feat: add suppression provenance fields to IgnoreRule (#357)

[Shreya2005-2005]

Overview

IgnoreRule had only 3 fields (Vulnerability, FixState, Package),
with no way to record why or by what a vulnerability was suppressed.

kubevuln's recently-merged suppression-provenance system (kubevuln#488,
merged as kubevuln#495) already builds a real record of this -which
SecurityException matched, its scope, and its stated justification -but
that PR's own code comment confirms it can only log this, never store it,
because IgnoreRule has no fields for it.

This also affects the External VEX Ingestion project (kubevuln#387),
whose deliverables explicitly require "recording which document/statement
caused each suppression" - the same missing capability, for VEX
statements instead of SecurityExceptions.

Before / After

Before:

rule := IgnoreRule{
	Vulnerability: "CVE-2021-44228",
	SourceKind:    "SecurityException",
}

unknown field SourceKind in struct literal of type IgnoreRule

After: the same code compiles, and the field round-trips correctly
through both JSON and DeepCopy.

Changes

Add generic, reusable provenance fields to IgnoreRule, in both the
internal and v1beta1 versions:

SourceKind      string // e.g. "SecurityException"
SourceName      string
SourceNamespace string
Justification   string
ImpactStatement string

No deepcopy regeneration needed - the generated DeepCopyInto does a
full value copy (*out = *in) before handling the one pointer field
(Package), so it already covers these new plain string fields
correctly. Verified with a test.

Testing

pkg/apis/softwarecomposition/v1beta1/grype_types_test.go (new):
confirms the new fields survive a JSON round-trip, and confirms
DeepCopy correctly copies them without aliasing the original.

Full repo build and go test ./... pass with no failures.

Follow-up

Once this is merged and released, a follow-up PR in kubevuln will wire
buildSuppressionAttributes/logSuppression (from #495) to actually
populate these new fields on IgnoreRule, instead of only logging them —
closing the gap that PR's own comment flagged.

Related issues/PRs:

• Resolved IgnoreRule has no fields to record suppression provenance (source, justification) #357

Checklist before requesting a review

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• New and existing unit tests pass locally with my changes

<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit

- **New Features**
  - Ignore rules now capture their source identity, including kind, name, and namespace.
  - Added optional VEX-related rationale details, including justification and impact statements.
  - These details are available across supported API versions.

- **Bug Fixes**
  - Improved preservation of ignore rule metadata when data is serialized, restored, or duplicated.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6d2b28f5-cb0c-4aa5-9e85-f3c5b53755a6

📥 Commits

Reviewing files that changed from the base of the PR and between e003b62 and 0da7875.

⛔ Files ignored due to path filters (2)

• pkg/apis/softwarecomposition/v1beta1/generated.pb.go is excluded by !**/*.pb.go
• pkg/generated/openapi/zz_generated.openapi.go is excluded by !**/generated/**

📒 Files selected for processing (2)

• pkg/apis/softwarecomposition/v1beta1/grype_types_test.go
• pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go

---

📝 Walkthrough

Walkthrough

IgnoreRule now records suppression source identity and VEX rationale in both API versions. Conversion functions preserve the fields, and tests verify JSON, protobuf, and deep-copy behavior.

Changes

IgnoreRule provenance

Layer / File(s)	Summary
Provenance contract and validation pkg/apis/softwarecomposition/grype_types.go, pkg/apis/softwarecomposition/v1beta1/grype_types.go, pkg/apis/softwarecomposition/v1beta1/grype_types_test.go	IgnoreRule adds source identity, justification, and impact statement fields. Tests verify JSON and protobuf round-tripping, deep-copy equality, and clone independence.
Provenance conversion pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go	Bidirectional conversion preserves the new source metadata and rationale fields.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: matthyx

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The five provenance fields and conversion tests are present, but generated protobuf and OpenAPI files were excluded from review.	Review the excluded generated protobuf and OpenAPI files, and confirm ApplyConfiguration includes all five fields.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the addition of suppression provenance fields to IgnoreRule.
Out of Scope Changes check	✅ Passed	The changes add the requested IgnoreRule fields, conversion support, and focused round-trip tests; no unrelated code changes are shown.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/apis/softwarecomposition/v1beta1/grype_types.go`:
- Around line 101-107: Regenerate the protobuf bindings for the type containing
SourceKind, SourceName, SourceNamespace, Justification, and ImpactStatement so
generated.pb.go marshals and unmarshals protobuf fields 4–8. Add a round-trip
test covering all five fields and verify their values are preserved.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 402ec1a4-496e-4b12-b38b-42b13cff2c5f

📥 Commits

Reviewing files that changed from the base of the PR and between c63a75b and e003b62.

📒 Files selected for processing (3)

• pkg/apis/softwarecomposition/grype_types.go
• pkg/apis/softwarecomposition/v1beta1/grype_types.go
• pkg/apis/softwarecomposition/v1beta1/grype_types_test.go

[matthyx]

Code Review Summary

There is a blocker before this PR is ready to merge:

Blocker: Generated Code Out-of-Sync (Protobuf & API Conversion)

1. Protobuf serialization ():
   only marshals fields 1-3 (, , ). Protobuf serialization/deserialization currently drops fields 4–8 (, , , , ). , , , and in must be updated for fields 4–8.

2. API conversion & OpenAPI specs (, ):
   Running Generating deepcopy code for 2 targets
   Generating defaulter code for 1 targets
   Generating conversion code for 2 targets
   Generating openapi code for 1 targets
   Generating applyconfig code for 1 targets
   Generating client code for 1 targets
   Generating lister code for 1 targets
   Generating informer code for 1 targets is required to generate conversion functions ( & ) for fields 4–8, as well as updating OpenAPI schema and ApplyConfiguration.

3. Protobuf test coverage ():
   A protobuf round-trip test covering all 5 new fields should be added to to ensure wire compatibility.

[Shreya2005-2005]

@matthyx all 3 addressed:

1. Protobuf (fields 4-8) go-to-protobuf couldn't run here (read-only
   module cache), so I hand-extended generated.pb.go for
   Marshal/Size/Unmarshal, matching the existing pattern exactly.
   Added TestIgnoreRuleProtobufRoundTrip proving all 8 fields survive a
   real binary encode/decode.

2. Conversion & OpenAPI ran hack/update-codegen.sh;
   zz_generated.conversion.go now converts all 5 fields both ways.
   deepcopy needed no change (already a full value copy). gen_openapi
   hit the same module-cache issue, so I hand-extended
   zz_generated.openapi.go too, matching the existing schema.

3. Protobuf test done, see above.

Full build + go test ./... pass, no failures.

[matthyx]

LGTM! All 3 issues (protobuf codec, conversion & openapi codegen, and protobuf round-trip tests) have been fully addressed and verified.