feat(ci-failures): enrich scan-failure issue bodies with parsed grype/trivy findings

[itsmiso-ai]

Enriches scan-failure issue bodies with a structured markdown table of parsed grype/trivy findings.

Fixes #994

Opened by foreman on review GO (workload wl-misospace-dispatch-994).

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — primary route

Review: PR PR 995 — Enrich scan-failure issue bodies with parsed grype/trivy findings

Recommendation: Approve.

This PR fully satisfies issue PR 994's acceptance criteria and implements the feature cleanly within the existing ci-failure-ingestion.ts module.

---

Change-by-change findings

src/lib/ci-failure-ingestion.ts (+136 / -2)

• ScanFinding interface — correctly captures package, installed, fixedIn, severity, and optional location fields, matching issue requirements.
• SCAN_COLUMN_ALIASES — maps grype and trivy header variants (name/package, version/installed, fix version/fixed version/fixed in, location/target/file/path) so the parser is robust across scanner output formats.
• splitScanRow — splits on two-or-more-space delimiters, handling space-aligned scanner tables correctly.
• stripLinePrefix — strips GHA wrapper tags ([grype] , [trivy] ) so the parser works on live job log excerpts, not just bare scanner output.
• isSeparatorRow — correctly skips ───────────── separator lines under headers.
• parseScanFindings — walks lines looking for a header row (must have name/package + version/installed columns), then maps each data row. Filters out summary lines like "3 vulnerabilities found" (bare number in package column). Returns [] for non-scan logs, making isScanFailure a simple two-step check.
• isScanFailure — matches on workflow/job name keywords (scan|vuln|trivy|grype|vulnerab|security, case-insensitive), and falls back to log-content detection via parseScanFindings — so unnamed workflows that emit grype output are still caught.
• buildIssueDraft — now calls isScanFailure + parseScanFindings and inserts a markdown table above the raw excerpt. Findings are capped at 50 rows with a "showing first 50" annotation when truncated, addressing the hard issue-body size limit.
• No changes to computeFailureSignature or the close/recovery path, as required.

src/lib/ci-failure-ingestion.test.ts (+142 / -0)

• Real grype log fixture including the [grype] NAME VERSION FIX VERSION ... header with box-drawing separators, embedded in a full GHA log with exit-code lines — reproduces the elixir-gate scenario from the issue.
• Tests verify all four ScanFinding fields including optional location.
• Trivy-style table with TARGET column confirms the column-aliasing logic.
• isScanFailure tests cover: named scan workflows, log-content detection, and non-scan negatives.
• buildIssueDraft tests verify table ordering (findings before raw excerpt), raw excerpt preservation, non-scan unchanged, and the 50-row cap behavior.

---

Standards Compliance

Per AGENTS.md conventions, this change:

• ✅ Adds no agent-specific names in generic docs/code (parseScanFindings, ScanFinding, isScanFailure are generic)
• ✅ Validates inputs before processing (parseScanFindings returns [] for empty/null log)
• ✅ Uses appropriate TypeScript types (ScanFinding interface, column aliasing, null checks)
• ✅ No secrets committed; only source code and tests modified

---

Linked Issue Fit

Issue PR 994 acceptance criteria are fully addressed:

Criterion	Status
Scan-gate failure body contains findings table with package, installed, fixed-in, severity, location	✅ Parsed and rendered
Non-scan failures unchanged	✅ Tested explicitly
Unit test with real grype fixture	✅ grypeLog fixture with authentic output
No change to computeFailureSignature (dedup)	✅ Not touched
No change to recovery-close path	✅ Not touched

---

CI Results

All checks passed: Lint, Typecheck, Tests, Build, Docker Build, npm audit, Coverage.

---

Unknowns / Needs Verification

None. The diff, tests, and linked issue all provide sufficient evidence that the implementation is correct, complete, and follows repository conventions.