Completes the CVE loop for #166 (tracker #167). The control-app SBOM path
stored CVE alerts but created no notifications, so CODESYS runtime/library CVEs
never rang the dashboard bell.
Factor the alert-upsert + notification-creation out of run_pipeline into a
shared persist_cve_alerts(repo_id, repo_name, alerts) helper.
Call it from both the SAST pipeline and persist_control_app_sbom, so every
SBOM source (source deps, firmware, CODESYS libraries/runtime) raises the same
dedup'd CVE notifications.
Existing SAST behavior is unchanged (same logic, extracted); the PLC path gains
notifications. Full core+agent suites green; fmt + clippy clean.
Completes the CVE loop for **#166** (tracker **#167**). The control-app SBOM path
stored CVE alerts but created no **notifications**, so CODESYS runtime/library CVEs
never rang the dashboard bell.
- Factor the alert-upsert + notification-creation out of `run_pipeline` into a
shared `persist_cve_alerts(repo_id, repo_name, alerts)` helper.
- Call it from **both** the SAST pipeline and `persist_control_app_sbom`, so every
SBOM source (source deps, firmware, CODESYS libraries/runtime) raises the same
dedup'd CVE notifications.
Existing SAST behavior is unchanged (same logic, extracted); the PLC path gains
notifications. Full core+agent suites green; fmt + clippy clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The control-app SBOM CVE path (#166) stored alerts but created no notifications,
so CODESYS runtime/library CVEs never rang the dashboard bell.
Factor the alert-upsert + notification-creation out of run_pipeline into a shared
persist_cve_alerts(repo_id, repo_name, alerts) helper and call it from both the
SAST pipeline and persist_control_app_sbom. Now every SBOM source — source deps,
firmware, and CODESYS libraries/runtime — raises the same dedup'd CVE notifications.
Behavior for the existing SAST path is unchanged (same logic, extracted); the PLC
path additionally gains notifications. Completes the CVE loop for #166. Tracker #167.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sharang
merged commit d2003eb3c0 into main2026-07-16 16:30:20 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Completes the CVE loop for #166 (tracker #167). The control-app SBOM path
stored CVE alerts but created no notifications, so CODESYS runtime/library CVEs
never rang the dashboard bell.
run_pipelineinto ashared
persist_cve_alerts(repo_id, repo_name, alerts)helper.persist_control_app_sbom, so everySBOM source (source deps, firmware, CODESYS libraries/runtime) raises the same
dedup'd CVE notifications.
Existing SAST behavior is unchanged (same logic, extracted); the PLC path gains
notifications. Full core+agent suites green; fmt + clippy clean.
🤖 Generated with Claude Code