dennisdoomen / packageguard / 32662905250

81%

Build Type

push

github

Committed by web-flow

Commit Message

Make the risk cache expire, refresh, and be keyed by repository (#242)

* Make the risk cache expire and refresh as intended

The --risk-cache-max-age setting did not do what it says, in both directions.

CacheUpdatedAt was only stamped on entries that had none, so an entry kept the
moment it was first written for good. Once past the maximum age it stayed past
it, which made every later run refetch the metadata of every package. Entries
are now stamped when they are written or refreshed, and keep their timestamp
when they are reused, so they expire on schedule and go fresh again afterwards.

At the same time the risk signals never refreshed at all. HasGitHubRiskData and
HasOsvRiskData are persisted, and the enrichers skip a package that carries
them, so an expired entry kept the signals it was written with. Expiring an
entry now clears them, which is what makes the enrichers collect them again.

The refetch was also thrown away. Merging a freshly fetched package into a
cached entry only carried the source, repository URL, and license across, so
the values that actually go out of date for a fixed package version -- the
latest version it lags behind, its download count, its deprecation status --
stayed at what they were when the entry was first written. An expired entry now
drops those before the merge refills them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Cache a repository's risk profile by repository

The profile of a GitHub repository was stored on every package that came out of
it. Dozens of packages can share one repository, so the same fifty fields were
written to cache.bin dozens of times, and whether the profile was collected
again depended on the freshness of individual packages rather than of the
repository.

The profile is now keyed by the repository's API root and persisted next to the
package cache, with its own maximum age. One package going stale no longer
forces a repository to be described again, one repository is desc... (continued)

Coverage Stats

1959 of 2704 branches covered (72.45%)

Branch coverage included in aggregate %.

202 of 215 new or added lines in 8 files covered. (93.95%)

113 existing lines in 3 files now uncovered.

6241 of 7454 relevant lines covered (83.73%)

1700.27 hits per line