fix: correct format verbs in diagnostic messages

[eran132]

Description

While reviewing the codebase I found two small bugs that produce misleading diagnostic output:

1. pkg/vex/sbomref.go — when fetching an external VEX document, a non-2xx HTTP response is reported with:

   xerrors.Errorf("did not receive 2xx status code: %w", res.StatusCode)

   res.StatusCode is an int, but %w expects an error. So a failed fetch renders as:

   did not receive 2xx status code: %!w(int=404)
   

   Switched to %d so the actual status code is shown. (go vet flags this class of mistake.)

2. pkg/sbom/spdx/marshal.go — the "Unsupported hash algorithm" warning logs the alg variable from the default branch of the switch, where it is still the zero value:

   var alg spdx.ChecksumAlgorithm
   switch d.Algorithm() {
   ...
   default:
       m.logger.Warn("Unsupported hash algorithm", log.String("algorithm", string(alg))) // always ""
   }

   So the warning never names the offending algorithm. Changed it to log d.Algorithm().

I also strengthened the existing "vex not found" test case to assert that the status code appears in the returned error message. The previous test only checked require.Error, which still passes with the garbled %!w(int=404) output — so it would not have caught this regression.

Related issues

N/A

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR tightens error handling and observability around external VEX document retrieval and SPDX checksum marshaling, and extends tests to validate the updated behavior.

Changes:

• Fix HTTP status code error formatting when retrieving external VEX documents.
• Extend VEX retrieval tests to assert on error message content for non-2xx responses.
• Improve log output for unsupported checksum algorithms by logging the actual digest algorithm string.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
pkg/vex/sbomref_test.go	Adds per-test expected error substring assertions for failed external VEX fetches.
pkg/vex/sbomref.go	Fixes incorrect error formatting for non-OK HTTP responses.
pkg/sbom/spdx/marshal.go	Logs the correct unsupported hash algorithm (from the digest) in warnings.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.