Allow vulnerability scans on arbitrary N|Solid refs

Known branches still use curated dependency lists, but unknown refs now fall
back to probing every tracked dependency definition and keeping only the ones
whose version parsers succeed against the checked-out tree.

This lets the scanner run against release branches and ad hoc refs without
having to pre-register each branch name in dependencies_per_branch.

Also document the workflow input as an arbitrary N|Solid branch/ref and mark
curated scans as incomplete when a curated dependency fails to resolve.

Author: santigimeno

.github/workflows/check-vulns.yml

@@ -6,6 +6,7 @@ on:
       nsolidStream:
         type: string
         default: 'main'
+        description: 'N|Solid branch or ref to scan'
     secrets:
       NVD_API_KEY:
         required: true
@@ -14,6 +15,7 @@ on:
       nsolidStream:
         type: string
         default: 'main'
+        description: 'N|Solid branch or ref to scan'
 
 
 permissions:

dep_checker/main.py

@@ -103,6 +103,64 @@ def default(self, obj):
 )
 
 
+def resolve_dependencies(
+    repo_path: Path, repo_branch: str
+) -> tuple[dict[str, Dependency], list[str]]:
+    """Return the dependencies that can be parsed from the checked-out repo.
+
+    Known branches still use their curated dependency list. Unknown branches fall
+    back to probing every tracked dependency definition and keeping only the ones
+    whose version parser succeeds against the checkout.
+    """
+
+    configured_names = dependencies_per_branch.get(repo_branch)
+    if configured_names is None:
+        candidate_dependencies = dependencies_info
+        print(
+            f"Info: '{repo_branch}' is not explicitly configured; scanning all known dependency definitions"
+        )
+    else:
+        candidate_dependencies = {
+            name: dep
+            for name, dep in dependencies_info.items()
+            if name in configured_names
+        }
+
+    available_dependencies: dict[str, Dependency] = {}
+    skipped_dependencies: list[str] = []
+
+    for name, dep in candidate_dependencies.items():
+        try:
+            dep.version_parser(repo_path)
+        except (
+            FileNotFoundError,
+            RuntimeError,
+            ValueError,
+            KeyError,
+            IndexError,
+            AttributeError,
+            TypeError,
+            OSError,
+        ) as exc:
+            skipped_dependencies.append(f"{name}: {exc}")
+            continue
+        available_dependencies[name] = dep
+
+    if not available_dependencies:
+        raise RuntimeError(
+            f"No supported dependencies could be resolved from '{repo_branch}'"
+        )
+
+    if skipped_dependencies:
+        print(
+            f"Info: Skipping {len(skipped_dependencies)} dependencies that are not present or not parseable in '{repo_branch}'"
+        )
+        for skipped in skipped_dependencies:
+            print(f"  - {skipped}")
+
+    return available_dependencies, skipped_dependencies
+
+
 def query_ghad(
     dependencies: dict[str, Dependency], gh_token: str, repo_path: Path
 ) -> list[Vulnerability]:
@@ -237,7 +295,10 @@ def main() -> int:
     parser.add_argument(
         "node_repo_branch",
         metavar="NODE_REPO_BRANCH",
-        help=f"the current branch of the Node repository (supports {supported_branches})",
+        help=(
+            "the current branch of the Node/N|Solid repository; known branches use "
+            f"curated dependency lists, other branches are scanned by probing available dependencies ({supported_branches})"
+        ),
     )
     parser.add_argument(
         "--gh-token",
@@ -281,10 +342,6 @@ def main() -> int:
         raise RuntimeError(
             "Invalid argument: '{repo_path}' is not a valid Node git repository"
         )
-    if repo_branch not in dependencies_per_branch:
-        raise RuntimeError(
-            f"Invalid argument: '{repo_branch}' is not a supported branch. Please use one of: {supported_branches}"
-        )
     if gh_token is None:
         print(
             "Warning: GitHub authentication token not provided, skipping GitHub Advisory Database queries",
@@ -296,15 +353,17 @@ def main() -> int:
             file=sys.stderr,
         )
 
-    dependencies = {
-        name: dep
-        for name, dep in dependencies_info.items()
-        if name in dependencies_per_branch[repo_branch]
-    }
+    dependencies, skipped_dependencies = resolve_dependencies(repo_path, repo_branch)
 
     # Track whether every vulnerability source completed successfully. A partial scan must not
     # cause the reconciler to close issues for vulns that simply weren't queried this run.
     scan_complete = True
+    if repo_branch in dependencies_per_branch and skipped_dependencies:
+        scan_complete = False
+        print(
+            f"Warning: {len(skipped_dependencies)} curated dependencies could not be resolved for '{repo_branch}'",
+            file=sys.stderr,
+        )
 
     ghad_vulnerabilities: list[Vulnerability] = []
     if gh_token is not None: