CM-71730: Key SCA detail rows by policy instead of chaining conditions

The printers picked their rows from an if/elif chain over has_alert, which is
only a guess at the policy and has to grow a branch for every new one. It had
already gone wrong once: unmaintained packages have no alert, so they fell to
the license branch and rendered an empty License row.

Each policy now contributes its own labelled fields from one map that both
printers render, and a policy with no entry contributes nothing rather than
borrowing another's fields.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: AradTraub

cycode/cli/printers/rich_printer.py

@@ -16,7 +16,7 @@
 )
 from cycode.cli.printers.utils.detection_ordering.common_ordering import sort_and_group_detections_from_scan_result
 from cycode.cli.printers.utils.rich_helpers import get_columns_in_1_to_3_ratio, get_markdown_panel, get_panel
-from cycode.cli.printers.utils.sca_ossf import get_maintained_score, get_ossf_report_url, get_ossf_score
+from cycode.cli.printers.utils.sca_policy_details import get_sca_policy_details
 
 if TYPE_CHECKING:
     from cycode.cli.models import CliError, Detection, Document, LocalScanResult
@@ -91,21 +91,11 @@ def __add_sca_scan_related_rows(details_table: Table, detection: 'Detection') ->
         details_table.add_row('Package', detection_details.get('package_name'))
         details_table.add_row('Version', detection_details.get('package_version'))
 
-        if detection.has_alert:
-            patched_version = detection_details['alert'].get('first_patched_version')
-            details_table.add_row('First patched version', patched_version or 'Not fixed')
-
         dependency_path = detection_details.get('dependency_paths')
         details_table.add_row('Dependency path', dependency_path or 'N/A')
 
-        if detection.detection_type_id == consts.UNMAINTAINED_PACKAGE_POLICY_ID:
-            maintained_score = get_maintained_score(detection_details)
-            ossf_score = get_ossf_score(detection_details)
-            details_table.add_row('Maintained score', 'N/A' if maintained_score is None else str(maintained_score))
-            details_table.add_row('OSSF Scorecard score', 'N/A' if ossf_score is None else str(ossf_score))
-            details_table.add_row('Scorecard report', get_ossf_report_url(detection_details) or 'N/A')
-        elif not detection.has_alert:
-            details_table.add_row('License', detection_details.get('license'))
+        for label, value in get_sca_policy_details(detection):
+            details_table.add_row(label, value)
 
     @staticmethod
     def __add_iac_scan_related_rows(details_table: Table, detection: 'Detection') -> None:

cycode/cli/printers/text_printer.py

@@ -7,7 +7,7 @@
 from cycode.cli.printers.utils.code_snippet_syntax import get_code_snippet_syntax, get_detection_line
 from cycode.cli.printers.utils.detection_data import get_detection_title
 from cycode.cli.printers.utils.detection_ordering.common_ordering import sort_and_group_detections_from_scan_result
-from cycode.cli.printers.utils.sca_ossf import get_maintained_score, get_ossf_report_url, get_ossf_score
+from cycode.cli.printers.utils.sca_policy_details import get_sca_policy_details
 
 if TYPE_CHECKING:
     from cycode.cli.models import Detection, LocalScanResult
@@ -83,28 +83,7 @@ def __get_intermediate_summary_lines(self, detection: 'Detection') -> list[str]:
 
     @staticmethod
     def __get_sca_related_summary_lines(detection: 'Detection') -> list[str]:
-        summary_lines = []
-
-        if detection.detection_type_id == consts.UNMAINTAINED_PACKAGE_POLICY_ID:
-            maintained_score = get_maintained_score(detection.detection_details)
-            ossf_score = get_ossf_score(detection.detection_details)
-            maintained = 'N/A' if maintained_score is None else maintained_score
-            score = 'N/A' if ossf_score is None else ossf_score
-            report_url = get_ossf_report_url(detection.detection_details) or 'N/A'
-
-            summary_lines.append(f'Maintained score: [cyan]{maintained}[/]\n')
-            summary_lines.append(f'OSSF Scorecard score: [cyan]{score}[/]\n')
-            summary_lines.append(f'Scorecard report: [cyan]{report_url}[/]\n')
-        elif detection.has_alert:
-            patched_version = detection.detection_details['alert'].get('first_patched_version')
-            patched_version = patched_version or 'Not fixed'
-
-            summary_lines.append(f'First patched version: [cyan]{patched_version}[/]\n')
-        else:
-            package_license = detection.detection_details.get('license', 'N/A')
-            summary_lines.append(f'License: [cyan]{package_license}[/]\n')
-
-        return summary_lines
+        return [f'{label}: [cyan]{value}[/]\n' for label, value in get_sca_policy_details(detection)]
 
     def __print_detection_code_segment(self, detection: 'Detection', document: Document) -> None:
         self.console.print(

cycode/cli/printers/utils/sca_policy_details.py

@@ -0,0 +1,52 @@
+from typing import TYPE_CHECKING, Callable
+
+from cycode.cli.consts import (
+    LICENSE_COMPLIANCE_POLICY_ID,
+    PACKAGE_VULNERABILITY_POLICY_ID,
+    UNMAINTAINED_PACKAGE_POLICY_ID,
+)
+from cycode.cli.printers.utils.sca_ossf import get_maintained_score, get_ossf_report_url, get_ossf_score
+
+if TYPE_CHECKING:
+    from cycode.cyclient.models import Detection
+
+_NOT_AVAILABLE = 'N/A'
+
+
+def _package_vulnerability_details(detection: 'Detection') -> list[tuple[str, str]]:
+    alert = detection.detection_details.get('alert') or {}
+    return [('First patched version', alert.get('first_patched_version') or 'Not fixed')]
+
+
+def _license_compliance_details(detection: 'Detection') -> list[tuple[str, str]]:
+    return [('License', detection.detection_details.get('license') or _NOT_AVAILABLE)]
+
+
+def _unmaintained_package_details(detection: 'Detection') -> list[tuple[str, str]]:
+    detection_details = detection.detection_details
+    maintained_score = get_maintained_score(detection_details)
+    ossf_score = get_ossf_score(detection_details)
+
+    return [
+        ('Maintained score', _NOT_AVAILABLE if maintained_score is None else str(maintained_score)),
+        ('OSSF Scorecard score', _NOT_AVAILABLE if ossf_score is None else str(ossf_score)),
+        ('Scorecard report', get_ossf_report_url(detection_details) or _NOT_AVAILABLE),
+    ]
+
+
+_DETAILS_BY_POLICY: dict[str, Callable[['Detection'], list[tuple[str, str]]]] = {
+    PACKAGE_VULNERABILITY_POLICY_ID: _package_vulnerability_details,
+    LICENSE_COMPLIANCE_POLICY_ID: _license_compliance_details,
+    UNMAINTAINED_PACKAGE_POLICY_ID: _unmaintained_package_details,
+}
+
+
+def get_sca_policy_details(detection: 'Detection') -> list[tuple[str, str]]:
+    """Labelled fields specific to the SCA policy that raised the detection, in display order.
+
+    A policy with no entry contributes nothing rather than borrowing another policy's fields, so a new one shows
+    no details until it is added here.
+    """
+    build_details = _DETAILS_BY_POLICY.get(detection.detection_type_id)
+
+    return build_details(detection) if build_details else []

tests/cli/printers/utils/test_sca_policy_details.py

@@ -0,0 +1,80 @@
+from cycode.cli.consts import (
+    LICENSE_COMPLIANCE_POLICY_ID,
+    PACKAGE_VULNERABILITY_POLICY_ID,
+    UNMAINTAINED_PACKAGE_POLICY_ID,
+)
+from cycode.cli.printers.utils.sca_policy_details import get_sca_policy_details
+from cycode.cyclient.models import Detection
+
+
+def _make_detection(policy_id: str, **details: object) -> Detection:
+    return Detection(
+        detection_type_id=policy_id,
+        type='sca',
+        message='message',
+        detection_details=dict(details),
+        detection_rule_id='rule-id',
+        severity='Medium',
+    )
+
+
+def test_package_vulnerability_reports_the_patched_version() -> None:
+    detection = _make_detection(PACKAGE_VULNERABILITY_POLICY_ID, alert={'first_patched_version': '4.17.21'})
+
+    assert get_sca_policy_details(detection) == [('First patched version', '4.17.21')]
+
+
+def test_package_vulnerability_without_a_patch() -> None:
+    detection = _make_detection(PACKAGE_VULNERABILITY_POLICY_ID, alert={'first_patched_version': None})
+
+    assert get_sca_policy_details(detection) == [('First patched version', 'Not fixed')]
+
+
+def test_license_compliance_reports_the_license() -> None:
+    detection = _make_detection(LICENSE_COMPLIANCE_POLICY_ID, license='GPL-3.0')
+
+    assert get_sca_policy_details(detection) == [('License', 'GPL-3.0')]
+
+
+def test_license_compliance_without_a_license() -> None:
+    detection = _make_detection(LICENSE_COMPLIANCE_POLICY_ID)
+
+    assert get_sca_policy_details(detection) == [('License', 'N/A')]
+
+
+def test_unmaintained_package_reports_the_maintained_check_first() -> None:
+    detection = _make_detection(
+        UNMAINTAINED_PACKAGE_POLICY_ID,
+        ossf={
+            'score': 4.1,
+            'scorecard_report_url': 'https://scorecard.dev/viewer/?uri=github.com/a/b',
+            'checks': [{'name': 'Maintained', 'score': 0}],
+        },
+    )
+
+    assert get_sca_policy_details(detection) == [
+        ('Maintained score', '0'),
+        ('OSSF Scorecard score', '4.1'),
+        ('Scorecard report', 'https://scorecard.dev/viewer/?uri=github.com/a/b'),
+    ]
+
+
+def test_unmaintained_package_without_a_scorecard() -> None:
+    detection = _make_detection(UNMAINTAINED_PACKAGE_POLICY_ID)
+
+    assert get_sca_policy_details(detection) == [
+        ('Maintained score', 'N/A'),
+        ('OSSF Scorecard score', 'N/A'),
+        ('Scorecard report', 'N/A'),
+    ]
+
+
+def test_an_unregistered_policy_contributes_nothing() -> None:
+    """A policy with no entry must stay silent rather than borrow another policy's fields.
+
+    Before this was keyed by policy, an unmaintained detection fell through to the license branch and rendered
+    an empty License row. A fourth policy would do the same.
+    """
+    detection = _make_detection('00000000-0000-0000-0000-000000000000', license='GPL-3.0', alert={})
+
+    assert get_sca_policy_details(detection) == []