add wont fix feature

[riosje]

Summary by CodeRabbit

• Bug Fixes
  • Prevented vulnerabilities marked as “won’t fix” in closed issues from being recreated during reconciliation.
  • Improved recognition of “won’t fix” labels regardless of capitalization, spacing, or underscores.
  • Reconciliation summaries now report how many vulnerabilities were skipped.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f782442d-ac9f-4399-bca6-13b86b04b780

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Reconciliation now fetches closed stream issues, recognizes case-insensitive “won’t fix” labels, suppresses matching vulnerabilities using current or legacy keys, and reports skipped items in the final summary.

Changes

Won’t-fix vulnerability suppression

Layer / File(s)	Summary
Closed issue detection and label normalization dep_checker/reconcile_issues.py	Adds “won’t fix” label normalization and a GitHub wrapper for retrieving closed issues by stream, raising when pagination may truncate results.
Suppressed vulnerability reconciliation dep_checker/reconcile_issues.py	Builds suppressed key sets from issue bodies or legacy titles, skips matching primary or legacy vulnerabilities, and includes skipped in reconciliation logging.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Reconcile
  participant Gh
  participant GitHubIssues
  participant DesiredVulnerabilities

  Reconcile->>Gh: Fetch closed issues for stream
  Gh->>GitHubIssues: List closed issues with stream filter
  GitHubIssues-->>Gh: Return issue JSON
  Gh-->>Reconcile: Return issues or raise on pagination limit
  Reconcile->>Reconcile: Normalize labels and collect current or legacy keys
  Reconcile->>DesiredVulnerabilities: Compare primary and legacy keys
  DesiredVulnerabilities-->>Reconcile: Matching vulnerability
  Reconcile-->>Reconcile: Skip processing and increment skipped

Loading

Poem

A rabbit found a “won’t fix” mark,
Beneath the moon and after dark.
Keys were checked, old and new,
Skipped bugs joined the summary too.
Hop, hop—no duplicate spark!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and clearly points to the main change: adding a wont-fix suppression feature.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jeff/addwontfixfeat

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

dep_checker/reconcile_issues.py (1)

333-343: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Check suppression before updating an existing issue.

Because issue is resolved before the suppression condition, a matching open issue is edited and counted as updated; the won’t-fix branch only runs when no open issue exists. This violates the stated “skip creating or updating” behavior.

Move the suppression check before edit_body()/sync_labels() and handle any existing open duplicate explicitly.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@dep_checker/reconcile_issues.py` around lines 333 - 343, In the
reconciliation flow around issue resolution, check whether the vulnerability’s
pkey or legacy key is in suppressed before entering the existing-issue update
path. For suppressed vulnerabilities, skip editing, label synchronization, and
updated counting; explicitly handle any matching open issue as skipped while
preserving the existing behavior for unsuppressed issues.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@dep_checker/reconcile_issues.py`:
- Around line 219-230: Update list_closed_issues so it never returns a truncated
closed-issue suppression list: paginate the query until all matching issues are
retrieved, or fail closed with an error when the limit is reached. Do not
continue reconciliation with the incomplete issues result, and preserve the
existing warning or reporting context as appropriate.

---

Outside diff comments:
In `@dep_checker/reconcile_issues.py`:
- Around line 333-343: In the reconciliation flow around issue resolution, check
whether the vulnerability’s pkey or legacy key is in suppressed before entering
the existing-issue update path. For suppressed vulnerabilities, skip editing,
label synchronization, and updated counting; explicitly handle any matching open
issue as skipped while preserving the existing behavior for unsuppressed issues.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0884e45e-a439-4c96-b33e-9ed2b4b38b97

📥 Commits

Reviewing files that changed from the base of the PR and between 7613c0e and b6997fa.

📒 Files selected for processing (1)

• dep_checker/reconcile_issues.py

[riosje]

@coderabbitai review this again

[coderabbitai]

@riosje Sure, I'll review the changes again.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

@riosje Sure, I'll review the changes again.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.