Skip to content

Chore/sp 4306 add info message and info code to responses#50

Merged
agustingroh merged 4 commits intomainfrom
chore/SP-4306-add-info-message-and-info-code-to-responses
Apr 20, 2026
Merged

Chore/sp 4306 add info message and info code to responses#50
agustingroh merged 4 commits intomainfrom
chore/SP-4306-add-info-message-and-info-code-to-responses

Conversation

@agustingroh
Copy link
Copy Markdown
Contributor

@agustingroh agustingroh commented Apr 20, 2026

Summary by CodeRabbit

Release Notes

  • New Features

    • Release version 0.10.0 with improved status messaging and reliability.
  • Bug Fixes & Improvements

    • Enhanced consistency in component status reporting with updated messaging framework.
  • Chores

    • Upgraded Go toolchain to 1.25.0 and multiple critical dependencies (gRPC, OpenTelemetry, PostgreSQL driver) for improved performance and security.

@agustingroh agustingroh requested a review from scanoss-qg April 20, 2026 15:44
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 20, 2026

Warning

Rate limit exceeded

@agustingroh has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 36 minutes and 57 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 36 minutes and 57 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6c431395-eea6-4ca7-be82-d52029d7f173

📥 Commits

Reviewing files that changed from the base of the PR and between c46243e and ff9b217.

⛔ Files ignored due to path filters (6)
  • go.sum is excluded by !**/*.sum
  • pkg/responsebuilder/testdata/algorithms_in_range_test_cases.csv is excluded by !**/*.csv
  • pkg/responsebuilder/testdata/algorithms_response_test_cases.csv is excluded by !**/*.csv
  • pkg/responsebuilder/testdata/encryption_hints_response_test_cases.csv is excluded by !**/*.csv
  • pkg/responsebuilder/testdata/hints_in_range_test_cases.csv is excluded by !**/*.csv
  • pkg/responsebuilder/testdata/versions_in_range_test_cases.csv is excluded by !**/*.csv
📒 Files selected for processing (49)
  • .github/workflows/go-ci.yml
  • .github/workflows/golangci-lint.yml
  • .github/workflows/release.yml
  • .golangci.yml
  • CHANGELOG.md
  • Makefile
  • go.mod
  • pkg/cmd/server.go
  • pkg/domain/cryptography_output.go
  • pkg/domain/ec_output.go
  • pkg/dtos/component_dto.go
  • pkg/dtos/cryptography_input_test.go
  • pkg/handlers/algorithm_handler_test.go
  • pkg/handlers/algorithm_in_range_handler_test.go
  • pkg/handlers/cryptography_support.go
  • pkg/handlers/cryptography_support_test.go
  • pkg/handlers/encryption_hints_handler_test.go
  • pkg/handlers/hints_in_range_handler_test.go
  • pkg/handlers/ruleset_download_handler.go
  • pkg/handlers/ruleset_download_handler_test.go
  • pkg/handlers/versions_in_range_handler_test.go
  • pkg/httphelper/http_helper.go
  • pkg/httphelper/http_helper_test.go
  • pkg/models/all_urls.go
  • pkg/models/all_urls_test.go
  • pkg/protocol/grpc/server.go
  • pkg/responsebuilder/algorithms_in_range_response_buider_test.go
  • pkg/responsebuilder/algorithms_in_range_response_builder.go
  • pkg/responsebuilder/algorithms_response_builder.go
  • pkg/responsebuilder/algorithms_response_builder_test.go
  • pkg/responsebuilder/encryption_hints_response_builder.go
  • pkg/responsebuilder/encryption_hints_response_builder_test.go
  • pkg/responsebuilder/error_code_response_builder.go
  • pkg/responsebuilder/error_code_response_builder_test.go
  • pkg/responsebuilder/hints_in_range_response_builder.go
  • pkg/responsebuilder/hints_in_range_response_builder_test.go
  • pkg/responsebuilder/versions_in_range_response_builder.go
  • pkg/responsebuilder/versions_in_range_response_builder_test.go
  • pkg/service/cryptography_service_test.go
  • pkg/testutils/test_helpers.go
  • pkg/usecase/component_validator.go
  • pkg/usecase/cryptography_major.go
  • pkg/usecase/cryptography_major_test.go
  • pkg/usecase/cryptography_search.go
  • pkg/usecase/cryptography_search_test.go
  • pkg/usecase/cryptography_versions_using.go
  • pkg/usecase/cryptography_versions_using_test.go
  • pkg/usecase/library_detections.go
  • pkg/usecase/library_detections_test.go
📝 Walkthrough

Walkthrough

The pull request refactors status handling across response builders and use cases by migrating from local ComponentStatus types to external types from github.com/scanoss/go-grpc-helper, renaming error fields to info fields, replacing CSV-driven tests with inline Go fixtures, removing the statusCodeToErrorCode helper function, and updating Go dependencies.

Changes

Cohort / File(s) Summary
Dependency Updates
go.mod
Upgraded Go toolchain from 1.24.0 to 1.25.0; bumped direct dependencies including github.com/lib/pq, github.com/scanoss/go-grpc-helper, github.com/scanoss/papi, go.opentelemetry.io/otel, google.golang.org/grpc, and modernc.org/sqlite; updated indirect dependencies including OpenTelemetry, protobuf, and modernc packages.
Changelog & Documentation
CHANGELOG.md
Added release notes for version 0.10.0 documenting field renames (error_message/error_codeinfo_message/info_code), removal of error_code_response_builder, dependency updates, and test refactoring from CSV fixtures to inline Go tests.
Domain Model Updates
pkg/domain/cryptography_output.go, pkg/domain/ec_output.go
Migrated local ComponentStatus type references to domain.ComponentStatus imported from github.com/scanoss/go-grpc-helper/pkg/grpc/domain across CryptoOutputItem, ECOutputItem, and related status fields.
Response Builder Logic
pkg/responsebuilder/algorithms_in_range_response_builder.go, pkg/responsebuilder/algorithms_response_builder.go, pkg/responsebuilder/encryption_hints_response_builder.go, pkg/responsebuilder/hints_in_range_response_builder.go, pkg/responsebuilder/versions_in_range_response_builder.go
Replaced error-field population (ErrorMessage/ErrorCode via statusCodeToErrorCode) with info-field population (InfoMessage/InfoCode via .String() and .Message); switched success comparison from domain.Success to status.Success from external gRPC helper library.
Response Builder Tests
pkg/responsebuilder/algorithms_in_range_response_buider_test.go, pkg/responsebuilder/algorithms_response_builder_test.go, pkg/responsebuilder/encryption_hints_response_builder_test.go, pkg/responsebuilder/hints_in_range_response_builder_test.go, pkg/responsebuilder/versions_in_range_response_builder_test.go
Replaced CSV/JSON-driven test-case loading with inline Go fixtures; removed TestCase structs, CSV parsing, and external test-data files; refactored to use context.Background(), zap.NewNop().Sugar() loggers, and full-struct assert.Equal assertions instead of field-by-field comparisons.
Error Code Builder (Removed)
pkg/responsebuilder/error_code_response_builder.go, pkg/responsebuilder/error_code_response_builder_test.go
Removed statusCodeToErrorCode(...) function and its entire test file; status code mapping is now inline within each response builder using .String() conversion.
Service Updates
pkg/service/cryptography_service.go
Added debug logging via fmt.Printf in the deprecated GetAlgorithms gRPC method.
Use Case Implementations
pkg/usecase/component_validator.go, pkg/usecase/cryptography_major.go, pkg/usecase/cryptography_search.go, pkg/usecase/cryptography_versions_using.go, pkg/usecase/library_detections.go
Migrated all status-code comparisons and ComponentStatus struct construction from local domain package to external status (alias for github.com/scanoss/go-grpc-helper/pkg/grpc/domain); updated status codes (e.g., domain.Successstatus.Success, domain.ComponentWithoutInfostatus.NoInfo).
Use Case Tests
pkg/usecase/cryptography_major_test.go, pkg/usecase/cryptography_search_test.go, pkg/usecase/cryptography_versions_using_test.go, pkg/usecase/library_detections_test.go
Updated all test assertions to reference status-code constants from the external status library instead of local domain package (e.g., domain.InvalidPurlstatus.InvalidPurl).

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

🐰 Across the codebase, a status migration hops,
From error fields to info—refactoring never stops!
CSV fixtures fade to Go test tables bright,
New dependencies dance; all status codes take flight!

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 25.58% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: adding info_message and info_code fields to replace error_message and error_code across response builders and domain structs.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/SP-4306-add-info-message-and-info-code-to-responses

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@agustingroh agustingroh force-pushed the chore/SP-4306-add-info-message-and-info-code-to-responses branch from 9dcfd55 to bf763a9 Compare April 20, 2026 15:52
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)
pkg/responsebuilder/algorithms_in_range_response_builder.go (1)

47-65: ⚠️ Potential issue | 🟠 Major

Map non-success statuses to InfoCode / InfoMessage in this builder too.

The component builders below manually translate Status into Info*, but ToAlgorithmsInRangeResponse still relies on JSON conversion. Since the DTO emits a status object and the protobuf response expects info_code / info_message, non-success per-PURL status details can be silently dropped on this response path.

🐛 Proposed manual mapping
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	status "github.com/scanoss/go-grpc-helper/pkg/grpc/domain"
 	"net/http"
@@
 func ToAlgorithmsInRangeResponse(ctx context.Context, s *zap.SugaredLogger, output domain.CryptoInRangeOutput) (*pb.AlgorithmsInRangeResponse, error) {
-	data, err := json.Marshal(output)
-
-	if err != nil {
-		s.Errorf("Problem marshalling Cryptography request output: %v", err)
-		return &pb.AlgorithmsInRangeResponse{}, errors.New("problem marshalling Cryptography output")
-	}
-	var response pb.AlgorithmsInRangeResponse
-	err = json.Unmarshal(data, &response)
-	if err != nil {
-		s.Errorf("Problem unmarshalling Cryptography request output: %v", err)
-		return &pb.AlgorithmsInRangeResponse{}, errors.New("problem unmarshalling Cryptography output")
+	response := &pb.AlgorithmsInRangeResponse{
+		Purls: make([]*pb.AlgorithmsInRangeResponse_Purl, 0, len(output.Cryptography)),
+	}
+	for _, c := range output.Cryptography {
+		algorithms := make([]*pb.Algorithm, 0, len(c.Algorithms))
+		for _, alg := range c.Algorithms {
+			algorithms = append(algorithms, &pb.Algorithm{
+				Algorithm: alg.Algorithm,
+				Strength:  alg.Strength,
+			})
+		}
+		purl := &pb.AlgorithmsInRangeResponse_Purl{
+			Purl:       c.Purl,
+			Versions:   c.Versions,
+			Algorithms: algorithms,
+		}
+		if c.Status.StatusCode != status.Success {
+			code := c.Status.StatusCode.String()
+			msg := c.Status.Message
+			purl.InfoCode = &code
+			purl.InfoMessage = &msg
+		}
+		response.Purls = append(response.Purls, purl)
 	}
 	response.Status = &common.StatusResponse{
 		Status:  common.StatusCode_SUCCESS,
 		Message: "Algorithms in range retrieved successfully.",
 	}
 	httphelper.SetHTTPCodeOnTrailer(ctx, s, http.StatusOK)
-	return &response, nil
+	return response, nil
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/responsebuilder/algorithms_in_range_response_builder.go` around lines 47
- 65, ToAlgorithmsInRangeResponse currently uses JSON round-trip which drops
per-PURL non-success status fields; change it to build
pb.AlgorithmsInRangeResponse explicitly by iterating the
domain.CryptoInRangeOutput entries and mapping each entry's status to the
protobuf's info_code/info_message fields (e.g., translate domain status ->
common.InfoCode and status message -> info_message) instead of relying on
json.Unmarshal; preserve existing fields (algorithms, purl, etc.), set
response.Status as now, and keep the httphelper.SetHTTPCodeOnTrailer(ctx, s,
http.StatusOK) call.
pkg/usecase/library_detections.go (1)

121-131: ⚠️ Potential issue | 🟡 Minor

Typo: double space in message, plus inconsistent format across branches.

Line 131 has "Component without info: '%s'" with a double space between without and info. Line 121 uses a single space. Line 246 in processSinglePurl uses yet a third variant: "Component without info '%s'" (single space, no colon). These user-visible messages should be consistent.

🔧 Proposed fix
@@ line 131
-				Status:      status.ComponentStatus{StatusCode: status.NoInfo, Message: fmt.Sprintf("Component without  info: '%s'", component.Purl)},
+				Status:      status.ComponentStatus{StatusCode: status.NoInfo, Message: fmt.Sprintf("Component without info: '%s'", component.Purl)},

Optionally align line 246 ("Component without info '%s'") to also include the colon for parity with lines 121/131.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/usecase/library_detections.go` around lines 121 - 131, The user-visible
status messages for missing component info are inconsistent and contain a double
space; update all occurrences to a single, consistent format (e.g., "Component
without info: '%s'") across the codebase—specifically fix the string in the
block that appends to out.Hints (domain.HintsOutputItem) and the message in
processSinglePurl so all use the same spelling, spacing, and punctuation when
constructing status.ComponentStatus.Message.
🧹 Nitpick comments (6)
pkg/responsebuilder/hints_in_range_response_builder_test.go (2)

34-85: Fixture duplication between hintsInRangeFixtures and each test's wants map.

The aes / rsa detection items are re-declared in every test function (TestToHintsInRangeResponse line 91-92, TestToComponentsHintsInRangeResponse line 143-144, and TestComponentHintsInRangeResponse line 195) and also inside hintsInRangeFixtures. Consider hoisting them to package-level test variables (or a single helper) to reduce drift risk when updating test data.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/responsebuilder/hints_in_range_response_builder_test.go` around lines 34
- 85, The fixtures duplicate the AES/RSA ECDetectedItem definitions across
hintsInRangeFixtures and several tests (TestToHintsInRangeResponse,
TestToComponentsHintsInRangeResponse, TestComponentHintsInRangeResponse); hoist
the shared detections into package-level test variables (e.g., var testAES =
domain.ECDetectedItem{...}, var testRSA = ... ) or a single helper function and
update hintsInRangeFixtures and the tests to reference those variables (replace
local aes/rsa declarations with the package-level symbols) so all tests use the
same source of truth.

115-117: Use .String() for consistency with production code pattern.

StatusCode is defined as type StatusCode string, so string(status.ComponentWithoutInfo) and status.ComponentWithoutInfo.String() are functionally equivalent. However, the production builder uses .String(), and aligning the test with that pattern improves consistency:

Changes needed

Line 115:

-				InfoCode:    ptr(string(status.ComponentWithoutInfo)),
+				InfoCode:    ptr(status.ComponentWithoutInfo.String()),

Line 168 in TestToComponentsHintsInRangeResponse:

-				InfoCode:    ptr(string(status.NoInfo)),
+				InfoCode:    ptr(status.NoInfo.String()),
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/responsebuilder/hints_in_range_response_builder_test.go` around lines 115
- 117, The test uses string(status.ComponentWithoutInfo) for the InfoCode field
but should use the production pattern status.ComponentWithoutInfo.String();
update the test in TestToComponentsHintsInRangeResponse (the struct setting
InfoCode) to call .String() on status.ComponentWithoutInfo so the test matches
production code style and consistency with the StatusCode type.
pkg/usecase/cryptography_major.go (1)

55-67: Local variable status shadows the package alias inside the loop.

parseAndValidateComponent returns a value being assigned to a local status at line 56, which shadows the imported status package alias within the body of this for loop. It currently compiles because the package alias is only referenced outside this loop (line 71 and below), but it's fragile — any future edit adding a status.X reference inside this loop will silently break. Consider renaming the local variable (e.g., compStatus or st) or the package alias.

♻️ Proposed rename
 	for _, component := range components {
-		status, packageURL, purlName := parseAndValidateComponent(s, component)
+		compStatus, packageURL, purlName := parseAndValidateComponent(s, component)
 		cryptoItem := domain.CryptoInRangeOutputItem{
-			Status:      status,
+			Status:      compStatus,
 			Purl:        component.Purl,

The same pattern exists in pkg/usecase/cryptography_versions_using.go at line 57 and should be fixed there too.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/usecase/cryptography_major.go` around lines 55 - 67, The local variable
named status in the loop that assigns parseAndValidateComponent(...) should be
renamed (e.g., compStatus or st) to avoid shadowing the imported package alias
status; update the variable usage inside the loop when building
domain.CryptoInRangeOutputItem (Status: ...) to use the new name, and apply the
same rename in the corresponding loop in the cryptography_versions_using.go file
to prevent future accidental package shadowing.
pkg/usecase/cryptography_versions_using.go (1)

77-82: Pre-existing: errQ from GetUrlsByPurlNameTypeInRange is discarded.

Not changed in this PR, but worth noting since the status code was migrated here: when GetUrlsByPurlNameTypeInRange returns an error, errQ is unused (line 82: _ = errQ) and the error path is indistinguishable from a legitimate empty result — both map to ComponentNotFound. If the underlying call fails transiently, the caller will be told the component doesn't exist.

Consider logging or surfacing errQ distinctly (e.g., ComponentWithoutInfo for DB errors vs ComponentNotFound for genuine empty results), matching the pattern used at line 91-95 for cryptoUsage.GetCryptoUsageByURLHashes.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/usecase/cryptography_versions_using.go` around lines 77 - 82, The call to
GetUrlsByPurlNameTypeInRange returns an error (errQ) that is currently discarded
which conflates DB errors with genuine "no results" and sets StatusCode to
ComponentNotFound; update the loop handling the result from
GetUrlsByPurlNameTypeInRange (variable errQ, res, component) to check if errQ !=
nil and surface or log it and set a distinct status (e.g., ComponentWithoutInfo
or include the error message) instead of treating it as ComponentNotFound;
mirror the pattern used around cryptoUsage.GetCryptoUsageByURLHashes (lines
handling errors at 91-95) so DB/query failures are distinguishable from empty
results.
pkg/responsebuilder/encryption_hints_response_builder_test.go (1)

39-252: Test refactor LGTM.

Inline fixtures + full-struct assertions are a nice improvement over the CSV/JSON-driven approach. One small observation: aes/rsa detection items are redeclared inside TestToHintsResponse and TestToComponentsEncryptionHintsResponse (lines 119-120, 171-172) despite being declared in encryptionHintsFixtures (lines 40-55). Consider extracting them to package-level test vars or a small helper to avoid drift if any field changes.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/responsebuilder/encryption_hints_response_builder_test.go` around lines
39 - 252, Tests redeclare AES/RSA detection items in TestToHintsResponse and
TestToComponentsEncryptionHintsResponse even though encryptionHintsFixtures
defines them; extract the AES/RSA items to package-level test variables (or a
small helper function) and update encryptionHintsFixtures, TestToHintsResponse,
TestToComponentsEncryptionHintsResponse, and
TestComponentEncryptionHintsResponse to reference those shared vars (look for
symbols encryptionHintsFixtures, TestToHintsResponse,
TestToComponentsEncryptionHintsResponse, and the local aes/rsa declarations) so
the same canonical domain.ECDetectedItem instances are used across fixtures and
tests to avoid drift.
pkg/responsebuilder/algorithms_in_range_response_buider_test.go (1)

109-254: Consistency: prefer StatusCode.String() over string(StatusCode) in test expectations for alignment with production code.

The response builders produce the InfoCode value via v.Status.StatusCode.String(), but the tests construct expected values via direct type conversion: ptr(string(status.InvalidPurl)), ptr(string(status.ComponentNotFound)), etc.

Currently, StatusCode is defined as type StatusCode string with a trivial String() method that returns string(s) unchanged, so both approaches produce identical results and tests pass. However, this inconsistency diverges from the production pattern. To maintain consistency and resilience against future changes to the String() method, update all test occurrences to use:

InfoCode: ptr(status.ComponentNotFound.String()),

instead of:

InfoCode: ptr(string(status.ComponentNotFound)),

Applies to all ptr(string(status.X)) occurrences in this file and in algorithms_response_builder_test.go, encryption_hints_response_builder_test.go, and versions_in_range_response_builder_test.go.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/responsebuilder/algorithms_in_range_response_buider_test.go` around lines
109 - 254, Tests use direct type conversion ptr(string(status.X)) for InfoCode
while production uses v.Status.StatusCode.String(); update all occurrences of
ptr(string(status.*)) in this test file (and the other listed tests:
algorithms_response_builder_test.go, encryption_hints_response_builder_test.go,
versions_in_range_response_builder_test.go) to call the String() method instead
(e.g., ptr(status.ComponentNotFound.String())) so expectations match builders;
locate uses by searching for "InfoCode: ptr(string(status." and replace with the
corresponding "InfoCode: ptr(status.<StatusName>.String())" for each StatusCode.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@go.mod`:
- Around line 32-36: Update the five OpenTelemetry module entries in go.mod from
v1.40.0 to v1.43.0 to remediate the PATH hijacking vulnerability; specifically
change versions for go.opentelemetry.io/otel/sdk,
go.opentelemetry.io/otel/sdk/metric,
go.opentelemetry.io/otel/exporters/otlp/otlptrace,
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, and
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc to v1.43.0,
then run `go mod tidy`/`go get` to update the lockfile and ensure all otel
packages resolve to the patched v1.43.0 release.

In `@pkg/service/cryptography_service.go`:
- Line 74: The stray fmt.Printf("GetAlgorithms, %v\n", request) in the
GetAlgorithms handler is a leftover debug print; remove it (and the fmt import
if now unused) or replace it with the structured logger used in this file
(ctxzap.FromContext(ctx).Debug or Info) so the request is logged with
context/correlation like the Echo handler; locate the GetAlgorithms method in
pkg/service/cryptography_service.go and either drop the print entirely or emit a
contextual debug log using ctxzap.FromContext(ctx).Debugw/Debugf with a
descriptive message and the request payload.

In `@pkg/usecase/cryptography_major.go`:
- Line 98: There is a typo in the status message string: change "withput" to
"without" in the assignment to c.Status (the ComponentStatus instantiation that
uses status.ComponentStatus, StatusCode: status.NoInfo, and fmt.Sprintf with
c.Purl); update the fmt.Sprintf message to read "Component without info %s" so
the log/ status text is correct.

In `@pkg/usecase/cryptography_versions_using_test.go`:
- Around line 160-162: The test assertion message has a typo: update the
t.Fatalf call that checks v.Status.StatusCode against status.InvalidSemver to
read "invalid semver" instead of "inavlid semver" (i.e., change the string
inside t.Fatalf to "Expected to get 'invalid semver' status, but get '%s'") so
the failure message is correct and clear; locate the assertion using
v.Status.StatusCode, status.InvalidSemver and t.Fatalf to apply the fix.

---

Outside diff comments:
In `@pkg/responsebuilder/algorithms_in_range_response_builder.go`:
- Around line 47-65: ToAlgorithmsInRangeResponse currently uses JSON round-trip
which drops per-PURL non-success status fields; change it to build
pb.AlgorithmsInRangeResponse explicitly by iterating the
domain.CryptoInRangeOutput entries and mapping each entry's status to the
protobuf's info_code/info_message fields (e.g., translate domain status ->
common.InfoCode and status message -> info_message) instead of relying on
json.Unmarshal; preserve existing fields (algorithms, purl, etc.), set
response.Status as now, and keep the httphelper.SetHTTPCodeOnTrailer(ctx, s,
http.StatusOK) call.

In `@pkg/usecase/library_detections.go`:
- Around line 121-131: The user-visible status messages for missing component
info are inconsistent and contain a double space; update all occurrences to a
single, consistent format (e.g., "Component without info: '%s'") across the
codebase—specifically fix the string in the block that appends to out.Hints
(domain.HintsOutputItem) and the message in processSinglePurl so all use the
same spelling, spacing, and punctuation when constructing
status.ComponentStatus.Message.

---

Nitpick comments:
In `@pkg/responsebuilder/algorithms_in_range_response_buider_test.go`:
- Around line 109-254: Tests use direct type conversion ptr(string(status.X))
for InfoCode while production uses v.Status.StatusCode.String(); update all
occurrences of ptr(string(status.*)) in this test file (and the other listed
tests: algorithms_response_builder_test.go,
encryption_hints_response_builder_test.go,
versions_in_range_response_builder_test.go) to call the String() method instead
(e.g., ptr(status.ComponentNotFound.String())) so expectations match builders;
locate uses by searching for "InfoCode: ptr(string(status." and replace with the
corresponding "InfoCode: ptr(status.<StatusName>.String())" for each StatusCode.

In `@pkg/responsebuilder/encryption_hints_response_builder_test.go`:
- Around line 39-252: Tests redeclare AES/RSA detection items in
TestToHintsResponse and TestToComponentsEncryptionHintsResponse even though
encryptionHintsFixtures defines them; extract the AES/RSA items to package-level
test variables (or a small helper function) and update encryptionHintsFixtures,
TestToHintsResponse, TestToComponentsEncryptionHintsResponse, and
TestComponentEncryptionHintsResponse to reference those shared vars (look for
symbols encryptionHintsFixtures, TestToHintsResponse,
TestToComponentsEncryptionHintsResponse, and the local aes/rsa declarations) so
the same canonical domain.ECDetectedItem instances are used across fixtures and
tests to avoid drift.

In `@pkg/responsebuilder/hints_in_range_response_builder_test.go`:
- Around line 34-85: The fixtures duplicate the AES/RSA ECDetectedItem
definitions across hintsInRangeFixtures and several tests
(TestToHintsInRangeResponse, TestToComponentsHintsInRangeResponse,
TestComponentHintsInRangeResponse); hoist the shared detections into
package-level test variables (e.g., var testAES = domain.ECDetectedItem{...},
var testRSA = ... ) or a single helper function and update hintsInRangeFixtures
and the tests to reference those variables (replace local aes/rsa declarations
with the package-level symbols) so all tests use the same source of truth.
- Around line 115-117: The test uses string(status.ComponentWithoutInfo) for the
InfoCode field but should use the production pattern
status.ComponentWithoutInfo.String(); update the test in
TestToComponentsHintsInRangeResponse (the struct setting InfoCode) to call
.String() on status.ComponentWithoutInfo so the test matches production code
style and consistency with the StatusCode type.

In `@pkg/usecase/cryptography_major.go`:
- Around line 55-67: The local variable named status in the loop that assigns
parseAndValidateComponent(...) should be renamed (e.g., compStatus or st) to
avoid shadowing the imported package alias status; update the variable usage
inside the loop when building domain.CryptoInRangeOutputItem (Status: ...) to
use the new name, and apply the same rename in the corresponding loop in the
cryptography_versions_using.go file to prevent future accidental package
shadowing.

In `@pkg/usecase/cryptography_versions_using.go`:
- Around line 77-82: The call to GetUrlsByPurlNameTypeInRange returns an error
(errQ) that is currently discarded which conflates DB errors with genuine "no
results" and sets StatusCode to ComponentNotFound; update the loop handling the
result from GetUrlsByPurlNameTypeInRange (variable errQ, res, component) to
check if errQ != nil and surface or log it and set a distinct status (e.g.,
ComponentWithoutInfo or include the error message) instead of treating it as
ComponentNotFound; mirror the pattern used around
cryptoUsage.GetCryptoUsageByURLHashes (lines handling errors at 91-95) so
DB/query failures are distinguishable from empty results.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 167f3a7d-67bb-4952-ba23-79421f136968

📥 Commits

Reviewing files that changed from the base of the PR and between f42c57d and c46243e.

⛔ Files ignored due to path filters (6)
  • go.sum is excluded by !**/*.sum
  • pkg/responsebuilder/testdata/algorithms_in_range_test_cases.csv is excluded by !**/*.csv
  • pkg/responsebuilder/testdata/algorithms_response_test_cases.csv is excluded by !**/*.csv
  • pkg/responsebuilder/testdata/encryption_hints_response_test_cases.csv is excluded by !**/*.csv
  • pkg/responsebuilder/testdata/hints_in_range_test_cases.csv is excluded by !**/*.csv
  • pkg/responsebuilder/testdata/versions_in_range_test_cases.csv is excluded by !**/*.csv
📒 Files selected for processing (26)
  • CHANGELOG.md
  • go.mod
  • pkg/domain/cryptography_output.go
  • pkg/domain/ec_output.go
  • pkg/responsebuilder/algorithms_in_range_response_buider_test.go
  • pkg/responsebuilder/algorithms_in_range_response_builder.go
  • pkg/responsebuilder/algorithms_response_builder.go
  • pkg/responsebuilder/algorithms_response_builder_test.go
  • pkg/responsebuilder/encryption_hints_response_builder.go
  • pkg/responsebuilder/encryption_hints_response_builder_test.go
  • pkg/responsebuilder/error_code_response_builder.go
  • pkg/responsebuilder/error_code_response_builder_test.go
  • pkg/responsebuilder/hints_in_range_response_builder.go
  • pkg/responsebuilder/hints_in_range_response_builder_test.go
  • pkg/responsebuilder/versions_in_range_response_builder.go
  • pkg/responsebuilder/versions_in_range_response_builder_test.go
  • pkg/service/cryptography_service.go
  • pkg/usecase/component_validator.go
  • pkg/usecase/cryptography_major.go
  • pkg/usecase/cryptography_major_test.go
  • pkg/usecase/cryptography_search.go
  • pkg/usecase/cryptography_search_test.go
  • pkg/usecase/cryptography_versions_using.go
  • pkg/usecase/cryptography_versions_using_test.go
  • pkg/usecase/library_detections.go
  • pkg/usecase/library_detections_test.go
💤 Files with no reviewable changes (2)
  • pkg/responsebuilder/error_code_response_builder.go
  • pkg/responsebuilder/error_code_response_builder_test.go

Comment thread go.mod
Comment thread pkg/service/cryptography_service.go Outdated
Comment thread pkg/usecase/cryptography_major.go Outdated
Comment thread pkg/usecase/cryptography_versions_using_test.go
@agustingroh agustingroh force-pushed the chore/SP-4306-add-info-message-and-info-code-to-responses branch from c46243e to b1e968d Compare April 20, 2026 16:45
@agustingroh agustingroh force-pushed the chore/SP-4306-add-info-message-and-info-code-to-responses branch from b1e968d to c825ffd Compare April 20, 2026 16:47
@agustingroh agustingroh force-pushed the chore/SP-4306-add-info-message-and-info-code-to-responses branch from c825ffd to ff9b217 Compare April 20, 2026 16:51
Copy link
Copy Markdown
Contributor

@scanoss-qg scanoss-qg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@agustingroh agustingroh merged commit 926c170 into main Apr 20, 2026
3 checks passed
@agustingroh agustingroh deleted the chore/SP-4306-add-info-message-and-info-code-to-responses branch April 20, 2026 17:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants