Add exclusion patterns and snippet choice support to SCANOSS scanner #10270

isasmendiagus · 2025-05-06T11:23:55Z

This PR enhances SCANOSS scanner by implementing:

Exclusion pattern support: Respects path patterns in .ort.yml to exclude files during scans
Snippet choice processing: Converts ORT's SnippetChoices to SCANOSS rule types

This builds on top of the SCANOSS SDK migration completed in the previous PR #10265

plugins/scanners/scanoss/src/test/kotlin/ScanOssScannerDirectoryTest.kt

plugins/scanners/scanoss/src/test/kotlin/TestUtils.kt

codecov · 2025-05-06T11:39:51Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 56.43%. Comparing base (e855ea5) to head (792f5de).
Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #10270   +/-   ##
=========================================
  Coverage     56.43%   56.43%           
  Complexity     1604     1604           
=========================================
  Files           331      331           
  Lines         12243    12243           
  Branches       1135     1135           
=========================================
  Hits           6909     6909           
  Misses         4887     4887           
  Partials        447      447

Flag	Coverage Δ
funTest-docker	`70.59% <ø> (ø)`
funTest-non-docker	`33.42% <ø> (ø)`
test-ubuntu-24.04	`40.45% <ø> (ø)`
test-windows-2022	`40.43% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

plugins/scanners/scanoss/src/test/assets/filesToScan/ArchiveUtils.kt

plugins/scanners/scanoss/src/main/kotlin/ScanOss.kt

plugins/scanners/scanoss/src/test/assets/exclusionTest/server.go

plugins/scanners/scanoss/src/main/kotlin/ScanOss.kt

sschuberth

Some final nits / questions.

plugins/scanners/scanoss/src/main/kotlin/ScanOss.kt

sschuberth · 2025-05-07T06:37:26Z

plugins/scanners/scanoss/src/main/kotlin/ScanOss.kt

+
+            // Set line range only if both `sourceLocation.startLine` and `sourceLocation.endLine` are positive numbers.
+            // If either line is zero or negative, the rule will apply to the entire file.
+            if (choice.given.sourceLocation.startLine > 0 && choice.given.sourceLocation.endLine > 0) {


As the TextLocation constructor limits valid line numbers, see

ort/model/src/main/kotlin/TextLocation.kt

Lines 58 to 60 in 6e68575

require(startLine in 1..endLine || (startLine == UNKNOWN_LINE && endLine == UNKNOWN_LINE)) {

"Invalid start or end line values."

}

I believe this check can be simplified to just choice.given.sourceLocation.startLine != TextLocation.UNKNOWN_LINE.

Note that if changing the code, the comment should be slightly adjusted as well.

Replaced hardcoded choice.given.sourceLocation.startLine > 0 checks with UNKNOWN_LINE constants for better semantics.

I kept both checks for readability, but I'm happy to simplify to a single check if you prefer that approach

I kept both checks for readability, but I'm happy to simplify to a single check if you prefer that approach

I wasn't super happy with the single check either, as it reads a bit odd if don't know the internals. I was also thinking about introducing this. How about that?

I was thinking also to introduce a method like you did on #10280. Is that PR going to be merge today?

Is that PR going to be merge today?

I'm confident at it will.

plugins/scanners/scanoss/src/test/kotlin/ScanOssTest.kt

plugins/scanners/scanoss/src/main/kotlin/ScanOss.kt

plugins/scanners/scanoss/src/test/kotlin/ScanOssTest.kt

+// A sample purl in the results.
+private const val PURL_1 = "pkg:github/fakeuser/[email protected]"
+
+class ScanOssTest : WordSpec({


This commit replaces test files containing OSS source code with randomly generated data to prevent false positives during code scanning. Signed-off-by: Agustin Isasmendi <[email protected]>

Implement exclusion filtering to respect path patterns specified in the configuration. The scanner now properly excludes files matching the patterns during the scan process. Signed-off-by: Agustin Isasmendi <[email protected]>

sschuberth · 2025-05-07T14:48:43Z

Please remember to rebase instead of merge to catch-up with latest main!

isasmendiagus · 2025-05-07T14:49:40Z

Please remember to rebase instead of merge to catch-up with latest main!

Ignore please the latest merge. I'll remove it from the history

Implement snippet choice processing functionality. It handles findings according to two different scenarios: - Original findings that should be included - Non-relevant findings that should be removed The implementation converts ORT's SnippetChoices into SCANOSS-specific rule types. Signed-off-by: Agustin Isasmendi <[email protected]>

isasmendiagus requested a review from a team as a code owner May 6, 2025 11:23

github-advanced-security bot found potential problems May 6, 2025

View reviewed changes

plugins/scanners/scanoss/src/test/kotlin/ScanOssScannerDirectoryTest.kt Fixed Show fixed Hide fixed

plugins/scanners/scanoss/src/test/kotlin/TestUtils.kt Fixed Show fixed Hide fixed

isasmendiagus force-pushed the feat/scanoss/exclusion-patterns-and-snippet-choices branch from 53042f4 to 2c695dc Compare May 6, 2025 11:43

sschuberth requested changes May 6, 2025

View reviewed changes

isasmendiagus force-pushed the feat/scanoss/exclusion-patterns-and-snippet-choices branch 2 times, most recently from 93ad889 to 9761e69 Compare May 6, 2025 14:21

isasmendiagus requested a review from sschuberth May 6, 2025 14:23

sschuberth requested changes May 6, 2025

View reviewed changes

plugins/scanners/scanoss/src/test/assets/exclusionTest/server.go Outdated Show resolved Hide resolved

plugins/scanners/scanoss/src/main/kotlin/ScanOss.kt Outdated Show resolved Hide resolved

plugins/scanners/scanoss/src/main/kotlin/ScanOss.kt Outdated Show resolved Hide resolved

isasmendiagus force-pushed the feat/scanoss/exclusion-patterns-and-snippet-choices branch 2 times, most recently from d51e6aa to ee1c81e Compare May 6, 2025 16:05

isasmendiagus requested a review from sschuberth May 6, 2025 16:18

sschuberth requested changes May 7, 2025

View reviewed changes

isasmendiagus force-pushed the feat/scanoss/exclusion-patterns-and-snippet-choices branch from ee1c81e to bfd7a6d Compare May 7, 2025 10:07

github-advanced-security bot found potential problems May 7, 2025

View reviewed changes

plugins/scanners/scanoss/src/main/kotlin/ScanOss.kt Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems May 7, 2025

View reviewed changes

plugins/scanners/scanoss/src/test/kotlin/ScanOssTest.kt

// A sample purl in the results.

private const val PURL_1 = "pkg:github/fakeuser/[email protected]"

class ScanOssTest : WordSpec({

Check warning

Code scanning / QDJVMC

Unused symbol

Class "ScanOssTest" is never used

isasmendiagus added 2 commits May 7, 2025 16:47

refactor(scanoss): Replace test assets with randomly generated data

45f5d94

This commit replaces test files containing OSS source code with randomly generated data to prevent false positives during code scanning. Signed-off-by: Agustin Isasmendi <[email protected]>

feat(scanoss): Add exclusion pattern support to SCANOSS

c7dcb0f

Implement exclusion filtering to respect path patterns specified in the configuration. The scanner now properly excludes files matching the patterns during the scan process. Signed-off-by: Agustin Isasmendi <[email protected]>

isasmendiagus force-pushed the feat/scanoss/exclusion-patterns-and-snippet-choices branch from ec7a4d7 to 792f5de Compare May 7, 2025 14:55

sschuberth approved these changes May 7, 2025

View reviewed changes

sschuberth enabled auto-merge (rebase) May 7, 2025 14:57

sschuberth merged commit 77293c6 into oss-review-toolkit:main May 7, 2025
23 of 24 checks passed

isasmendiagus mentioned this pull request May 7, 2025

Add report generation and optimize snippet findings for SCANOSS #10287

Draft

	require(startLine in 1..endLine \|\| (startLine == UNKNOWN_LINE && endLine == UNKNOWN_LINE)) {
	"Invalid start or end line values."
	}

Add exclusion patterns and snippet choice support to SCANOSS scanner #10270

Add exclusion patterns and snippet choice support to SCANOSS scanner #10270

Uh oh!

Conversation

isasmendiagus commented May 6, 2025

Uh oh!

Uh oh!

Uh oh!

codecov bot commented May 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sschuberth left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sschuberth May 7, 2025

Choose a reason for hiding this comment

Uh oh!

sschuberth May 7, 2025

Choose a reason for hiding this comment

Uh oh!

isasmendiagus May 7, 2025

Choose a reason for hiding this comment

Uh oh!

sschuberth May 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

isasmendiagus May 7, 2025

Choose a reason for hiding this comment

Uh oh!

sschuberth May 7, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Check warning

sschuberth commented May 7, 2025

Uh oh!

isasmendiagus commented May 7, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented May 6, 2025 •

edited

Loading

sschuberth May 7, 2025 •

edited

Loading