Bug — RuntimeException crashes entire annotation pass

Wrapping MalformedPackageURLException in RuntimeException inside a stream .filter() means a single malformed PURL in the recommendations list kills the entire annotation pipeline for the file. The same pattern exists in getRecommendation() at line 262.

getHardenedRecommendation() should catch-and-skip (return false or log a warning), not re-throw:

.filter(r -> {
    try {
        return imageRef.getPackageURL().equals(r.getRef().purl());
    } catch (MalformedPackageURLException e) {
        LOG.warn("Skipping recommendation with malformed PURL", e);
        return false;
    }
})

Same fix needed in getRecommendation() (line 262).

[sdlc-workflow/verify-pr] Classified as code change request — addressed in commit 8f58a16 (catch-and-skip MalformedPackageURLException + extracted into shared findMatchingRecommendation() helper). No sub-task created.

Regression — UBI quick-fix now conditional on recommendation lookup succeeding

Before this PR, UBIIntentionAction was always added unconditionally. Now it's gated by recommendation != null (line 470), which depends on the recommendations API call succeeding AND recommendationsEnabled being true.

If the recommendations API is down or the toggle is off, users lose the UBI quick-fix entirely — a regression from the previous behavior where UBI suggestions were always available.

Consider decoupling the UBI quick-fix from the recommendation lookup result.

[sdlc-workflow/verify-pr] Classified as code change request — addressed in commit 8f58a16 (UBIIntentionAction restored as unconditional). No sub-task created.

Design — single toggle gates two independent features

One recommendationsEnabled boolean controls both UBI recommendations (line 446) and hardened image recommendations (line 448). Users may want UBI suggestions without hardened-image suggestions, or vice versa. Consider separate toggles, or at minimum document that this is intentional.

I won't change that now, since I'm removing the UBI recommendations.

Sounds good

[sdlc-workflow/verify-pr] Classified as suggestion — proposes separate toggles for UBI vs hardened recommendations. No matching convention in CONVENTIONS.md; existing codebase uses coarse-grained toggles (e.g., licenseCheckEnabled). Author declined, reviewer accepted. No sub-task created.

Bug — inconsistent withFix() builder pattern drops quick-fix actions

Line 468 correctly reassigns: builder = builder.withFix(...). But lines 470 and 473 call builder.withFix(...) without assigning back. If AnnotationBuilder.withFix() returns a new builder (immutable pattern), the UBI and Hardened quick-fixes are silently discarded.

// Line 468 — correct
builder = builder.withFix(new ImageReportIntentionAction());
// Line 470 — missing assignment
builder.withFix(new UBIIntentionAction());        // ← should be: builder = builder.withFix(...)
// Line 473 — missing assignment  
builder.withFix(new HardenedImageIntentionAction()); // ← same

Note: if withFix() mutates in place (mutable builder), this works by accident but is inconsistent with line 468's style.

[sdlc-workflow/verify-pr] Classified as code change request — addressed in commit 8f58a16 (consistent builder = builder.withFix(...) reassignment). No sub-task created.

Cleanup — redundant guard condition

!hasIssue && !hasIssue(report) is redundant: at the call site (line 443), hasIssue is computed as hasIssue(report), so both operands are always equal. Simplify to just !hasIssue.

[sdlc-workflow/verify-pr] Classified as code change request — addressed in commit 8f58a16 (simplified to !hasIssue). No sub-task created.

Cleanup — duplicated PURL matching logic

getHardenedRecommendation() (lines 287–298) and getRecommendation() (lines 257–268) share nearly identical stream-filter-find logic, differing only in the report accessor (getHardenedImageRecommendation() vs getImageRecommendation()). Consider extracting a shared helper to reduce duplication and ensure bug fixes (like the RuntimeException issue above) are applied consistently.

[sdlc-workflow/verify-pr] Classified as suggestion — proposes extracting shared PURL matching logic. Already addressed in commit 8f58a16 (generic findMatchingRecommendation() helper extracted). No sub-task created.