fix(vuln): scanned_sboms reflects current snapshot, not all-time coverage #14

Merged

jonas merged 1 commit from fix/vuln-summary-snapshot-sboms into chore/remove-material-views

2026-06-24 13:07:22 +02:00

jonas commented

2026-06-24 12:25:45 +02:00

Owner

/api/vuln/summary's scanned_sboms counted every SBOM ever scanned (cumulative — no recency/branch/liveness scoping), inflating the headline number vs. what's actually deployed today.

Redefined as the org's current snapshot in both computeSummary (unrestricted) and computeSummaryScoped (narrow-grant):

repos: latest scan per repo (DISTINCT ON (repo_id) ORDER BY scanned_at DESC over sbom_scan_results) — superseded commits drop out.
images: SBOMs for digests currently running in a live cluster (via cluster_image_inventory + db.LiveClusterExistsSQL, reusing the SPAM_CLUSTER_LIVE_WINDOW window). Digests no longer running anywhere drop out.

last_scanned_at stays an all-time MAX.

Import-cycle note: vulnmetrics can't import scam (cycle scam → … → jobs → vulnmetrics), so the live-window SQL helper lives in the leaf db package (ClusterLiveWindowInterval / LiveClusterExistsSQL), reading the same SPAM_CLUSTER_LIVE_WINDOW env + 24h default as scam.

Scope: only the live /api/vuln/summary value changes. /api/vuln/trend is severity-only and untouched; historic vuln_dashboard_snapshots rows are not recomputed (new dailies use the new definition going forward).

Base: stacked on chore/remove-material-views because it depends on that branch's derived-tables work (cluster_image_inventory, the new computeSummary). Retarget to main once #12 merges.

Verified: go vet + gofmt clean; both queries EXPLAIN cleanly against the schema.

🤖 Generated with Claude Code

`/api/vuln/summary`'s `scanned_sboms` counted every SBOM ever scanned (cumulative — no recency/branch/liveness scoping), inflating the headline number vs. what's actually deployed today. Redefined as the org's **current snapshot** in both `computeSummary` (unrestricted) and `computeSummaryScoped` (narrow-grant): - **repos**: latest scan per repo (`DISTINCT ON (repo_id) ORDER BY scanned_at DESC` over `sbom_scan_results`) — superseded commits drop out. - **images**: SBOMs for digests currently running in a **live cluster** (via `cluster_image_inventory` + `db.LiveClusterExistsSQL`, reusing the `SPAM_CLUSTER_LIVE_WINDOW` window). Digests no longer running anywhere drop out. `last_scanned_at` stays an all-time MAX. **Import-cycle note:** `vulnmetrics` can't import `scam` (cycle `scam → … → jobs → vulnmetrics`), so the live-window SQL helper lives in the leaf `db` package (`ClusterLiveWindowInterval` / `LiveClusterExistsSQL`), reading the same `SPAM_CLUSTER_LIVE_WINDOW` env + 24h default as `scam`. **Scope:** only the live `/api/vuln/summary` value changes. `/api/vuln/trend` is severity-only and untouched; historic `vuln_dashboard_snapshots` rows are not recomputed (new dailies use the new definition going forward). **Base:** stacked on `chore/remove-material-views` because it depends on that branch's derived-tables work (`cluster_image_inventory`, the new `computeSummary`). Retarget to `main` once #12 merges. Verified: `go vet` + `gofmt` clean; both queries `EXPLAIN` cleanly against the schema. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jonas added 1 commit

2026-06-24 12:25:45 +02:00

fix(vuln): scanned_sboms reflects current snapshot, not all-time coverage

Build and Deploy / build-repo-runner (push) Successful in 1m10s

Details

Build and Deploy / build-sbom-scanner (push) Successful in 1m11s

Details

Build and Deploy / build-image-scanner (push) Successful in 1m11s

Details

Build and Deploy / build-app (push) Successful in 3m23s

Details

Build and Deploy / deploy-helm (push) Successful in 18s

Details

5057c9afb0

/api/vuln/summary's scanned_sboms counted every SBOM ever scanned (repo OSV
results UNION any image-bound SBOM with a finished scan) — cumulative, with
no recency/branch/liveness scoping. That inflates the headline "scanned
SBOMs" number relative to what's actually deployed today.

Redefine it as the org's current snapshot in both computeSummary (unrestricted)
and computeSummaryScoped (narrow-grant), so the two stay consistent:
- repos: the latest scan per repo (DISTINCT ON (repo_id) ORDER BY scanned_at
  DESC over sbom_scan_results), matching how the repo vuln view picks each
  repo's representative scan. Superseded commits drop out.
- images: SBOMs for digests currently running in a LIVE cluster — joined via
  cluster_image_inventory and gated by db.LiveClusterExistsSQL, reusing the
  SPAM_CLUSTER_LIVE_WINDOW window. Digests no longer running anywhere drop out.
last_scanned_at stays an all-time MAX.

vulnmetrics can't import scam (import cycle scam -> ... -> jobs -> vulnmetrics),
so the live-window SQL helper lives in the leaf db package
(ClusterLiveWindowInterval / LiveClusterExistsSQL), reading the same
SPAM_CLUSTER_LIVE_WINDOW env + 24h default as scam.

Scope: only the live /api/vuln/summary value changes. /api/vuln/trend is
severity-only and untouched; historic vuln_dashboard_snapshots rows are not
recomputed (new dailies use the new definition going forward).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

jonas merged commit fb99124364 into chore/remove-material-views

2026-06-24 13:07:22 +02:00

jonas referenced this pull request from a commit

2026-06-24 13:07:23 +02:00

Merge pull request 'fix(vuln): scanned_sboms reflects current snapshot, not all-time coverage' (#14) from fix/vuln-summary-snapshot-sboms into chore/remove-material-views