Merge branch 'dependency-review' of https://github.com/advanced-security/github-sbom-toolkit into dependency-review

Author: aegilops

src/componentDetection.ts

@@ -34,7 +34,7 @@ export default class ComponentDetection {
   // This is the default entry point for this class.
   // If executablePath is provided, use it directly and skip download.
   async scanAndGetManifests(path: string): Promise<Manifest[] | undefined> {
-    if (!this.componentDetectionPath) {
+    if (!fs.existsSync(this.componentDetectionPath)) {
       await this.downloadLatestRelease();
     }
 
@@ -272,9 +272,7 @@ export default class ComponentDetection {
       if (packageUrlJson.Version) {
         packageUrl += `@${packageUrlJson.Version}`;
       }
-      if (typeof packageUrlJson.Qualifiers === "object"
-        && packageUrlJson.Qualifiers !== null
-        && Object.keys(packageUrlJson.Qualifiers).length > 0) {
+      if (packageUrlJson.Qualifiers && Object.keys(packageUrlJson.Qualifiers).length > 0) {
         const qualifierString = Object.entries(packageUrlJson.Qualifiers)
           .map(([key, value]) => `${key}=${value}`)
           .join("&");

src/sbomCollector.ts

@@ -260,7 +260,7 @@ export class SbomCollector {
             this.decisions[fullName] = `Fetching because error comparing pushed_at (${baseline.repoPushedAt} / ${repo.pushed_at})`;
           }
         } else {
-          this.decisions[fullName] = baseline ? `Fetching because missing pushed_at (${baseline.repoPushedAt} / ${repo.pushed_at})` : "Fetching because no baseline";
+          this.decisions[fullName] = baseline ? `Fetching because of missing pushed_at (${baseline.repoPushedAt} / ${repo.pushed_at})` : "Fetching because no baseline";
         }
 
         let sbom: RepositorySbom | undefined = undefined;
@@ -540,7 +540,7 @@ export class SbomCollector {
             if (ok) {
               console.log(chalk.blue(`Snapshot submission attempted; waiting 3 seconds before retrying dependency review diff for ${org}/${repo} ${base}...${head}...`));
               await new Promise(r => setTimeout(r, 3000));
-              return await this.fetchDependencyReviewDiff(org, repo, base, head, --retries, latestCommit);
+              return await this.fetchDependencyReviewDiff(org, repo, base, head, retries - 1, latestCommit);
             }
           } catch (subErr) {
             console.error(chalk.red(`Snapshot submission failed for ${org}/${repo} branch ${head}: ${(subErr as Error).message}`));