@@ -6,9 +6,10 @@ import (
66 "net/http"
77 "net/url"
88 "strings"
9- "sync"
109 "time"
1110
11+ "github.com/sourcegraph/conc/pool"
12+
1213 "github.com/google/uuid"
1314 "github.com/nais/api/internal/graph/model"
1415 "github.com/nais/api/internal/graph/scalar"
@@ -137,28 +138,24 @@ func (c *Client) VulnerabilitySummary(ctx context.Context, app *AppInstance) (*m
137138}
138139
139140func (c * Client ) GetVulnerabilities (ctx context.Context , apps []* AppInstance ) ([]* model.Vulnerability , error ) {
140- var wg sync.WaitGroup
141141 now := time .Now ()
142-
143142 nodes := make ([]* model.Vulnerability , 0 )
144- for _ , a := range apps {
145- wg .Add (1 )
146- go func (app * AppInstance ) {
147- defer wg .Done ()
148- v , err := c .findingsForApp (ctx , app )
143+ p := pool .New ().WithMaxGoroutines (10 )
144+ for _ , app := range apps {
145+ p .Go (func () {
146+ appVulnNode , err := c .findingsForApp (ctx , app )
149147 if err != nil {
150148 c .log .Errorf ("retrieveFindings for app %q: %v" , app .ID (), err )
151149 return
152150 }
153- if v == nil {
151+ if appVulnNode == nil {
154152 c .log .Debugf ("no findings found in DependencyTrack for app %q" , app .ID ())
155153 return
156154 }
157- nodes = append (nodes , v )
158- }( a )
155+ nodes = append (nodes , appVulnNode )
156+ })
159157 }
160- wg .Wait ()
161-
158+ p .Wait ()
162159 c .log .Debugf ("DependencyTrack fetch: %v\n " , time .Since (now ))
163160 return nodes , nil
164161}
@@ -186,7 +183,7 @@ func (c *Client) findingsForApp(ctx context.Context, app *AppInstance) (*model.V
186183 findingsLink := fmt .Sprintf ("%s/projects/%s/findings" , u , p .Uuid )
187184
188185 v .FindingsLink = findingsLink
189- v .HasBom = p . LastBomImportFormat != ""
186+ v .HasBom = hasBom ( p )
190187
191188 if ! v .HasBom {
192189 c .log .Debugf ("no bom found in DependencyTrack for project %s" , p .Name )
@@ -206,6 +203,13 @@ func (c *Client) findingsForApp(ctx context.Context, app *AppInstance) (*model.V
206203 return v , nil
207204}
208205
206+ // Due to the nature of the DependencyTrack API, the 'LastBomImportFormat' is not reliable to determine if a project has a BOM.
207+ // The 'LastBomImportFormat' can be empty even if the project has a BOM.
208+ // As a fallback, we can check if projects has registered any components, then we assume that if a project has components, it has a BOM.
209+ func hasBom (p * dependencytrack.Project ) bool {
210+ return p .LastBomImportFormat != "" || p .Metrics != nil && p .Metrics .Components > 0
211+ }
212+
209213func (c * Client ) retrieveFindings (ctx context.Context , uuid string ) ([]* dependencytrack.Finding , error ) {
210214 findings , err := c .client .GetFindings (ctx , uuid )
211215 if err != nil {
0 commit comments