HMS-10223: mark bootc system advisories as applicable

[MichaelMraka]

Secure Coding Practices Checklist GitHub Link

• https://github.com/RedHatInsights/secure-coding-checklist

Secure Coding Checklist

• Input Validation
• Output Encoding
• Authentication and Password Management
• Session Management
• Access Control
• Cryptographic Practices
• Error Handling and Logging
• Data Protection
• Communication Security
• System Configuration
• Database Security
• File Management
• Memory Management
• General Coding Practices

Summary by Sourcery

Handle evaluation and advisory update processing directly from Kafka messages while ensuring bootc systems have all updates marked applicable.

New Features:

• Add support for marking all updates as applicable for bootc (image-mode) systems based on merged VMaaS and yum update data.

Enhancements:

• Refactor message handling so evaluators and advisory update handlers accept raw Kafka messages and perform their own event deserialization.
• Simplify Kafka reader and retry logic by removing generic PlatformEvent and advisory event handler wrappers.
• Update evaluator and aggregator tests to reflect KafkaMessage-based handlers and verify bootc advisory applicability behavior.

Tests:

• Add a dedicated test to verify bootc systems produce only applicable advisories and no installable updates.
• Adjust existing evaluator, notifications, and Kafka round-trip tests to use KafkaMessage-based evaluate and advisory handlers.

[sourcery-ai]

Reviewer's Guide

This PR changes the evaluator and aggregator to consume raw Kafka messages instead of pre-parsed platform/advisory events, adds bootc-specific handling so all updates are marked applicable for image-mode systems, and updates tests accordingly to reflect the new message handling and bootc advisory behavior.

File-Level Changes

Change	Details	Files
Evaluator now consumes KafkaMessage directly, doing its own PlatformEvent deserialization and integrating with the generic retrying Kafka handler.	Refactored evaluateHandler to accept KafkaMessage, unmarshal PlatformEvent via sonic, and log deserialization errors without failing. Updated run() to pass evaluateHandler directly into MakeRetryingHandler instead of wrapping it with MakeMessageHandler. Adjusted evaluator tests (evaluate_test, advisory_update_test, notifications_test, template_advisory_e2e_test) to marshal PlatformEvent into KafkaMessage before calling evaluateHandler.	evaluator/evaluate.go evaluator/evaluate_test.go evaluator/advisory_update_test.go evaluator/notifications_test.go evaluator/template_advisory_e2e_test.go
Bootc/image-mode systems are treated as non-patchable via Insights; all available updates for such systems are forced to APPLICABLE status.	Extended getUpdatesData to, when system.Inventory.Bootc is true and merged VMaaS data is non-nil, iterate merged update list and set installability of all updates to APPLICABLE. Added TestBootcSystemAdvisories to construct a bootc SystemPlatformV2 with VMaaS and yum data and assert that all four available updates are marked applicable and none installable.	evaluator/evaluate.go evaluator/evaluate_test.go
Message handling utilities were simplified: event-specific handler wrappers were removed, and tests now work directly with KafkaMessage handlers using sonic for JSON parsing.	Removed EventHandler, MakeMessageHandler, AdvisoryUpdateEventHandler, and MakeAdvisoryUpdateHandler abstractions from mqueue, along with their sonic-based unmarshalling and logging. Updated aggregator advisoryUpdateHandler to accept KafkaMessage, unmarshal AdvisoryUpdateEvent via sonic, log errors, and be wrapped directly by MakeRetryingHandler. Adjusted mqueue tests to no longer use MakeMessageHandler: TestRoundTripKafkaGo now unmarshals Kafka messages directly, SpawnReader/Retry tests now use KafkaMessage handlers, and TestParseEvents was removed. Imported sonic in mqueue_test for JSON unmarshalling.	base/mqueue/event.go base/mqueue/advisory_update_event.go base/mqueue/mqueue_test.go aggregator/events.go aggregator/aggregator.go

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• Kafka message deserialization is now duplicated in evaluateHandler and advisoryUpdateHandler; consider a shared helper to keep the parsing/logging behavior consistent and easier to adjust in one place.
• In getUpdatesData, the bootc-specific logic forces all updates to APPLICABLE; verify whether any pre-existing StatusID distinctions (e.g., already installed/ignored) should be preserved instead of blindly overriding everything.
• The tests now repeatedly marshal PlatformEvent into KafkaMessage before calling evaluateHandler; a small test helper for this conversion would reduce duplication and make future handler changes easier to propagate.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Kafka message deserialization is now duplicated in `evaluateHandler` and `advisoryUpdateHandler`; consider a shared helper to keep the parsing/logging behavior consistent and easier to adjust in one place.
- In `getUpdatesData`, the bootc-specific logic forces all updates to `APPLICABLE`; verify whether any pre-existing `StatusID` distinctions (e.g., already installed/ignored) should be preserved instead of blindly overriding everything.
- The tests now repeatedly marshal `PlatformEvent` into `KafkaMessage` before calling `evaluateHandler`; a small test helper for this conversion would reduce duplication and make future handler changes easier to propagate.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 41.17647% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.00%. Comparing base (7c7b07b) to head (3bc3d5d).

Files with missing lines	Patch %	Lines
aggregator/events.go	0.00%	6 Missing ⚠️
evaluator/evaluate.go	70.00%	2 Missing and 1 partial ⚠️
aggregator/aggregator.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2277      +/-   ##
==========================================
- Coverage   59.02%   59.00%   -0.02%     
==========================================
  Files         147      147              
  Lines        9327     9324       -3     
==========================================
- Hits         5505     5502       -3     
  Misses       3248     3248              
  Partials      574      574              

Flag	Coverage Δ
unittests	59.00% <41.17%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[TenSt]

lgtm!