fix(trivy): initialize resource_name for cluster-scoped k8s resources

[Volkiaa]

Description

The kubernetes-report branch of the Trivy parser (ClusterName reports produced by trivy k8s --report all --format json) crashes with an UnboundLocalError when the first entry of the Resources array is a cluster-scoped resource (e.g. ClusterRole, ClusterRoleBinding — no Namespace key). Through /api/v2/import-scan/ this surfaces as an HTTP 500.

Root cause: in the Resources loop of dojo/tools/trivy/parser.py, resource_name is never initialized before the conditional concatenations — unlike the two twin loops just above (Vulnerabilities, Misconfigurations), which both reset service_name = "" on every iteration:

• if the first resource has no Namespace, the if namespace: assignment is skipped and resource_name += f"{kind} / " raises UnboundLocalError;
• if a cluster-scoped resource follows a namespaced one, it silently inherits the previous iteration's value and is imported with a corrupted service name.

The fix initializes resource_name = "" at the top of each iteration, matching the loops above.

Reproduced against a kind cluster with the current published image (defectdojo/defectdojo-django:latest, 2026-07-15):

File "dojo/tools/trivy/parser.py", line 224, in get_findings
    resource_name += f"{kind} / "
    ^^^^^^^^^^^^^
UnboundLocalError: cannot access local variable 'resource_name' where it is not associated with a value

Test results

Added unittests/scans/trivy/kubernetes_cluster_scoped_resources.json — a ClusterName report whose Resources array contains a cluster-scoped resource first (crash case), then a namespaced one, then a second cluster-scoped one (carry-over case) — and test_kubernetes_cluster_scoped_resources in unittests/tools/test_trivy_parser.py asserting the three findings parse with the expected service names (ClusterRole / system:controller:bootstrap-signer, default / Deployment / redis-follower, ClusterRoleBinding / cluster-admin).

Verified: the sample raises UnboundLocalError with the current parser and parses cleanly (3 findings, correct service names) with the fix.

Documentation

No documentation change needed — one-line bugfix, no behavior change for valid inputs.

🤖 Generated with Claude Code