Skip to content

ROX-33655: Query changes for enhanced filters#19881

Open
ksurabhi91 wants to merge 2 commits intomasterfrom
query_enhanced_filters
Open

ROX-33655: Query changes for enhanced filters#19881
ksurabhi91 wants to merge 2 commits intomasterfrom
query_enhanced_filters

Conversation

@ksurabhi91
Copy link
Copy Markdown
Contributor

@ksurabhi91 ksurabhi91 commented Apr 7, 2026

This PR is part 1 of ROX-33655 that updates the query builder to use the new entityScope method combined with a query string containing enhanced filters for building report data queries. When a user selects entity scope for scoping reports, the new path is used; when a user selects a collection as the scoping method, report generation continues to work as previously implemented with legacy filters and collections.
There will be follow up PRs for scheduler changes and benchmark test

Testing and quality

Added integration tests and unit tests

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

change me!

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Apr 7, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 7, 2026

🚀 Build Images Ready

Images are ready for commit 64893a1. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.11.x-609-g64893a10df

@ksurabhi91 ksurabhi91 force-pushed the query_enhanced_filters branch 3 times, most recently from dd7d511 to 75378cb Compare April 7, 2026 23:46
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 7, 2026

Codecov Report

❌ Patch coverage is 75.78125% with 31 lines in your changes missing coverage. Please review.
✅ Project coverage is 49.58%. Comparing base (9d35506) to head (64893a1).
⚠️ Report is 6 commits behind head on master.

Files with missing lines Patch % Lines
central/reports/common/query_builder.go 69.00% 31 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master   #19881      +/-   ##
==========================================
- Coverage   49.61%   49.58%   -0.04%     
==========================================
  Files        2765     2764       -1     
  Lines      208541   208466      -75     
==========================================
- Hits       103464   103359     -105     
- Misses      97401    97451      +50     
+ Partials     7676     7656      -20     
Flag Coverage Δ
go-unit-tests 49.58% <75.78%> (-0.04%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ksurabhi91 ksurabhi91 force-pushed the query_enhanced_filters branch 2 times, most recently from 4588ba5 to ce311ef Compare April 8, 2026 23:54
@ksurabhi91 ksurabhi91 changed the title ROX-33655: Query changes for enahnced filters ROX-33655: Query changes for enhanced filters Apr 9, 2026
@ksurabhi91 ksurabhi91 force-pushed the query_enhanced_filters branch 4 times, most recently from d05c96a to e89acd6 Compare April 9, 2026 02:54
@ksurabhi91 ksurabhi91 force-pushed the query_enhanced_filters branch from e89acd6 to b463795 Compare April 9, 2026 14:31
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 9, 2026

📝 Walkthrough

Summary by CodeRabbit

Release Notes

  • New Features

    • Added support for entity-scoped vulnerability reports with filtering by cluster, namespace, deployment names, and labels.
    • Enhanced query construction to support both entity-scope and collection-based filtering for vulnerability reports.
  • Tests

    • Added comprehensive test coverage for entity-scoped query building and filtering scenarios.
  • Bug Fixes

    • Corrected test expectations for image registry filtering.

Walkthrough

The changes add entity-scoped query support to the vulnerability report query builder, allowing reports to be scoped by entity-specific rules (cluster, namespace, deployment) instead of only by resource collections. The builder now accepts an entityScope parameter and translates entity scope rules into search queries, with corresponding test coverage and integration updates.

Changes

Cohort / File(s) Summary
Core Query Builder Logic
central/reports/common/query_builder.go
Added entityScope parameter to NewVulnReportQueryBuilder signature. Modified BuildQuery to construct DeploymentsQuery from either collection query or new buildEntityScopeQuery() function. Updated buildCVEAttributesQuery with branching logic for collection-scoped vs entity-scoped reports. Introduced three new helper functions: buildEntityScopeQuery (translates entity scope rules to search queries), entityScopeRuleToFieldLabel (maps entity/field combinations to query field labels with regex support), and splitLabelValue (parses map-field label key/value pairs). Added error handling for unsupported entity/field combinations.
Query Builder Tests
central/reports/common/query_builder_test.go
Added comprehensive unit test TestBuildEntityScopeQuery with table-driven test cases covering: empty scope, exact matches (namespace/deployment/cluster), combined rules with AND logic, label/annotation map queries, regex matching with r/ prefix, empty value handling, and error scenarios for unsupported entity/field combinations.
Integration Points
central/reports/scheduler/schedule.go, central/reports/scheduler/v2/reportgenerator/report_gen_impl.go
Updated two callers of NewVulnReportQueryBuilder to pass ResourceScope.GetEntityScope() as the new second parameter, enabling entity-scoped query construction in scheduled and snapshot-based report generation.
Integration Test Suite
central/reports/scheduler/v2/reportgenerator/report_gen_impl_flat_data_model_test.go
Renamed TearDownTest() to TearDownSuite() to truncate tables once per suite instead of per test case. Added new integration test TestGetReportDataWithEntityScopeAndQueryFilters validating report data collection across combinations of entity scope rules, vulnerability filters (CVSS/EPSS/fixability/registry), image types, and SAC access scopes.
Test Expectation Updates
central/reports/scheduler/v2/reportgenerator/report_gen_view_based_test.go
Updated expected results in TestGetReportDataViewBased for image registry filtering test case, removing watcher-derived image/component/CVE entries from expectations.
Test Utilities
central/reports/scheduler/v2/reportgenerator/testutils.go
Updated testImage() signature to accept dynamic registry and per-image labels parameters. Modified callers to pass registry (docker.io for deployments, quay.io for watched images) and differentiated labels. Added new helper testEntityScopeReportSnapshot() to construct ReportSnapshot objects with entity scope (leaving collection as nil) for entity-scoped test scenarios.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check ❓ Inconclusive The description covers the key context (part 1 of ROX-33655, entityScope + query string approach, backwards compatibility with collections), mentions added tests, but leaves the testing validation section incomplete with placeholder text. Replace 'change me!' placeholder in 'How I validated my change' section with concrete validation details explaining how the changes were tested and verified to function as expected.
✅ Passed checks (1 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly references the ticket (ROX-33655) and accurately summarizes the main focus on query changes for enhanced filters, which aligns with the core changes in the diff.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch query_enhanced_filters

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
central/reports/scheduler/schedule.go (1)

338-347: ⚠️ Potential issue | 🟠 Major

Entity-scoped reports still hard-depend on a collection here.

Lines 339-345 always fetch rc.GetScopeId() and fail if no collection exists. Because BuildQuery prefers a non-nil collection over entityScope, this means the new entity-scope path is never reached when a collection is still present, and entity-scoped configs without a collection fail before query building.

Suggested fix
 func (s *scheduler) getReportData(ctx context.Context, rc *storage.ReportConfiguration) ([]common.DeployedImagesResult, error) {
-	collection, found, err := s.collectionDatastore.Get(ctx, rc.GetScopeId())
-	if err != nil {
-		return nil, errors.Wrapf(err, "error building report query: unable to get the collection %s", rc.GetScopeId())
-	}
-	if !found {
-		return nil, errors.Errorf("error building report query: collection with id %s not found", rc.GetScopeId())
-	}
+	var (
+		collection *storage.ResourceCollection
+		found      bool
+		err        error
+	)
+	if rc.GetResourceScope().GetEntityScope() == nil {
+		collection, found, err = s.collectionDatastore.Get(ctx, rc.GetScopeId())
+		if err != nil {
+			return nil, errors.Wrapf(err, "error building report query: unable to get the collection %s", rc.GetScopeId())
+		}
+		if !found {
+			return nil, errors.Errorf("error building report query: collection with id %s not found", rc.GetScopeId())
+		}
+	}
 	rQuery, err := s.buildReportQuery(ctx, rc, collection)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@central/reports/scheduler/schedule.go` around lines 338 - 347, getReportData
currently always fetches a collection via
collectionDatastore.Get(rc.GetScopeId()) and errors if not found, which blocks
the entity-scoped path; change getReportData so that when the
ReportConfiguration rc represents an entity-scoped report (check
rc.IsEntityScoped() or the equivalent flag on rc) you do not hard-fail when
collectionDatastore.Get returns !found but instead call s.buildReportQuery(ctx,
rc, nil) (or pass a nil collection) so buildReportQuery can use the entityScope;
only treat missing collection as an error for non-entity-scoped configs and keep
existing error wrapping for real Get errors from collectionDatastore.Get.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@central/reports/common/query_builder.go`:
- Around line 176-200: The current loop builds a single query from
rule.GetValues()[0] and mishandles map fields and mixed match types; instead,
for each rule you must construct a separate proto query for each RuleValue
(using storage.MatchType_REGEX on that RuleValue), taking care for isMapField to
call splitLabelValue on the raw value to get key and value then apply regex
prefix only to the value part if needed (do not prefix the key), collect those
per-value queries, OR them together into one rule-level query (e.g. using
search.NewQueryBuilder().AddOr(...) or equivalent) and then append that single
ORed query to conjuncts so the rule-level queries are ANDed correctly; use
search.NewQueryBuilder().AddMapQuery, AddStrings, AddExactMatches and ProtoQuery
for the per-value builders and splitLabelValue to locate the label key/value.

---

Outside diff comments:
In `@central/reports/scheduler/schedule.go`:
- Around line 338-347: getReportData currently always fetches a collection via
collectionDatastore.Get(rc.GetScopeId()) and errors if not found, which blocks
the entity-scoped path; change getReportData so that when the
ReportConfiguration rc represents an entity-scoped report (check
rc.IsEntityScoped() or the equivalent flag on rc) you do not hard-fail when
collectionDatastore.Get returns !found but instead call s.buildReportQuery(ctx,
rc, nil) (or pass a nil collection) so buildReportQuery can use the entityScope;
only treat missing collection as an error for non-entity-scoped configs and keep
existing error wrapping for real Get errors from collectionDatastore.Get.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 1631a6b2-cb6e-45fd-9715-62fd8073474d

📥 Commits

Reviewing files that changed from the base of the PR and between 8c9e377 and e89acd6.

📒 Files selected for processing (7)
  • central/reports/common/query_builder.go
  • central/reports/common/query_builder_test.go
  • central/reports/scheduler/schedule.go
  • central/reports/scheduler/v2/reportgenerator/report_gen_impl.go
  • central/reports/scheduler/v2/reportgenerator/report_gen_impl_flat_data_model_test.go
  • central/reports/scheduler/v2/reportgenerator/report_gen_view_based_test.go
  • central/reports/scheduler/v2/reportgenerator/testutils.go

@ksurabhi91 ksurabhi91 marked this pull request as ready for review April 9, 2026 18:24
@ksurabhi91 ksurabhi91 requested a review from a team as a code owner April 9, 2026 18:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant