feat: add ai models to sbom details page#968
Open
carlosthe19916 wants to merge 3 commits intoguacsec:mainfrom
Open
feat: add ai models to sbom details page#968carlosthe19916 wants to merge 3 commits intoguacsec:mainfrom
carlosthe19916 wants to merge 3 commits intoguacsec:mainfrom
Conversation
Signed-off-by: Carlos Feria <2582866+carlosthe19916@users.noreply.github.com>
Contributor
Reviewer's GuideAdds AI model support to the SBOM details page by introducing a new backend listModels endpoint, React query hook, models tab with list view and detail drawer, and shared conditional DataList wrapper for loading/error/empty states. Sequence diagram for fetching AI models on the SBOM details pagesequenceDiagram
actor User
participant SbomDetails
participant ModelsBySbom
participant useFetchModelsBySbomId
participant ReactQuery
participant trustdClient
participant TrustdAPI
User->>SbomDetails: Open SBOM details page
SbomDetails->>SbomDetails: Initialize tabs info, packages, vulnerabilities, models
User->>SbomDetails: Select models tab
SbomDetails->>ModelsBySbom: Render ModelsBySbom(sbomId)
ModelsBySbom->>useFetchModelsBySbomId: Call hook with sbomId, table params
useFetchModelsBySbomId->>ReactQuery: useQuery(listModels, queryKey)
ReactQuery->>trustdClient: listModels(path id, query params)
trustdClient->>TrustdAPI: GET /api/v2/sbom/{id}/models
TrustdAPI-->>trustdClient: 200 PaginatedResults_SbomModel
trustdClient-->>ReactQuery: AxiosResponse(data)
ReactQuery-->>useFetchModelsBySbomId: data, isLoading, error
useFetchModelsBySbomId-->>ModelsBySbom: result (items, total), isFetching
ModelsBySbom->>ConditionalDataListBody: Render with isLoading, isError, isNoData
alt models returned
ModelsBySbom->>ModelsBySbom: Render DataList of models
User->>ModelsBySbom: Click model name
ModelsBySbom->>ModelDetailDrawer: Open drawer with SbomModel
else no models
ConditionalDataListBody-->>User: Show no models empty state
end
Entity-relationship diagram for SBOM and AI models API typeserDiagram
Sbom {
uuid id
}
SbomModel {
string id
string name
string purl
object properties
}
PaginatedResults_SbomModel {
SbomModel[] items
int total
}
Sbom ||--o{ SbomModel : has
PaginatedResults_SbomModel }o--o{ SbomModel : wraps
Updated class diagram for SBOM AI models frontend and API typesclassDiagram
class SbomModel {
+string id
+string name
+any properties
+any purl
}
class PaginatedResults_SbomModel {
+SbomModel[] items
+int total
}
class ModelProperties {
+string version
+string licenses
+string bomFormat
+string suppliedBy
+string specVersion
+string typeOfModel
+string serialNumber
+string primaryPurpose
+string downloadLocation
+string external_references
+string limitation
+string safetyRiskAssessment
}
class ExternalReference {
+string type
+string url
+string comment
}
class ModelDetailDrawerProps {
+SbomModel model
}
class ModelDetailDrawer {
+render(props ModelDetailDrawerProps) ReactElement
}
class ModelsProps {
+string sbomId
}
class ModelsBySbom {
+SbomModel selectedModel
+render(props ModelsProps) ReactElement
}
class IConditionalDataListBodyProps {
+bool isLoading
+bool isError
+bool isNoData
+ReactNode errorEmptyState
+ReactNode noDataEmptyState
+ReactNode children
}
class ConditionalDataListBody {
+render(props IConditionalDataListBodyProps) ReactElement
}
class useFetchModelsBySbomIdHook {
+execute(sbomId string, params HubRequestParams) UseFetchModelsBySbomIdResult
}
class UseFetchModelsBySbomIdResult {
+UseFetchModelsBySbomIdResultData result
+bool isFetching
+AxiosError fetchError
+function refetch
}
class UseFetchModelsBySbomIdResultData {
+SbomModel[] data
+int total
+HubRequestParams params
}
class listModelsFunction {
+call(client any, id string, query any) Promise~PaginatedResults_SbomModel~
}
class HubRequestParams
class AxiosError
class ReactElement
class ReactNode
SbomModel --> ModelProperties : properties as
ModelDetailDrawer --> SbomModel : uses
ModelDetailDrawer --> ModelProperties : getModelProperties
ModelDetailDrawer --> ExternalReference : parseExternalReferences
ModelsBySbom --> SbomModel : lists
ModelsBySbom --> ModelDetailDrawer : opens drawer
ModelsBySbom --> ConditionalDataListBody : wraps list
ModelsBySbom --> useFetchModelsBySbomIdHook : calls
useFetchModelsBySbomIdHook --> listModelsFunction : uses
useFetchModelsBySbomIdHook --> PaginatedResults_SbomModel : returns data
PaginatedResults_SbomModel --> SbomModel : contains
ConditionalDataListBody --> IConditionalDataListBodyProps : uses props
useFetchModelsBySbomIdHook --> UseFetchModelsBySbomIdResult : returns
UseFetchModelsBySbomIdResult --> UseFetchModelsBySbomIdResultData : has
listModelsFunction --> PaginatedResults_SbomModel : resolves to
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- In the OpenAPI schema,
PaginatedResults_SbomModel.itemsdefines an inline object instead of reusing theSbomModelcomponent, which duplicates the shape and risks divergence; consider referencing#/components/schemas/SbomModelthere instead. - The
propertiesandpurlfields in bothPaginatedResults_SbomModel.itemsandSbomModellack explicittypedeclarations, which can cause issues for code generators and validators; declare their types (e.g.,type: stringor a more specific schema) consistently. - In
useFetchModelsBySbomId, theparams: params ?? paramsexpression in the returnedresultobject is redundant and can be simplified to justparams.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In the OpenAPI schema, `PaginatedResults_SbomModel.items` defines an inline object instead of reusing the `SbomModel` component, which duplicates the shape and risks divergence; consider referencing `#/components/schemas/SbomModel` there instead.
- The `properties` and `purl` fields in both `PaginatedResults_SbomModel.items` and `SbomModel` lack explicit `type` declarations, which can cause issues for code generators and validators; declare their types (e.g., `type: string` or a more specific schema) consistently.
- In `useFetchModelsBySbomId`, the `params: params ?? params` expression in the returned `result` object is redundant and can be simplified to just `params`.
## Individual Comments
### Comment 1
<location path="client/openapi/trustd.yaml" line_range="4994-5003" />
<code_context>
type: integer
format: int64
minimum: 0
+ PaginatedResults_SbomModel:
+ type: object
+ required:
+ - items
+ - total
+ properties:
+ items:
+ type: array
+ items:
+ type: object
+ required:
+ - id
+ - name
+ - purl
+ - properties
+ properties:
+ id:
+ type: string
+ description: The internal ID of a model
+ name:
+ type: string
+ description: The name of the model in the SBOM
+ properties:
+ description: The properties associated with the model
+ purl:
+ description: The model's PURL
+ total:
</code_context>
<issue_to_address>
**issue (bug_risk):** Add explicit types for `properties` and `purl` (and consider referencing `SbomModel`) to improve schema correctness and client generation.
In `PaginatedResults_SbomModel.items.properties` (and in `SbomModel`), `properties` and `purl` only have descriptions, so client generators may infer them incorrectly or as `any`. Please explicitly set their types (e.g., `type: object` for `properties`, `type: string` for `purl`), and consider replacing the inline `type: object` under `items` with a `$ref: '#/components/schemas/SbomModel'` to keep the model definition centralized and consistent.
</issue_to_address>
### Comment 2
<location path="client/openapi/trustd.yaml" line_range="5686-5703" />
<code_context>
type: string
v3Signatures:
type: boolean
+ SbomModel:
+ type: object
+ required:
+ - id
+ - name
+ - purl
+ - properties
+ properties:
+ id:
+ type: string
+ description: The internal ID of a model
+ name:
+ type: string
+ description: The name of the model in the SBOM
+ properties:
+ description: The properties associated with the model
+ purl:
+ description: The model's PURL
SbomPackage:
</code_context>
<issue_to_address>
**suggestion:** Clarify the schema for `properties` and `purl` on `SbomModel` to avoid ambiguous or weakly-typed clients.
`SbomModel.properties` and `SbomModel.purl` currently lack explicit `type` definitions. Since the UI expects `properties` to be an object with known keys and `purl` to be a string, please add explicit types (e.g. `properties: { type: object, additionalProperties: true }` or a more detailed object schema, and `purl: { type: string }`) so generated client types are accurate and integration issues are caught earlier.
```suggestion
SbomModel:
type: object
required:
- id
- name
- purl
- properties
properties:
id:
type: string
description: The internal ID of a model
name:
type: string
description: The name of the model in the SBOM
properties:
type: object
description: The properties associated with the model
additionalProperties: true
purl:
type: string
description: The model's PURL
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+4994
to
+5003
| PaginatedResults_SbomModel: | ||
| type: object | ||
| required: | ||
| - items | ||
| - total | ||
| properties: | ||
| items: | ||
| type: array | ||
| items: | ||
| type: object |
Contributor
There was a problem hiding this comment.
issue (bug_risk): Add explicit types for properties and purl (and consider referencing SbomModel) to improve schema correctness and client generation.
In PaginatedResults_SbomModel.items.properties (and in SbomModel), properties and purl only have descriptions, so client generators may infer them incorrectly or as any. Please explicitly set their types (e.g., type: object for properties, type: string for purl), and consider replacing the inline type: object under items with a $ref: '#/components/schemas/SbomModel' to keep the model definition centralized and consistent.
Comment on lines
+5686
to
+5703
| SbomModel: | ||
| type: object | ||
| required: | ||
| - id | ||
| - name | ||
| - purl | ||
| - properties | ||
| properties: | ||
| id: | ||
| type: string | ||
| description: The internal ID of a model | ||
| name: | ||
| type: string | ||
| description: The name of the model in the SBOM | ||
| properties: | ||
| description: The properties associated with the model | ||
| purl: | ||
| description: The model's PURL |
Contributor
There was a problem hiding this comment.
suggestion: Clarify the schema for properties and purl on SbomModel to avoid ambiguous or weakly-typed clients.
SbomModel.properties and SbomModel.purl currently lack explicit type definitions. Since the UI expects properties to be an object with known keys and purl to be a string, please add explicit types (e.g. properties: { type: object, additionalProperties: true } or a more detailed object schema, and purl: { type: string }) so generated client types are accurate and integration issues are caught earlier.
Suggested change
| SbomModel: | |
| type: object | |
| required: | |
| - id | |
| - name | |
| - purl | |
| - properties | |
| properties: | |
| id: | |
| type: string | |
| description: The internal ID of a model | |
| name: | |
| type: string | |
| description: The name of the model in the SBOM | |
| properties: | |
| description: The properties associated with the model | |
| purl: | |
| description: The model's PURL | |
| SbomModel: | |
| type: object | |
| required: | |
| - id | |
| - name | |
| - purl | |
| - properties | |
| properties: | |
| id: | |
| type: string | |
| description: The internal ID of a model | |
| name: | |
| type: string | |
| description: The name of the model in the SBOM | |
| properties: | |
| type: object | |
| description: The properties associated with the model | |
| additionalProperties: true | |
| purl: | |
| type: string | |
| description: The model's PURL |
Signed-off-by: Carlos Feria <2582866+carlosthe19916@users.noreply.github.com>
Signed-off-by: Carlos Feria <2582866+carlosthe19916@users.noreply.github.com>
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #968 +/- ##
==========================================
- Coverage 67.24% 66.70% -0.54%
==========================================
Files 218 221 +3
Lines 3828 3881 +53
Branches 873 898 +25
==========================================
+ Hits 2574 2589 +15
- Misses 915 955 +40
+ Partials 339 337 -2 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Counterpart of guacsec/trustify#2255
Screencast.From.2026-03-18.18-46-30.mp4
Summary by Sourcery
Add backend API contract and frontend UI to list and inspect AI models associated with an SBOM on the SBOM details page.
New Features:
Enhancements: