Show the CVE row only for package vulnerabilities

The rich printer added a CVEs row to every SCA detection, so unmaintained and
license findings - neither of which carries a vulnerability_id - rendered an
empty row. The CVE now comes from the policy-keyed details alongside the first
patched version, so a policy that has no CVE simply does not show the field.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: AradTraub

cycode/cli/printers/rich_printer.py

@@ -87,7 +87,6 @@ def __add_secret_scan_related_rows(details_table: Table, detection: 'Detection')
     def __add_sca_scan_related_rows(details_table: Table, detection: 'Detection') -> None:
         detection_details = detection.detection_details
 
-        details_table.add_row('CVEs', get_detection_clickable_cwe_cve(consts.SCA_SCAN_TYPE, detection))
         details_table.add_row('Package', detection_details.get('package_name'))
         details_table.add_row('Version', detection_details.get('package_version'))
 

cycode/cli/printers/utils/sca_policy_details.py

@@ -3,8 +3,10 @@
 from cycode.cli.consts import (
     LICENSE_COMPLIANCE_POLICY_ID,
     PACKAGE_VULNERABILITY_POLICY_ID,
+    SCA_SCAN_TYPE,
     UNMAINTAINED_PACKAGE_POLICY_ID,
 )
+from cycode.cli.printers.utils.detection_data import get_detection_clickable_cwe_cve
 from cycode.cli.printers.utils.sca_ossf import get_maintained_score, get_ossf_report_url, get_ossf_score
 
 if TYPE_CHECKING:
@@ -15,7 +17,10 @@
 
 def _package_vulnerability_details(detection: 'Detection') -> list[tuple[str, str]]:
     alert = detection.detection_details.get('alert') or {}
-    return [('First patched version', alert.get('first_patched_version') or 'Not fixed')]
+    return [
+        ('CVEs', get_detection_clickable_cwe_cve(SCA_SCAN_TYPE, detection) or _NOT_AVAILABLE),
+        ('First patched version', alert.get('first_patched_version') or 'Not fixed'),
+    ]
 
 
 def _license_compliance_details(detection: 'Detection') -> list[tuple[str, str]]:

tests/cli/printers/utils/test_sca_policy_details.py

@@ -18,16 +18,26 @@ def _make_detection(policy_id: str, **details: object) -> Detection:
     )
 
 
-def test_package_vulnerability_reports_the_patched_version() -> None:
-    detection = _make_detection(PACKAGE_VULNERABILITY_POLICY_ID, alert={'first_patched_version': '4.17.21'})
+def test_package_vulnerability_reports_the_cve_and_the_patched_version() -> None:
+    detection = _make_detection(
+        PACKAGE_VULNERABILITY_POLICY_ID,
+        alert={'first_patched_version': '4.17.21'},
+        vulnerability_id='CVE-2021-23337',
+    )
 
-    assert get_sca_policy_details(detection) == [('First patched version', '4.17.21')]
+    assert get_sca_policy_details(detection) == [
+        ('CVEs', '[link=https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23337]CVE-2021-23337[/]'),
+        ('First patched version', '4.17.21'),
+    ]
 
 
-def test_package_vulnerability_without_a_patch() -> None:
+def test_package_vulnerability_without_a_patch_or_a_cve() -> None:
     detection = _make_detection(PACKAGE_VULNERABILITY_POLICY_ID, alert={'first_patched_version': None})
 
-    assert get_sca_policy_details(detection) == [('First patched version', 'Not fixed')]
+    assert get_sca_policy_details(detection) == [
+        ('CVEs', 'N/A'),
+        ('First patched version', 'Not fixed'),
+    ]
 
 
 def test_license_compliance_reports_the_license() -> None:
@@ -69,6 +79,19 @@ def test_unmaintained_package_without_a_scorecard() -> None:
     ]
 
 
+def test_only_package_vulnerability_reports_a_cve() -> None:
+    """A CVE belongs to the vulnerability policy alone.
+
+    It used to be rendered for every SCA detection, so an unmaintained or license finding - neither of which
+    carries a vulnerability_id - showed an empty CVEs row.
+    """
+    for policy_id in (LICENSE_COMPLIANCE_POLICY_ID, UNMAINTAINED_PACKAGE_POLICY_ID):
+        detection = _make_detection(policy_id, vulnerability_id='CVE-2021-23337')
+
+        labels = [label for label, _ in get_sca_policy_details(detection)]
+        assert 'CVEs' not in labels
+
+
 def test_an_unregistered_policy_contributes_nothing() -> None:
     """A policy with no entry must stay silent rather than borrow another policy's fields.