🌱 [main] update client/openapi/trustd.yaml#971
Open
trustify-ci-bot[bot] wants to merge 1 commit intomainfrom
Open
🌱 [main] update client/openapi/trustd.yaml#971trustify-ci-bot[bot] wants to merge 1 commit intomainfrom
trustify-ci-bot[bot] wants to merge 1 commit intomainfrom
Conversation
Contributor
Reviewer's GuideUpdates the trustd OpenAPI specification to refine path parameter descriptions, introduce a versioned v3 SBOM listing endpoint with new pagination schemas, adjust SBOM deletion and relationship response types, and deprecate or reshape several licensing and remediation-related schemas for clearer, versioned API behavior. Class diagram for updated SBOM pagination and listing schemasclassDiagram
class PaginatedResults_SbomSummary {
+items: SbomSummary[]
+total: int64
}
class PaginatedResults_SbomPackageRelation_SbomPackage {
+items: SbomPackageRelationItem[]
+total: int64
}
class SbomPackageRelationItem {
+package: SbomPackageInline
+relationship: Relationship
}
class PaginatedResults_SbomPackageSummary {
+items: SbomPackageSummary[]
+total: int64
}
class SbomSummary {
<<existing_schema>>
}
class SbomPackageSummary {
+id: string
+name: string
+group: string?
+version: string?
}
class SbomPackageInline {
+id: string
+name: string
+purl: PurlSummary[]
+cpe: string[]
+group: string?
+version: string?
+licenses: LicenseInfo[]
+licenses_ref_mapping: LicenseRefMapping[] <<deprecated>>
}
class Relationship {
<<existing_schema>>
}
class PurlSummary {
<<existing_schema>>
}
class LicenseInfo {
<<existing_schema>>
}
class LicenseRefMapping {
<<existing_schema>>
}
PaginatedResults_SbomSummary --> SbomSummary : items
PaginatedResults_SbomPackageRelation_SbomPackage --> SbomPackageRelationItem : items
SbomPackageRelationItem --> SbomPackageInline : package
SbomPackageRelationItem --> Relationship : relationship
SbomPackageInline --> PurlSummary : purl
SbomPackageInline --> LicenseInfo : licenses
SbomPackageInline --> LicenseRefMapping : licenses_ref_mapping
PaginatedResults_SbomPackageSummary --> SbomPackageSummary : items
Class diagram for updated SBOM package and remediation schemasclassDiagram
class SbomPackage {
+id: string
+name: string
+group: string?
+version: string?
+purl: PurlSummary[]
+cpe: string[]
+licenses: LicenseInfo[]
+licenses_ref_mapping: LicenseRefMapping[] <<deprecated>>
}
class SbomPackageSummary {
+id: string
+name: string
+group: string?
+version: string?
}
class RemediationSummary {
+category: RemediationCategory
+data: object <<deprecated>>
+details: string?
+url: string?
}
class RemediationCategory {
<<existing_schema>>
}
class PurlSummary {
<<existing_schema>>
}
class LicenseInfo {
<<existing_schema>>
}
class LicenseRefMapping {
<<existing_schema>>
}
SbomPackage --> PurlSummary : purl
SbomPackage --> LicenseInfo : licenses
SbomPackage --> LicenseRefMapping : licenses_ref_mapping
RemediationSummary --> RemediationCategory : category
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- The new
operationId: v2/listSbomsfor/api/v2/sbomincludes a slash, which can cause odd method names in some client generators; consider using a consistent, slash-free naming convention (e.g.listSbomsV2). - The
/api/v3/sbomGET endpoint is described as returning matching SBOMs but its schema isPaginatedResults_SbomPackageSummary; double-check whether this should instead point to an SBOM summary type to avoid confusion between SBOM-level and package-level resources.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The new `operationId: v2/listSboms` for `/api/v2/sbom` includes a slash, which can cause odd method names in some client generators; consider using a consistent, slash-free naming convention (e.g. `listSbomsV2`).
- The `/api/v3/sbom` GET endpoint is described as returning matching SBOMs but its schema is `PaginatedResults_SbomPackageSummary`; double-check whether this should instead point to an SBOM summary type to avoid confusion between SBOM-level and package-level resources.
## Individual Comments
### Comment 1
<location path="client/openapi/trustd.yaml" line_range="2743-2749" />
<code_context>
schema:
$ref: '#/components/schemas/Id'
responses:
- '200':
- description: Matching SBOM
- content:
</code_context>
<issue_to_address>
**issue (bug_risk):** The v3 `GET /api/v3/sbom` response schema looks like it returns package summaries rather than SBOMs.
The response schema currently uses `PaginatedResults_SbomPackageSummary`, whose items describe SBOM *packages* (package ID/name within an SBOM), not SBOMs. If this endpoint is meant to list SBOMs (as in v2), it should instead use `PaginatedResults_SbomSummary` or another SBOM-level type. If it’s meant to list packages, the endpoint name/summary/operationId should be updated to reflect that and avoid confusion for API consumers.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
2743
to
2749
| $ref: '#/components/schemas/Id' | ||
| responses: | ||
| '200': | ||
| description: Matching SBOM | ||
| content: | ||
| application/json: | ||
| schema: | ||
| $ref: '#/components/schemas/SbomSummary' | ||
| '204': | ||
| description: Matching SBOM as deleted | ||
| '404': | ||
| description: The SBOM could not be found | ||
| /api/v2/sbom/{id}/advisory: |
Contributor
There was a problem hiding this comment.
issue (bug_risk): The v3 GET /api/v3/sbom response schema looks like it returns package summaries rather than SBOMs.
The response schema currently uses PaginatedResults_SbomPackageSummary, whose items describe SBOM packages (package ID/name within an SBOM), not SBOMs. If this endpoint is meant to list SBOMs (as in v2), it should instead use PaginatedResults_SbomSummary or another SBOM-level type. If it’s meant to list packages, the endpoint name/summary/operationId should be updated to reflect that and avoid confusion for API consumers.
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
trustify-ci-bot
bot
force-pushed
the
create-pull-request/patch-a676b36
branch
from
2819618 to
7758a5d
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #971 +/- ##
=======================================
Coverage 66.50% 66.50%
=======================================
Files 218 218
Lines 3828 3828
Branches 873 873
=======================================
Hits 2546 2546
Misses 948 948
Partials 334 334 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The openapi.yaml of trustify has changed