Merge main and fix conflicts

Signed-off-by: tdruez <[email protected]>

Author: tdruez

.github/workflows/generate-sboms.yml

@@ -32,7 +32,7 @@ jobs:
           find scancodeio/ -type f -name "*.ABOUT" -exec cp {} "${{ env.INPUTS_PATH }}/about-files/" \;
 
       - name: Resolve the dependencies using ScanCode-action
-        uses: nexB/scancode-action@main
+        uses: aboutcode-org/scancode-action@main
         with:
           pipelines: "resolve_dependencies:DynamicResolver"
           inputs-path: ${{ env.INPUTS_PATH }}

CHANGELOG.rst

@@ -1,7 +1,32 @@
 Changelog
 =========
 
-v34.10.2 (unreleased)
+v34.12.0 (unreleased)
+---------------------
+
+- Display matched snippets details in "Resource viewer", including the package,
+  resource, and similarity values.
+  https://github.com/aboutcode-org/scancode.io/issues/1688
+
+- Add filtering by label and pipeline in the ``flush-projects`` management command.
+  Also, a new ``--dry-run`` option is available to test the filters before applying
+  the deletion.
+  https://github.com/aboutcode-org/scancode.io/pull/1690
+
+- Add support for using Package URL (purl) as project input.
+  This implementation is based on ``purl2url.get_download_url``.
+  https://github.com/aboutcode-org/scancode.io/issues/1383
+
+- Raise a ``MatchCodeIOException`` when the response from the MatchCode.io service is
+  not valid in ``send_project_json_to_matchcode``.
+  This generally means an issue on the MatchCode.io server side.
+  https://github.com/aboutcode-org/scancode.io/issues/1665
+
+- Upgrade Bulma CSS and Ace JS libraries to latest versions.
+  Refine the CSS for the Resource viewer.
+  https://github.com/aboutcode-org/scancode.io/pull/1692
+
+v34.11.0 (2025-05-02)
 ---------------------
 
 - Add a ``UUID`` field on the DiscoveredDependency model.

docs/automation.rst

@@ -79,8 +79,8 @@ automation methods such as a cron job or a git hook::
 Seamlessly integrate ScanCode.io into your GitHub Workflows to enable automated scans
 as an integral part of your development process.
 
-Visit the `scancode-action repository <https://github.com/nexB/scancode-action>`_ to
-explore and learn more about the GitHub Action for ScanCode.io.
+Visit the `scancode-action repository <https://github.com/aboutcode-org/scancode-action>`_
+to explore and learn more about the GitHub Action for ScanCode.io.
 The repository provides detailed information, usage instructions,
 and configuration options to help you incorporate code scanning effortlessly into your
 workflows.

docs/command-line-interface.rst

@@ -549,6 +549,14 @@ Optional arguments:
 
     scanpipe flush-projects --retain-days 7
 
+- ``--dry-run`` Do not delete any projects; just print the ones that would be flushed.
+
+- ``--label LABELS`` Filter projects by the provided label.
+  Multiple labels can be provided by using this argument multiple times.
+
+- ``--pipeline PIPELINES`` Filter projects by the provided pipeline name.
+  Multiple pipeline name can be provided by using this argument multiple times.
+
 - ``--no-input`` Does not prompt the user for input of any kind.
 
 

docs/faq.rst

@@ -202,7 +202,7 @@ How can I trigger a pipeline scan from a CI/CD, such as Jenkins, TeamCity or Azu
 You can refer to the :ref:`automation` to automate your projects management.
 
 Also, A new GitHub action is available at
-`scancode-action repository <https://github.com/nexB/scancode-action>`_
+`scancode-action repository <https://github.com/aboutcode-org/scancode-action>`_
 to run ScanCode.io pipelines from your GitHub Workflows.
 
 How can I get notified about my project progression?

etc/thirdparty/virtualenv.pyz

@@ -1,7 +1,7 @@
 about_resource: virtualenv.pyz
 name: get-virtualenv
-version: 20.29.3
-download_url: https://github.com/pypa/get-virtualenv/raw/20.29.3/public/virtualenv.pyz
+version: 20.31.2
+download_url: https://github.com/pypa/get-virtualenv/raw/20.31.2/public/virtualenv.pyz
 description: virtualenv is a tool to create isolated Python environments.
 homepage_url: https://github.com/pypa/virtualenv
 license_expression: lgpl-2.1-plus AND (bsd-new OR apache-2.0) AND mit AND python AND bsd-new
@@ -10,4 +10,4 @@ copyright: Copyright (c) The Python Software Foundation and others
 redistribute: yes
 attribute: yes
 track_changes: yes
-package_url: pkg:github/pypa/get-virtualenv@20.29.3#public/virtualenv.pyz
+package_url: pkg:github/pypa/get-virtualenv@20.31.2#public/virtualenv.pyz

etc/thirdparty/virtualenv.pyz.ABOUT

@@ -36,3 +36,5 @@ max-complexity = 10
 # Allow the usage of assert in the test_spdx file.
 "**/test_spdx.py*" = ["S101"]
 "scanpipe/pipes/spdx.py" = ["UP006", "UP035"]
+# Allow complexity in management commands
+"scanpipe/management/commands/*" = ["C901"]

pyproject.toml

@@ -28,7 +28,7 @@
 
 import git
 
-VERSION = "34.10.1"
+VERSION = "34.11.0"
 
 PROJECT_DIR = Path(__file__).resolve().parent
 ROOT_DIR = PROJECT_DIR.parent
@@ -87,6 +87,7 @@ def extract_short_commit(git_describe):
 # Turn off the warnings for the following modules.
 warnings.filterwarnings("ignore", module="extractcode")
 warnings.filterwarnings("ignore", module="typecode")
+warnings.filterwarnings("ignore", module="clamd")
 
 
 def command_line():

scancodeio/__init__.py

@@ -425,28 +425,30 @@
 
 # VulnerableCode integration
 
-VULNERABLECODE_URL = env.str("VULNERABLECODE_URL", default="")
+VULNERABLECODE_URL = env.str("VULNERABLECODE_URL", default="").rstrip("/")
 VULNERABLECODE_USER = env.str("VULNERABLECODE_USER", default="")
 VULNERABLECODE_PASSWORD = env.str("VULNERABLECODE_PASSWORD", default="")
 VULNERABLECODE_API_KEY = env.str("VULNERABLECODE_API_KEY", default="")
 
 # PurlDB integration
 
-PURLDB_URL = env.str("PURLDB_URL", default="")
+PURLDB_URL = env.str("PURLDB_URL", default="").rstrip("/")
 PURLDB_USER = env.str("PURLDB_USER", default="")
 PURLDB_PASSWORD = env.str("PURLDB_PASSWORD", default="")
 PURLDB_API_KEY = env.str("PURLDB_API_KEY", default="")
 
 # MatchCode.io integration
 
-MATCHCODEIO_URL = env.str("MATCHCODEIO_URL", default="")
+MATCHCODEIO_URL = env.str("MATCHCODEIO_URL", default="").rstrip("/")
 MATCHCODEIO_USER = env.str("MATCHCODEIO_USER", default="")
 MATCHCODEIO_PASSWORD = env.str("MATCHCODEIO_PASSWORD", default="")
 MATCHCODEIO_API_KEY = env.str("MATCHCODEIO_API_KEY", default="")
 
 # FederatedCode integration
 
-FEDERATEDCODE_GIT_ACCOUNT_URL = env.str("FEDERATEDCODE_GIT_ACCOUNT_URL", default="")
+FEDERATEDCODE_GIT_ACCOUNT_URL = env.str(
+    "FEDERATEDCODE_GIT_ACCOUNT_URL", default=""
+).rstrip("/")
 FEDERATEDCODE_GIT_SERVICE_TOKEN = env.str("FEDERATEDCODE_GIT_SERVICE_TOKEN", default="")
 FEDERATEDCODE_GIT_SERVICE_NAME = env.str("FEDERATEDCODE_GIT_SERVICE_NAME", default="")
 FEDERATEDCODE_GIT_SERVICE_EMAIL = env.str("FEDERATEDCODE_GIT_SERVICE_EMAIL", default="")