Allow vuln scans on arbitrary N|Solid branches by probing available dependencies

Author: santigimeno

.github/workflows/check-vulns.yml

@@ -6,6 +6,7 @@ on:
       nsolidStream:
         type: string
         default: 'main'
+        description: 'N|Solid branch or ref to scan'
     secrets:
       NVD_API_KEY:
         required: true
@@ -14,6 +15,7 @@ on:
       nsolidStream:
         type: string
         default: 'main'
+        description: 'N|Solid branch or ref to scan'
 
 
 permissions:

dep_checker/main.py

@@ -103,6 +103,53 @@ def default(self, obj):
 )
 
 
+def resolve_dependencies(
+    repo_path: Path, repo_branch: str
+) -> dict[str, Dependency]:
+    """Return the dependencies that can be parsed from the checked-out repo.
+
+    Known branches still use their curated dependency list. Unknown branches fall
+    back to probing every tracked dependency definition and keeping only the ones
+    whose version parser succeeds against the checkout.
+    """
+
+    configured_names = dependencies_per_branch.get(repo_branch)
+    if configured_names is None:
+        candidate_dependencies = dependencies_info
+        print(
+            f"Info: '{repo_branch}' is not explicitly configured; scanning all known dependency definitions"
+        )
+    else:
+        candidate_dependencies = {
+            name: dep
+            for name, dep in dependencies_info.items()
+            if name in configured_names
+        }
+
+    available_dependencies: dict[str, Dependency] = {}
+    skipped_dependencies: list[str] = []
+
+    for name, dep in candidate_dependencies.items():
+        try:
+            dep.version_parser(repo_path)
+        except (FileNotFoundError, RuntimeError, ValueError) as exc:
+            skipped_dependencies.append(f"{name}: {exc}")
+            continue
+        available_dependencies[name] = dep
+
+    if not available_dependencies:
+        raise RuntimeError(
+            f"No supported dependencies could be resolved from '{repo_branch}'"
+        )
+
+    if skipped_dependencies:
+        print(
+            f"Info: Skipping {len(skipped_dependencies)} dependencies that are not present or not parseable in '{repo_branch}'"
+        )
+
+    return available_dependencies
+
+
 def query_ghad(
     dependencies: dict[str, Dependency], gh_token: str, repo_path: Path
 ) -> list[Vulnerability]:
@@ -237,7 +284,10 @@ def main() -> int:
     parser.add_argument(
         "node_repo_branch",
         metavar="NODE_REPO_BRANCH",
-        help=f"the current branch of the Node repository (supports {supported_branches})",
+        help=(
+            "the current branch of the Node/N|Solid repository; known branches use "
+            f"curated dependency lists, other branches are scanned by probing available dependencies ({supported_branches})"
+        ),
     )
     parser.add_argument(
         "--gh-token",
@@ -281,10 +331,6 @@ def main() -> int:
         raise RuntimeError(
             "Invalid argument: '{repo_path}' is not a valid Node git repository"
         )
-    if repo_branch not in dependencies_per_branch:
-        raise RuntimeError(
-            f"Invalid argument: '{repo_branch}' is not a supported branch. Please use one of: {supported_branches}"
-        )
     if gh_token is None:
         print(
             "Warning: GitHub authentication token not provided, skipping GitHub Advisory Database queries",
@@ -296,11 +342,7 @@ def main() -> int:
             file=sys.stderr,
         )
 
-    dependencies = {
-        name: dep
-        for name, dep in dependencies_info.items()
-        if name in dependencies_per_branch[repo_branch]
-    }
+    dependencies = resolve_dependencies(repo_path, repo_branch)
 
     # Track whether every vulnerability source completed successfully. A partial scan must not
     # cause the reconciler to close issues for vulns that simply weren't queried this run.