fix: handle missing OS field in Trivy report

[robert-cronin]

Fixes panic when parsing Trivy reports that don't include ImageConfig history data. Added nil check before accessing History field to prevent segmentation violation.

Closes #1352

[Copilot]

Pull Request Overview

This PR fixes a nil pointer dereference panic that occurs when parsing Trivy vulnerability reports that lack ImageConfig.History data. The fix adds defensive nil checks before accessing the History and OS fields.

Key changes:

• Added nil check for ImageConfig.History before extracting Node.js and Yarn versions
• Added nil check for Metadata.OS before accessing OS family and name
• Added test case with corresponding test data to verify graceful handling of reports without history

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
pkg/report/trivy.go	Added nil checks for ImageConfig.History and Metadata.OS fields to prevent panics
pkg/report/trivy_test.go	Added test case to verify parser handles reports without ImageConfig.History
pkg/report/testdata/trivy_no_history.json	Added test data representing a Trivy report without ImageConfig.History field

[robert-cronin]

Run after fix:

❯ export IMAGE=quay.io/prometheus/alertmanager:v0.28.1
❯ trivy image --pkg-types os,library --ignore-unfixed -f json -o alertmanager-report.json $IMAGE
2025-10-23T23:25:20Z    INFO    [vuln] Vulnerability scanning is enabled
2025-10-23T23:25:20Z    INFO    [secret] Secret scanning is enabled
2025-10-23T23:25:20Z    INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-10-23T23:25:20Z    INFO    [secret] Please see also https://trivy.dev/v0.60/docs/scanner/secret#recommendation for faster secret detection
2025-10-23T23:25:22Z    INFO    Number of language-specific files       num=2
2025-10-23T23:25:22Z    INFO    [gobinary] Detecting vulnerabilities...
2025-10-23T23:25:22Z    WARN    Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/v0.60/docs/scanner/vulnerability#severity-selection for details.
❯ copa patch -r alertmanager-report.json -i $IMAGE
INFO[0000] Patched image name: quay.io/prometheus/alertmanager:v0.28.1-patched 
Error: no patchable vulnerabilities found in provided report for selected pkg-types (os)

[sozercan]

can you remove family too

[Copilot]

Pull Request Overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

The comment mentions 'safe defaults' but empty strings may not be safe defaults for OS metadata. Consider clarifying whether empty values are intentionally treated as valid or if this represents a degraded state that should be handled differently downstream.

Suggested change

	// Initialize OS metadata with safe defaults
	osType := ""
	osVersion := ""
	// Initialize OS metadata with explicit "unknown" values to indicate missing or degraded state
	const UnknownOSType = "unknown"
	const UnknownOSVersion = "unknown"
	osType := UnknownOSType
	osVersion := UnknownOSVersion

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 39.47%. Comparing base (ff6330d) to head (15f2f99).
⚠️ Report is 5 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/report/trivy.go	80.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1353      +/-   ##
==========================================
+ Coverage   38.19%   39.47%   +1.27%     
==========================================
  Files          42       42              
  Lines        7673     5877    -1796     
==========================================
- Hits         2931     2320     -611     
+ Misses       4546     3361    -1185     
  Partials      196      196              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ashnamehrotra]

LGTM