Add tests for `MetricsUpdateTask` and squash some bugs along the way by nscuro · Pull Request #1530 · DependencyTrack/dependency-track · GitHub
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add tests for MetricsUpdateTask and squash some bugs along the way #1530

Merged
merged 2 commits into from
Apr 10, 2022

Conversation

nscuro
Copy link
Member

@nscuro nscuro commented Apr 10, 2022

This PR adds tests for MetricsUpdateTask, making it easier to debug and verify its functionality when stuff gets changed.

  • The count of audited and suppressed findings was off, as their queries still included project == null expressions. Probably leftovers from the global component model before v4.
  • The count of audited findings was off, because it didn't account for suppressed findings. If a finding is suppressed, the overall finding count is reduced as well. Until now however, suppressed findings were considered "audited" as well, which could result in situations where more findings are audited than even exist.
  • The audited/unaudited counts of policy violations were off, because the count of audited violations was never populated.
  • Suppressed policy violations were not reflected in the metrics.

This PR also includes #1526.

Fixes DependencyTrack#1525

Signed-off-by: nscuro <nscuro@protonmail.com>
* The count of audited and suppressed findings was off, as their queries still included `project == null` expressions. Probably leftovers from the global component model before v4.
* The count of audited findings was off, because it didn't account for suppressed findings. If a finding is suppressed, the overall finding count is reduced as well. Until now however, suppressed findings were considered "audited" as well, which could result in situations where more findings are audited than even exist.
* The audited/unaudited counts of policy violations were off, because the count of audited violations was never populated.
* Suppressed policy violations were not reflected in the metrics.

Signed-off-by: nscuro <nscuro@protonmail.com>
@nscuro nscuro changed the title Add tests for MetricsUpdateTask and squash some bug along the way Add tests for MetricsUpdateTask and squash some bugs along the way Apr 10, 2022
@nscuro
Copy link
Member Author

nscuro commented Apr 10, 2022

Note that some of these bugs were not visible in the dashboard, and in consequence neither to most users.

For example, the wrong suppression count for component metrics did not lead to overall wrong suppression counts, because suppressions are queried again on the project level. So the sum on the dashboard would still be accurate, but for component metrics fetched via the API, it wasn't.

Also, per-type audited/unaudited counts of policy violations aren't displayed anywhere in the UI yet.

@stevespringett stevespringett added this to the 4.5 milestone Apr 10, 2022
@stevespringett
Copy link
Member

Huge thanks for the PR

@stevespringett stevespringett merged commit f3af574 into DependencyTrack:master Apr 10, 2022
@nscuro nscuro deleted the metrics-update-tests branch April 11, 2022 09:14
@github-actions github-actions bot locked as resolved and limited conversation to collaborators May 11, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants