feat(vulnerability): replace hasSBOM with sbom.status and add SBOM processing UX by ybelMekk · Pull Request #445 · nais/console-frontend

ybelMekk · 2026-05-19T13:58:42Z

Summary

Replaces the deprecated hasSBOM: Boolean field with the new sbom { status, processingStartedAt } object across all vulnerability-related queries, and adds a full SBOM processing UX.

Changes

New components

SbomStatusIcon — icon indicating SBOM health (healthy / processing / warning / no-sbom)
SbomProcessingCard — card with live elapsed timer shown while SBOM is being processed

Updated components

WorkloadsWithVulnerabilities — replaces table with List, shows SbomStatusIcon per row, auto-refreshes every 10s when any workload is PROCESSING
WorkloadVulnerabilitySummary — shows processing card and failed/no-sbom alerts
ImageVulnerabilities — shows processing/warning alert, auto-refreshes every 20s while PROCESSING
VulnerabilityBadges — SBOM-status-aware badge display
App vulnerabilities page — SbomStatusIcon in summary heading, polling on PROCESSING
Job vulnerabilities page — same as app
App sidebar — vulnerability summary with SbomStatusIcon

Utilities

sbomStatusDetails — returns indicator, label, description for a given SBOMStatus
formatProcessingDuration — human-readable elapsed time

Dependencies

Requires Enhance SBOM handling with new types, resolvers, and tests api#439 (adds ContainerImageSBOM.status and ContainerImageSBOM.processingStartedAt)

Copilot

Pull request overview

Adds SBOM status awareness to vulnerability views, replacing hasSBOM query usage with sbom.status and adding processing/failure/no-SBOM UI states.

Changes:

Updates vulnerability GraphQL queries to fetch sbom { status, processingStartedAt }.
Adds SBOM status utilities, icon, and processing card.
Updates workload/app/job vulnerability summaries and lists to show SBOM state and polling while processing.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`src/routes/team/[team]/[env]/job/[job]/vulnerabilities/query.gql`	Fetches SBOM status fields for job image vulnerability page.
`src/routes/team/[team]/[env]/job/[job]/vulnerabilities/+page.svelte`	Adds SBOM processing/no-SBOM/failed UI and polling for jobs.
`src/routes/team/[team]/[env]/app/[app]/vulnerabilities/query.gql`	Fetches SBOM status fields for app image vulnerability page.
`src/routes/team/[team]/[env]/app/[app]/vulnerabilities/+page.svelte`	Adds SBOM processing/no-SBOM/failed UI and polling for apps.
`src/routes/team/[team]/[env]/app/[app]/query.gql`	Adds image SBOM and vulnerability summary data to app query.
`src/routes/team/[team]/[env]/app/[app]/+page.svelte`	Adds vulnerability summary with SBOM icon to app sidebar.
`src/lib/utils/vulnerabilities.ts`	Adds SBOM status mapping and processing duration helpers.
`src/lib/utils/vulnerabilities.test.ts`	Adds tests for SBOM status and duration helpers.
`src/lib/domain/vulnerability/WorkloadVulnerabilitySummary.svelte`	Updates summary rendering for SBOM status states.
`src/lib/domain/vulnerability/WorkloadsWithVulnerabilities.svelte`	Reworks vulnerability workload list with SBOM icons and processing polling.
`src/lib/domain/vulnerability/VulnerabilityBadges.svelte`	Adjusts badge styling.
`src/lib/domain/vulnerability/SbomStatusIcon.svelte`	Adds reusable SBOM status icon component.
`src/lib/domain/vulnerability/SbomProcessingCard.svelte`	Adds reusable SBOM processing status card.
`src/lib/domain/vulnerability/ImageVulnerabilities.svelte`	Adds SBOM status fetching, alerts, and polling support.
`schema.graphql`	Updates generated schema with SBOM fields/status enum.
`package.json`	Adds a direct optional Rollup native package dependency.

…ocessing UX - Replace hasSBOM boolean with sbom { status, processingStartedAt } in all queries - Add SBOMStatus-aware utils: sbomStatusDetails, formatProcessingDuration - Add SbomStatusIcon component (healthy/processing/warning/no-sbom) - Add SbomProcessingCard component with live elapsed timer - WorkloadVulnerabilitySummary: show processing card, failed/no-sbom alerts - WorkloadsWithVulnerabilities: replace table with List, add sbom status icon, auto-refresh every 10s when any workload is PROCESSING - ImageVulnerabilities: show processing/warning alert, auto-refresh every 20s - App vulnerabilities page: show SbomStatusIcon in summary heading, poll on PROCESSING - Job vulnerabilities page: same as app - App sidebar: add vulnerability summary with SbomStatusIcon - Depends on nais/api#439

UI default was ascending while query defaulted to DESC, causing a mismatch when selecting a vulnerability sort field for the first time.

…s null When status is READY but vulnerabilitySummary is absent, hasVulnerabilityData is false but imageStaleness.indicator is healthy, so no branch rendered. Added {:else} fallback showing the temporary-unavailable info alert.

…UM row --ax-warning-600 does not exist in the design system. Use --ax-warning-500 as the dark-mode background and --ax-warning-400 for the hover state, consistent with the scale used elsewhere in the codebase.

Lockfile was out of sync with package.json after dependency updates, causing npm ci to fail in CI.

Copilot

Pull request overview

Copilot reviewed 16 out of 17 changed files in this pull request and generated 5 comments.

… with generic resource types

…fetch The effect tracked the whole data object, so every NetworkOnly fetch while status remained PROCESSING would reset nextRefresh and recreate intervals. Deriving sbomStatus separately ensures the effect only re-runs on genuine status transitions.

The markup const shadowed the team slug prop from script, making the component harder to read. Also regenerate package-lock.json to fix npm ci failures in CI.

Copilot

Pull request overview

Copilot reviewed 16 out of 17 changed files in this pull request and generated 1 comment.

Previous lockfile was generated with node 25, causing npm ci to fail in CI which runs node 24 via mise.

These enum values were removed from the schema. APPLICATION_UPDATED has no direct replacement; JOB_UPDATED is also gone. Remove them from the filter group to fix svelte-check type errors.

Copilot

Pull request overview

Copilot reviewed 17 out of 18 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

src/routes/team/[team]/activity-log/+page.svelte:53

groupedActivities is used to render the filter menu, but ActivityLogActivityType.GENERIC_KUBERNETES_RESOURCE_UPDATED (added in the updated schema) isn’t included in any group. That makes the activity type impossible to select/deselect in the UI even though it exists in allActivities. Add the updated enum value to an appropriate group (likely “Kubernetes Resource”).

			ActivityLogActivityType.JOB_RUN_DELETED,
			ActivityLogActivityType.JOB_TRIGGERED
		],
		'Kubernetes Resource': [ActivityLogActivityType.GENERIC_KUBERNETES_RESOURCE_CREATED],
		OpenSearch: [

… formatting Return null when sbomProcessingStartedAt is in the future to avoid misleading 'less than a minute' output on clock skew. Also fix Prettier formatting in job vulnerabilities page.

Copilot AI review requested due to automatic review settings May 19, 2026 13:58

Copilot AI reviewed May 19, 2026

View reviewed changes

Copilot started reviewing on behalf of ybelMekk May 19, 2026 14:06 View session

ybelMekk added 5 commits May 20, 2026 11:16

fix: add defaultOrderDirection DESC to OrderByMenu

0679c3d

UI default was ascending while query defaulted to DESC, causing a mismatch when selecting a vulnerability sort field for the first time.

fix: replace undefined --ax-warning-600 with --ax-warning-500 in MEDI…

ff3d3d7

…UM row --ax-warning-600 does not exist in the design system. Use --ax-warning-500 as the dark-mode background and --ax-warning-400 for the hover state, consistent with the scale used elsewhere in the codebase.

chore: update package-lock.json to match package.json

9b15afe

Lockfile was out of sync with package.json after dependency updates, causing npm ci to fail in CI.

Copilot AI review requested due to automatic review settings May 20, 2026 09:23

ybelMekk force-pushed the feat/sbom-status branch from b042883 to 9b15afe Compare May 20, 2026 09:23

Copilot started reviewing on behalf of ybelMekk May 20, 2026 09:23 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

ybelMekk added 2 commits May 20, 2026 11:37

refactor: remove deprecated application and job update types, replace…

ac48d68

… with generic resource types

Copilot AI review requested due to automatic review settings May 20, 2026 09:41

Copilot started reviewing on behalf of ybelMekk May 20, 2026 09:41 View session

fix: rename {@const team} to teamData to avoid shadowing team prop

5b06903

The markup const shadowed the team slug prop from script, making the component harder to read. Also regenerate package-lock.json to fix npm ci failures in CI.

Copilot AI reviewed May 20, 2026

View reviewed changes

Comment thread src/lib/domain/vulnerability/WorkloadsWithVulnerabilities.svelte

ybelMekk added 2 commits May 20, 2026 11:48

chore: regenerate package-lock.json with node 24 to fix npm ci in CI

1731eec

Previous lockfile was generated with node 25, causing npm ci to fail in CI which runs node 24 via mise.

fix: remove APPLICATION_UPDATED and JOB_UPDATED from activity-log filter

ec98288

These enum values were removed from the schema. APPLICATION_UPDATED has no direct replacement; JOB_UPDATED is also gone. Remove them from the filter group to fix svelte-check type errors.

Copilot AI review requested due to automatic review settings May 20, 2026 09:52

Copilot started reviewing on behalf of ybelMekk May 20, 2026 09:52 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

Comment thread src/lib/domain/vulnerability/WorkloadsWithVulnerabilities.svelte

Comment thread src/lib/domain/vulnerability/WorkloadsWithVulnerabilities.svelte

Comment thread src/lib/utils/vulnerabilities.ts

fix: clamp negative clock-skew diffs in formatProcessingDuration, fix…

02ee4c9

… formatting Return null when sbomProcessingStartedAt is in the future to avoid misleading 'less than a minute' output on clock skew. Also fix Prettier formatting in job vulnerabilities page.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(vulnerability): replace hasSBOM with sbom.status and add SBOM processing UX#445

feat(vulnerability): replace hasSBOM with sbom.status and add SBOM processing UX#445
ybelMekk wants to merge 11 commits into
mainfrom
feat/sbom-status

ybelMekk commented May 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ybelMekk commented May 19, 2026

Summary

Changes

New components

Updated components

Utilities

Dependencies

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants