Create SetOutcome function to handle updating conversion status

Author: jess-lowe

vulnfeeds/conversion/common.go

@@ -243,18 +243,6 @@ func GitVersionsToCommits(versionRanges []*osvschema.Range, repos []string, metr
 		unresolvedRanges = stillUnresolvedRanges
 	}
 
-	if len(newVersionRanges) > 0 {
-		metrics.ResolvedRangesCount += len(newVersionRanges)
-		metrics.Outcome = models.Successful
-	}
-
-	if len(unresolvedRanges) > 0 {
-		metrics.UnresolvedRangesCount += len(unresolvedRanges)
-		if len(newVersionRanges) == 0 {
-			metrics.Outcome = models.NoCommitRanges
-		}
-	}
-
 	return newVersionRanges, unresolvedRanges, successfulRepos
 }
 

vulnfeeds/conversion/nvd/converter.go

@@ -61,7 +61,9 @@ func CVEToOSV(cve models.NVDCVE, repos []string, cache *git.RepoTagsCache, direc
 
 	// Exit early if there are no repositories
 	if len(repos) == 0 {
-		affected := MergeRangesAndCreateAffected(resolvedRanges, unresolvedRanges, nil, nil, metrics)
+		metrics.SetOutcome(models.NoRepos)
+		metrics.UnresolvedRangesCount += len(cpeRanges)
+		affected := MergeRangesAndCreateAffected(resolvedRanges, cpeRanges, nil, nil, metrics)
 		v.Affected = append(v.Affected, affected)
 		// Exit early
 		outputFiles(v, directory, maybeVendorName, maybeProductName, metrics, rejectFailed, outputMetrics)
@@ -72,8 +74,20 @@ func CVEToOSV(cve models.NVDCVE, repos []string, cache *git.RepoTagsCache, direc
 	// If we have ranges, try to resolve them
 	if len(cpeRanges) > 0 {
 		r, un, sR := conversion.GitVersionsToCommits(cpeRanges, repos, metrics, cache)
-		resolvedRanges = append(resolvedRanges, r...)
-		unresolvedRanges = append(unresolvedRanges, un...)
+		if len(r) > 0 {
+			metrics.ResolvedRangesCount += len(r)
+			resolvedRanges = append(resolvedRanges, r...)
+			metrics.SetOutcome(models.Successful)
+		}
+
+		if len(un) > 0 {
+			metrics.UnresolvedRangesCount += len(un)
+			unresolvedRanges = append(unresolvedRanges, un...)
+			if len(r) == 0 {
+				metrics.SetOutcome(models.NoCommitRanges)
+			}
+		}
+
 		for _, s := range sR {
 			successfulRepos[s] = true
 		}
@@ -90,6 +104,7 @@ func CVEToOSV(cve models.NVDCVE, repos []string, cache *git.RepoTagsCache, direc
 		for _, commit := range commits {
 			successfulRepos[commit.Repo] = true
 		}
+		metrics.SetOutcome(models.Successful)
 		metrics.VersionSources = append(metrics.VersionSources, models.VersionSourceRefs)
 	}
 
@@ -100,8 +115,19 @@ func CVEToOSV(cve models.NVDCVE, repos []string, cache *git.RepoTagsCache, direc
 			metrics.AddNote("Extracted versions from description: %v", textRanges)
 		}
 		r, un, sR := conversion.GitVersionsToCommits(textRanges, repos, metrics, cache)
-		resolvedRanges = append(resolvedRanges, r...)
-		unresolvedRanges = append(unresolvedRanges, un...)
+		if len(r) > 0 {
+			metrics.ResolvedRangesCount += len(r)
+			resolvedRanges = append(resolvedRanges, r...)
+			metrics.SetOutcome(models.Successful)
+		}
+
+		if len(un) > 0 {
+			metrics.UnresolvedRangesCount += len(un)
+			unresolvedRanges = append(unresolvedRanges, un...)
+			if len(r) == 0 {
+				metrics.SetOutcome(models.NoCommitRanges)
+			}
+		}
 		for _, s := range sR {
 			successfulRepos[s] = true
 		}
@@ -110,13 +136,14 @@ func CVEToOSV(cve models.NVDCVE, repos []string, cache *git.RepoTagsCache, direc
 
 	if len(resolvedRanges) == 0 && len(commits) == 0 {
 		metrics.AddNote("No ranges detected for %q", maybeProductName)
-		metrics.Outcome = models.NoRanges
-	} else {
-		keys := slices.Collect(maps.Keys(successfulRepos))
-		affected := MergeRangesAndCreateAffected(resolvedRanges, unresolvedRanges, commits, keys, metrics)
-		v.Affected = append(v.Affected, affected)
+		metrics.SetOutcome(models.NoRanges)
 	}
 
+	// Use the successful repos for more efficient merging.
+	keys := slices.Collect(maps.Keys(successfulRepos))
+	affected := MergeRangesAndCreateAffected(resolvedRanges, unresolvedRanges, commits, keys, metrics)
+	v.Affected = append(v.Affected, affected)
+
 	if !outputMetrics && rejectFailed && metrics.Outcome != models.Successful {
 		return metrics.Outcome
 	}
@@ -239,7 +266,7 @@ func FindRepos(cve models.NVDCVE, vpRepoCache *cves.VPRepoCache, repoTagsCache *
 	if len(refs) == 0 && len(CPEs) == 0 {
 		metrics.AddNote("Skipping due to lack of CPEs and lack of references")
 		// 100% of these in 2022 were rejected CVEs
-		metrics.Outcome = models.Rejected
+		metrics.SetOutcome(models.Rejected)
 
 		return nil
 	}
@@ -297,7 +324,6 @@ func FindRepos(cve models.NVDCVE, vpRepoCache *cves.VPRepoCache, repoTagsCache *
 	if len(reposForCVE) == 0 {
 		// We have nothing useful to work with, so we'll assume it's out of scope
 		metrics.AddNote("Passing due to lack of viable repository")
-		metrics.Outcome = models.NoRepos
 
 		return nil
 	}
@@ -360,7 +386,6 @@ func MergeRangesAndCreateAffected(resolvedRanges []*osvschema.Range, unresolvedR
 			newResolvedRanges = append(newResolvedRanges, conversion.BuildVersionRange(commit.Introduced, commit.LastAffected, commit.Fixed))
 			metrics.ResolvedRangesCount++
 		}
-		metrics.Outcome = models.Successful
 	}
 
 	newAffected := &osvschema.Affected{

vulnfeeds/models/metrics.go

@@ -59,6 +59,14 @@ func (m *ConversionMetrics) AddNote(format string, a ...any) {
 	logger.Debug(fmt.Sprintf(format, a...), slog.String("cna", m.CNA), slog.String("cve", string(m.CVEID)))
 }
 
+// SetOutcome sets the outcome of the conversion only if it's not already set, or has become successful.
+func (m *ConversionMetrics) SetOutcome(outcome ConversionOutcome) {
+	if m.Outcome != ConversionUnknown || outcome != Successful {
+		return
+	}
+	m.Outcome = outcome
+}
+
 // AddSource appends a source to the ConversionMetrics
 func (m *ConversionMetrics) AddSource(source VersionSource) {
 	m.VersionSources = append(m.VersionSources, source)
@@ -80,15 +88,15 @@ func DetermineOutcome(metrics *ConversionMetrics) {
 	// check if we have affected ranges/versions.
 	if len(metrics.Repos) == 0 {
 		// Fix unlikely, as no repos to resolve
-		metrics.Outcome = NoRepos
+		metrics.SetOutcome(NoRepos)
 		return
 	}
 
 	if metrics.ResolvedRangesCount > 0 {
-		metrics.Outcome = Successful
+		metrics.SetOutcome(Successful)
 	} else if metrics.UnresolvedRangesCount > 0 {
-		metrics.Outcome = NoCommitRanges
+		metrics.SetOutcome(NoCommitRanges)
 	} else {
-		metrics.Outcome = NoRanges
+		metrics.SetOutcome(NoRanges)
 	}
 }