Review: add new import / export options

[reh-sfl]

Status

• READY
• HOLD
• WIP (Work-In-Progress)

How to verify this change

Review UI

1. Open the Review page and click Export.
2. Leave VulnScout JSON selected.
   • Verify the variant list uses checkboxes.
   • Verify the current variant is selected when viewing one variant; otherwise the project variants are selected.
   • Unselect one variant and export.
   • Verify the downloaded filename uses custom_data_...json.
   • Inspect the JSON: its assessments, cvss, and time_estimates entries should only reference selected variants.
3. Repeat with multiple variants selected.
   • Verify the export includes data for each selected variant.
4. Export again with OpenVEX selected.
   • Verify the variant list becomes radio buttons.
   • Verify exactly one variant must be selected before Export is enabled.
   • Export and verify the filename uses review_openvex_<variant>_...json.

Review Import

1. Click Import, select VulnScout JSON.
   • Verify no variant picker is shown.
   • Import a VulnScout JSON export into a project containing the referenced variants.
   • Verify imported assessments, CVSS scores, and time estimates appear on their variants from the file.
2. Click Import, select OpenVEX.
   • Verify one radio-button variant must be selected before Choose file is enabled.
   • Select a target variant and import an OpenVEX JSON export.
   • Verify assessments appear only in the selected target variant.

CLI: VulnScout JSON

Run from the repository checkout, or use the equivalent container entrypoint flags.

./vulnscout --project demo --export-custom-vulnscout-data

Export one variant:

./vulnscout --project demo --variant x86 --export-custom-vulnscout-data

Import the JSON into a project containing matching variants:

./vulnscout --project demo --import-custom-vulnscout-data /path/to/custom_vulnscout_data_all.json

CLI: OpenVEX

Export one variant:

./vulnscout --project demo --variant x86 --export-custom-openvex-assessments

Import it into a chosen target variant:

./vulnscout --project demo --variant arm \
  --import-custom-openvex-assessments /path/to/custom_openvex_x86.json

CLI Negative Checks

./vulnscout --project demo --export-custom-openvex-assessments
./vulnscout --project demo --import-custom-openvex-assessments /path/to/file.json

Pull Request Checklist

Please review and check all that apply before submitting your PR:

• The code compiles and passes all tests
• All new and existing tests are passing
• Documentation has been updated (if applicable)
• Code follows project style guidelines
• No sensitive information is included
• Linked relevant issues (if any)
• Added necessary reviewers

[ValentinBoudevinSFL]

Export:

1- "OpenVEX Assessment archive compatible with the CLI" . Maybe we should say it is assessments only (no time estimate cvss or variant).

The CLI is wrong and incomplete as both format "OpenVex", and "VulnScout JSON" should be exportable/importable via the CLI commands. Can you fix the CLI in this PR?

I think we should have:

-import-custom-vulnscout-data: Export custom VulnScout format
-import-custom-openvex-assessments: Export a OpenVex .json file format with --variant specified

-export-custom-vulnscout-data: Export custom VulnScout format
-export-custom-openvex-assessments: Export a OpenVex .json file format with --variant specified

We get rid of the OpenVex tar archive, it is too much to maintain right now.

So, the OpenVex format become an exclusive choice in your tab.

2- VulnScout JSON should also be able to export AI assessments if the user wants them

Import:

-Based on the modifications above, the menu should get two modes with "OpenVex", which ask for a variant exclusive selection, and "VulnScout JSON" mode it concerns every variants presents in the file