Skip to content

fix: read triage metrics from metadata paths - #6288

Merged
jess-lowe merged 4 commits into
google:masterfrom
darshpatel1052:fix/6211-triage-metrics
Nov 6, 2026
Merged

jess-lowe merged 4 commits into
google:masterfrom
darshpatel1052:fix/6211-triage-metrics

Conversation

@darshpatel1052

@darshpatel1052 darshpatel1052 commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

PR title: fix: read triage metrics from metadata paths

Overview

The triage page still requests CVE conversion metrics from their old locations, so it cannot display metrics stored under metadata/. Update the NVD and CVE5 metrics paths for both test and production buckets.

Closes #6211

Details

  • Read NVD metrics from metadata/nvd/metrics/<CVE-ID>.metrics.json.
  • Read CVE5 metrics from metadata/cve5/metrics/<CVE-ID>.metrics.json.
  • Keep the existing test and production bucket selection and non-metrics record paths.
  • Preserve missing-object handling without adding a legacy-path fallback, as confirmed in the issue discussion.
  • Add HTTP-backed storage regression tests covering all ten GCS sources, successful and missing reads, and lowercase CVE ID normalization.

No breaking changes or new dependencies.

AI assistance: OpenAI Codex (GPT-6.1 Sol, High reasoning effort) assisted with tests and verification.

Testing

Run from go/ unless noted otherwise:

  • Before the fix: go test ./internal/gcs -run TestTriageStore_GetFile_GCS -count=1 -v failed on the four metrics sources because they requested the old object paths; all six non-metrics sources passed.
  • After the fix: go test ./internal/gcs ./internal/website -count=1 passed, including all 20 new storage read cases and the existing triage HTTP endpoint tests.
  • go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 run ./internal/gcs passed with zero issues.
  • go build -o /tmp/osv-6211-website ./cmd/website passed.
  • Go formatting and git diff --check passed.

Storage reads were verified using a local HTTP test server and the real GCS client. Live test/production bucket access and the full monorepo test suite were not exercised.

@G-Rath

G-Rath commented Nov 3, 2026

Copy link
Copy Markdown
Collaborator

Please read our contributing guide before opening pull requests

@G-Rath G-Rath closed this Nov 3, 2026
@G-Rath

G-Rath commented Nov 3, 2026

Copy link
Copy Markdown
Collaborator

Whoops apologies, this is assigned to you! (That's what I get for reading my notifications backwards 🙃)

@G-Rath G-Rath reopened this Nov 3, 2026
@darshpatel1052

Copy link
Copy Markdown
Contributor Author

Whoops apologies, this is assigned to you! (That's what I get for reading my notifications backwards 🙃)

Haha, totally understandable!

@jess-lowe jess-lowe left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great. One small nit on the test :)

Comment thread go/internal/gcs/triage_test.go Outdated
t.Parallel()

const content = `{"id":"CVE-2024-1234"}`
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: Currently this spins up a new httptest.NewServer and storage.Client 20 times inside the inner subtest loop. We could lift the server and client creation to the top of TestTriageStore_GetFile_GCS so all subtests share a single client and mock server.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, Jess! Updated in the latest commit, all subtests now share a single mock server and storage client.

@jess-lowe

Copy link
Copy Markdown
Contributor

/gcbrun

@jess-lowe

Copy link
Copy Markdown
Contributor

/gcbrun

@jess-lowe
jess-lowe merged commit 4f02d37 into google:master Nov 6, 2026
23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

make triage page metrics look at the new metrics location

3 participants