Convert CSAF tasks to workflows

[nscuro]

Description

Converts CSAF tasks to workflows.

Enables provider discovery and document import to be addressable by workflow instance ID, while also effectively prevent multiple instances for the same aggregator / provider to run concurrently.

https://github.com/DependencyTrack/hyades-apiserver/blob/main/dex/docs/PATTERNS.md#singletons

Addressed Issue

N/A

Additional Details

N/A

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have updated the migration changelog accordingly
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[Copilot]

Pull request overview

This pull request converts CSAF provider discovery and document import from Alpine's event-based task system to Dex workflows. This enables addressability by workflow instance ID and prevents multiple concurrent instances for the same aggregator or provider.

Changes:

• Replaced CSAF event classes and tasks with Dex workflows and activities
• Updated DexEngine API to accept wildcard-bounded collection types for workflow run requests
• Modified initialization order and registration to support CSAF workflows
• Removed lock-based configuration properties in favor of workflow instance IDs

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
proto/src/main/proto/org/dependencytrack/internal/workflow/v1/argument_csaf.proto	Defines protobuf messages for CSAF workflow arguments (DiscoverCsafProvidersArg and ImportCsafDocumentsArg)
dex/engine-api/src/main/java/org/dependencytrack/dex/engine/api/DexEngine.java	Updated createRuns signature to accept wildcard-bounded collections
dex/engine/src/main/java/org/dependencytrack/dex/engine/DexEngineImpl.java	Implements updated createRuns signature
apiserver/src/main/java/org/dependencytrack/csaf/DiscoverCsafProvidersWorkflow.java	New workflow for CSAF provider discovery
apiserver/src/main/java/org/dependencytrack/csaf/DiscoverCsafProvidersActivity.java	Converted from CsafProviderDiscoveryTask to Dex activity
apiserver/src/main/java/org/dependencytrack/csaf/ImportCsafDocumentsWorkflow.java	New workflow for CSAF document import
apiserver/src/main/java/org/dependencytrack/csaf/ImportCsafDocumentsActivity.java	Converted from CsafDocumentImportTask to Dex activity with heartbeat support
apiserver/src/main/java/org/dependencytrack/resources/v2/CsafResource.java	Updated to trigger workflows instead of dispatching events, with conflict detection
apiserver/src/main/java/org/dependencytrack/dex/DexEngineInitializer.java	Registers CSAF workflows and activities
apiserver/src/main/java/org/dependencytrack/tasks/TaskSchedulerInitializer.java	Schedules CSAF import workflow runs for enabled providers
apiserver/src/main/java/org/dependencytrack/event/EventSubsystemInitializer.java	Removes CSAF event subscriptions
apiserver/src/main/java/org/dependencytrack/util/TaskUtil.java	Adds helper method to get cron schedule from config
apiserver/src/main/webapp/WEB-INF/web.xml	Reorders listeners to initialize DexEngine before TaskScheduler
apiserver/src/main/resources/application.properties	Removes lock-based configuration properties
apiserver/src/main/java/org/dependencytrack/csaf/CsafProviderDiscoveryEvent.java	Deleted - replaced by workflow argument
api/src/main/openapi/paths/csaf/aggregators__id__provider-discovery.yaml	Adds 409 Conflict response for concurrent workflow prevention
apiserver/src/test/java/org/dependencytrack/resources/v2/CsafResourceTest.java	Updated tests for workflow-based implementation with conflict scenarios
apiserver/src/test/java/org/dependencytrack/csaf/ImportCsafDocumentsWorkflowTest.java	New workflow test replacing task test
apiserver/src/test/java/org/dependencytrack/csaf/DiscoveryCsafProvidersWorkflowTest.java	New workflow test replacing task test
apiserver/src/test/java/org/dependencytrack/tasks/TaskSchedulerInitializerTest.java	Updated for DexEngine dependency

Comments suppressed due to low confidence (5)

apiserver/src/main/java/org/dependencytrack/csaf/ImportCsafDocumentsActivity.java:114

• Consider adding a heartbeat call after processDocuments at line 120 as well. Currently, heartbeat is only called before batch processing (line 111 for each document, line 126 for the final batch), but not after. If processDocuments takes a long time, the activity might time out without sending heartbeats during the processing phase itself.
  apiserver/src/test/java/org/dependencytrack/csaf/DiscoveryCsafProvidersWorkflowTest.java:52
• The class name "DiscoveryCsafProvidersWorkflowTest" has an inconsistent naming pattern. It should be "DiscoverCsafProvidersWorkflowTest" to match the workflow name "DiscoverCsafProvidersWorkflow" and follow the pattern of "ImportCsafDocumentsWorkflowTest" in the same package. The word "Discovery" should not have a "y" suffix here.
  apiserver/src/test/java/org/dependencytrack/csaf/ImportCsafDocumentsWorkflowTest.java:78
• The beforeEach method does not call super.before(), but the test uses qm at line 145 which requires qm to be initialized by the parent's before() method. This will cause NullPointerException when the test accesses qm. Call super.before() at the beginning of beforeEach to properly initialize the test infrastructure.
  apiserver/src/test/java/org/dependencytrack/csaf/ImportCsafDocumentsWorkflowTest.java:113
• The afterEach method does not call super.after(), which means event services won't be drained and qm won't be properly closed. This could cause tests to interfere with each other. Call super.after() after closing the jdbiHandle to ensure proper cleanup.
  apiserver/src/test/java/org/dependencytrack/csaf/DiscoveryCsafProvidersWorkflowTest.java:103
• The beforeEach and afterEach methods do not call super.before() and super.after() respectively. While this test doesn't use qm, the parent class's after() method drains event services to prevent tests from interfering with each other. Call super.before() and super.after() to ensure proper test infrastructure initialization and cleanup.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +0.00% (target: -1.00%)	✅ 71.28% (target: 70.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (13a1104)	36953	30905	83.63%
Head commit (0b11324)	36979 (+26)	30927 (+22)	83.63% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1704)	94	67	71.28%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences