Improve code coverage of submodule parsing

[robramsaynz]

This is a PR to improve coverage for submodule parsing that's already in the system. Specifically func getSubmodules in pkg/osvscanner/osvscanner.go.

This is already covered by a fixture based test in pkg/osvscanner/osvscanner_internal_test.go but while have execution inside getSubmodules, it doesn't actually cover the working parts of getSubmodules.

You can see coverage info by running ./scripts/generate_coverage_report.sh and looking in ./coverage.html#file133.

There are a number of states a submodule can be in:

1. a submodule is setup and checked out
2. a submodule is setup and but dir is empty
3. a submodule is setup and and checked out but dir has local changes
4. a submodule is setup and but dir is set to a different commit

I'm planning to test 1 and 2. I think 3 and 4 are nice to haves, and I plan to only tackle them if they're easy once 1 and 2 are done. Possibly submodules have more possible states, but these seem reasonable for coverage.

I see two implementation options:

• re-use and modify the func Test_scanGit in pkg/osvscanner/osvscanner_internal_test.go
  but with the fixture including a submodule
• re-use and modify the functions that create git repositories from scratch in
  Dont traverse gitignored dirs for gitignore files #797

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.85%. Comparing base (f8953ff) to head (bf25030).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #873      +/-   ##
==========================================
+ Coverage   67.83%   67.85%   +0.02%     
==========================================
  Files         174      174              
  Lines       16769    16769              
==========================================
+ Hits        11375    11379       +4     
+ Misses       4765     4761       -4     
  Partials      629      629              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[robramsaynz]

I've done a bit more poking and managed to create git-repo with submodules that doesn't have a backing github repo, so re-utilising the existing fixture based testing —func Test_scanGit— looks like the best option at this stage.

[github-actions]

This pull request has not had any activity for 60 days and will be automatically closed in two weeks

[github-actions]

Automatically closing stale pull request