feat(reporting): require repo-relative manifest_path on dependency CVE findings

[devin-ai-integration]

Summary

create_dependency_report gains a manifest_path parameter — the repo-relative lockfile/manifest where the vulnerable version was observed (trivy's Target, e.g. package-lock.json, services/api/pom.xml) — persisted into dependency_metadata.

It is required and validated fail-closed (_validate_manifest_path): missing/empty, absolute paths, backslashes, drive prefixes, and empty/./.. segments are rejected with an actionable error. This binds each SCA finding to its exact file, so downstream remediation (multi-repo scans in particular) can determine the correct repository deterministically instead of probing candidate repos by manifest filename.

Dedupe identity now includes the manifest: the same CVE/package observed in two different non-empty manifest_paths is two findings (one per manifest/workspace), while a missing path on either side keeps the legacy CVE/package/ecosystem identity (_distinct_manifest_paths in strix/report/dedupe.py).

The dependency_cve_scanning skill now instructs agents to always fill manifest_path from trivy's Target (stripping any scan-workspace/checkout prefix) and to dedupe per (CVE, PkgName, Target).

Tests: required-field and unsafe-path rejection cases, same-vs-distinct-manifest dedupe, plus metadata persistence assertions updated.

Link to Devin session: https://app.devin.ai/sessions/2fedf10aa9244f199f68727957fee746
Requested by: @0xallam

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

The PR fixes manifest identity loss during dependency deduplication and requires each new dependency finding to identify its repository-relative manifest.

• Persists validated manifest_path values in dependency metadata.
• Keeps findings from distinct manifests while deduplicating repeated findings from the same manifest.
• Updates the dependency-scanning skill and reporting tests for the new contract.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
strix/report/dedupe.py	Dedupe now preserves separate findings when the same CVE and package occur in different nonempty manifest paths, resolving the prior manifest-identity issue.
strix/tools/reporting/tool.py	Dependency reporting now validates and persists a required repository-relative manifest path before deduplication.
strix/skills/custom/dependency_cve_scanning.md	Agent guidance now uses Trivy Target as manifest identity and files separate findings per manifest.
tests/test_reporting_fields.py	Tests cover required and unsafe manifest paths, metadata persistence, and same-versus-distinct-manifest deduplication.

_{Reviews (2): Last reviewed commit: "feat(report): keep dependency findings f..." | Re-trigger Greptile}

[devin-ai-integration]

@greptile