feat: [SUP-2192] Adding manifest file to vuln card if scanning multi-project

[dotkas]

• Tests written and linted ℹ︎
• Commits are squashed and tidy and are suitable to become release notes

What this does

Before

A while back there was a change done to the CLI which altered the way we did naming for certain projects. It had a lot of regression errors introduced and this change is one of the remediations for fixing this, as rolling back was no longer an option.

For nuget packages, when scanning multiple projects, the overview would not adequately give a user an overview of what exact projects has been scanned:

Further, the list of vulnerabilities would also not give the user an idea about which project contains the vulnerability:

This change

This change adds a manifest path to all vulnerabilities when multiple projects are scanned:

As well as a more details list of paths if nuget is scanned specifically:

.. but I've limited this last change to nuget only, as this does not seem to be an issue for other ecosystems. Should that change, we can alter the conditional logic pretty quickly.

More information

• Link to issue

Screenshots

See inline.

[j-luong]

question: if the nuget conditional is removed, this will just add the full manifest path to all results? I don't see this as an issue, is there any reason for the caution?

Asking as, having specific branching logic like the one we're introducing can be a pain to understand without prior context.

[dotkas]

if the nuget conditional is removed, this will just add the full manifest path to all results? I don't see this as an issue, is there any reason for the caution?

@j-luong

Yes, should I swap the logic?

I can add a story in comments about why. I have seen other conditionals in the code related to ecosystem oddities so I figured it was an ok way to go.

I was not comfortable just adding this logic for all ecosystems.. was not sure if it would cause regression or angry users of other ecosystems.

I can do it if you think it would be OK - for sure

[j-luong]

@dotkas
I think if all it does is amend the path with the full filepath and add that to each vuln as Manifest File in the report, then it's minor enough to include everywhere IMO.

Although I tried a quick test with a Node project and it looks like a bit more work is required on top of just omitting the conditionals in the .hbs templates:

[dotkas]

@j-luong i'll ping you on Slack, need to understand more.

[github-actions]

🎉 This PR is included in version 2.4.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release
• v2.4.0

Your semantic-release bot 📦🚀