(tooling-trusted-releases) branch sbp updated: Report temporary OSV failures clearly

[sb...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sbp pushed a commit to branch sbp
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git


The following commit(s) were added to refs/heads/sbp by this push:
     new 3055495e Report temporary OSV failures clearly
3055495e is described below

commit 3055495ed84a520d29a9e4bf382840de1a8bc3be
Author: Sean B. Palmer <se...@miscoranda.com>
AuthorDate: Wed Jul 29 15:56:48 2026 +0100

    Report temporary OSV failures clearly
---
 atr/tasks/sbom.py           | 11 ++++++++++-
 tests/unit/test_sbom_osv.py | 30 ++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/atr/tasks/sbom.py b/atr/tasks/sbom.py
index 0105c142..a79190e5 100644
--- a/atr/tasks/sbom.py
+++ b/atr/tasks/sbom.py
@@ -23,6 +23,7 @@ from typing import Any, Final
 
 import aiofiles
 import aiofiles.os
+import aiohttp
 import orjson
 
 import atr.analysis as analysis
@@ -44,6 +45,7 @@ import atr.tasks.checks as checks
 import atr.util as util
 
 _CONFIG: Final = config.get()
+_OSV_UNAVAILABLE_MESSAGE: Final = "The OSV service could not be reached; try the scan again later"
 
 
 class SBOMConversionError(Exception):
@@ -243,7 +245,14 @@ async def osv_scan(args: args.FileArgs) -> results.Results | None:
     bundle = sbom.utilities.path_to_bundle(full_path.path)
     if not bundle:
         raise SBOMScanningError("Could not load bundle")
-    vulnerabilities, ignored = await sbom.osv.scan_bundle(bundle)
+    try:
+        vulnerabilities, ignored = await sbom.osv.scan_bundle(bundle)
+    except (TimeoutError, aiohttp.ClientConnectionError, aiohttp.ClientPayloadError) as e:
+        raise SBOMScanningError(_OSV_UNAVAILABLE_MESSAGE) from e
+    except aiohttp.ClientResponseError as e:
+        if (e.status != 429) and (e.status < 500):
+            raise
+        raise SBOMScanningError(_OSV_UNAVAILABLE_MESSAGE) from e
     patch_ops = await sbom.utilities.bundle_to_vuln_patch(bundle, vulnerabilities)
     components = []
     for v in vulnerabilities:
diff --git a/tests/unit/test_sbom_osv.py b/tests/unit/test_sbom_osv.py
index 503aee2a..7e1220b5 100644
--- a/tests/unit/test_sbom_osv.py
+++ b/tests/unit/test_sbom_osv.py
@@ -15,10 +15,15 @@
 # specific language governing permissions and limitations
 # under the License.
 
+import unittest.mock as mock
+
 import aiohttp
 import pytest
 
+import atr.models.args as args
+import atr.models.safe as safe
 import atr.sbom.osv as osv
+import atr.tasks.sbom as tasks_sbom
 
 
 class FakeResponse:
@@ -67,6 +72,31 @@ def sleeps(monkeypatch):
     return recorded
 
 
+async def test_osv_scan_reports_truncated_response_as_unavailable(tmp_path, monkeypatch):
+    rel_path = safe.RelPath("artifact.cdx.json")
+    (tmp_path / str(rel_path)).write_text("{}", encoding="utf-8")
+    monkeypatch.setattr(tasks_sbom.paths, "get_unfinished_dir_for", lambda *_args: safe.StatePath(tmp_path))
+    monkeypatch.setattr(tasks_sbom.sbom.utilities, "path_to_bundle", lambda _path: mock.sentinel.bundle)
+    monkeypatch.setattr(
+        tasks_sbom.sbom.osv,
+        "scan_bundle",
+        mock.AsyncMock(side_effect=aiohttp.ClientPayloadError()),
+    )
+    task_args = args.FileArgs(
+        project_key=safe.ProjectKey("project"),
+        version_key=safe.VersionKey("1.0.0"),
+        revision_number=safe.RevisionNumber("00001"),
+        file_path=rel_path,
+        asf_uid="test",
+    )
+
+    with pytest.raises(
+        tasks_sbom.SBOMScanningError,
+        match="The OSV service could not be reached; try the scan again later",
+    ):
+        await tasks_sbom.osv_scan(task_args.model_dump())
+
+
 async def test_request_json_does_not_retry_client_errors(sleeps):
     session = FakeSession([FakeResponse(404)])
 


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org