fix: handle missing [workspace.dependencies] in virtual workspace component analysis (#344)

[soul2zimate]

Add null check for workspaceDepsTable in processWorkspaceDependencies to prevent NPE when a virtual workspace Cargo.toml has [workspace] with members but no [workspace.dependencies] section.

Fixes: #344

[qodo-code-review]

Review Summary by Qodo

Handle missing workspace.dependencies section in Cargo virtual workspaces

🐞 Bug fix 🧪 Tests

Walkthroughs

Description

• Add null check for missing [workspace.dependencies] section in virtual workspaces
• Prevent NullPointerException when processing workspace without dependencies table
• Add comprehensive test case with reflection to verify graceful handling

Diagram

flowchart LR
  A["Virtual Workspace Cargo.toml"] -->|"has workspace members"| B["processWorkspaceDependencies"]
  B -->|"workspace.dependencies is null"| C["Null Check Added"]
  C -->|"log and return early"| D["Graceful Exit"]
  C -->|"table exists"| E["Process Dependencies"]

Loading

File Changes

1. src/main/java/io/github/guacsec/trustifyda/providers/CargoProvider.java 🐞 Bug fix +6/-0

Add null check for missing workspace dependencies table

• Add null check for workspaceDepsTable at the start of processWorkspaceDependencies method
• Return early with debug logging if workspace.dependencies section is missing
• Prevents NullPointerException when virtual workspace has members but no dependencies table

src/main/java/io/github/guacsec/trustifyda/providers/CargoProvider.java

---

2. src/test/java/io/github/guacsec/trustifyda/providers/CargoProviderCargoParsingTest.java 🧪 Tests +64/-0

Add test for missing workspace dependencies handling

• Add new test testVirtualWorkspaceWithoutWorkspaceDepsDoesNotThrowNPE to verify graceful handling
• Create test Cargo.toml with [workspace] members but no [workspace.dependencies] section
• Use reflection to invoke private method and verify no NullPointerException is thrown
• Add necessary imports for test infrastructure (PackageURL, Sbom, TomlParseResult, etc.)

src/test/java/io/github/guacsec/trustifyda/providers/CargoProviderCargoParsingTest.java

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0)

1. Reflection-based unit test ☑ 🐞 Bug ⛯ Reliability

Description

testVirtualWorkspaceWithoutWorkspaceDepsDoesNotThrowNPE invokes the private
processWorkspaceDependencies via reflection (setAccessible(true)), which is brittle against
refactors and can fail under stricter JVM/module access rules, causing CI failures unrelated to
functional behavior. It also bypasses the public entrypoints (provideComponent/provideStack),
reducing confidence that the user-facing flow is covered.

Code

src/test/java/io/github/guacsec/trustifyda/providers/CargoProviderCargoParsingTest.java[R763-776]

+    // Call the private processWorkspaceDependencies via reflection
+    var method =
+        CargoProvider.class.getDeclaredMethod(
+            "processWorkspaceDependencies",
+            Sbom.class,
+            PackageURL.class,
+            Map.class,
+            Set.class,
+            TomlParseResult.class);
+    method.setAccessible(true);
+
+    // This should NOT throw NPE when [workspace.dependencies] is absent
+    try {
+      method.invoke(provider, sbom, root, new HashMap<>(), new HashSet<>(), tomlResult);

Evidence

The test uses reflective access to invoke a private method, which is inherently less stable than
testing via public APIs or package-private test seams; the method under test is explicitly declared
private in the production class.

src/test/java/io/github/guacsec/trustifyda/providers/CargoProviderCargoParsingTest.java[763-776]
src/main/java/io/github/guacsec/trustifyda/providers/CargoProvider.java[211-216]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A new unit test uses reflection (`getDeclaredMethod`, `setAccessible(true)`) to call a private method. This makes tests brittle (signature/visibility refactors break at runtime) and can fail under stricter JVM/module access rules.
### Issue Context
The goal is to ensure virtual workspaces without `[workspace.dependencies]` don’t crash. That can still be tested without reflection by introducing a small test seam.
### Fix Focus Areas
- src/main/java/io/github/guacsec/trustifyda/providers/CargoProvider.java[211-216]
- src/test/java/io/github/guacsec/trustifyda/providers/CargoProviderCargoParsingTest.java[763-776]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[ruromero]

Actually Qodo is right. We shouldn't add tests using reflection.

[soul2zimate]

I have added a second commit to avoid the reflection use in test.