c path (the current .t assertion passes on extension, not on this branch).
Fixes inconsistency where affected files section showed test files but fix patterns section did not.
Applied consistent filtering to both sections - now both show only C/C++ source code files, excluding test files and build configuration.
For RPM scan workflow only (C/C++ packages)
Fixes: TC-5274