feat(report): add remediation and recommendation details to pipeline summary

[a-oren]

Summary

• Surfaces trusted-content remediations and recommendations in the Tekton task console output
• Previously this data was only available in the saved JSON report file; now it appears inline after the vulnerability counts
• Supports the Lightwell demo (Act 2: build-time guardrail) by showing which vulnerable dependencies have trusted-content replacements

Changes

• docker-image/scripts/trustify-da.sh: Added two new sections to the console summary:
  • Remediations (per source): count + list of dependencies with trustedContent replacements and their CVEs
  • Recommendations (per provider): count + list of dependencies with trusted-content alternatives

Test plan

• Verified jq queries against trustify-dependency-analytics test data (report.json) — correct output with remediations and recommendations
• Verified against trustify-da-java-client test data (analysis-report.json) — handles empty remediations gracefully
• No output produced when no remediations/recommendations exist (empty case)

🤖 Generated with Claude Code

Summary by Sourcery

Surface trusted-content remediation and recommendation details in the Trustify dependency analytics pipeline summary output.

New Features:

• Display per-source remediation counts and lists of dependencies with trusted-content replacements and associated CVEs in the Tekton task console summary.
• Display per-provider recommendation counts and lists of dependencies with trusted-content alternative suggestions in the console summary when available.

[sourcery-ai]

Reviewer's Guide

Adds remediation and recommendation details to the Trustify dependency analytics Tekton console summary, including counts and detailed listings sourced via jq from the JSON report.

File-Level Changes

Change	Details	Files
Extend per-provider/source console summary to include remediation counts and detailed dependency mappings when available.	Compute remediation count from the JSON report and print it alongside existing vulnerability severity counts. When remediations exist, use jq to extract dependencies and transitive dependencies with trustedContent remediations, including original and replacement refs plus associated CVEs, and print them in a formatted list. Ensure output is suppressed when no remediations are present by gating jq listing on the remediation count.	docker-image/scripts/trustify-da.sh
Surface trusted-content recommendations per provider with counts and per-dependency suggestions.	Discover recommendation sources under each provider and print a per-source total recommendation count. When recommendations exist, iterate recommended dependencies and print their refs and recommended replacements in a readable format. Handle absence of recommendations gracefully by defaulting counts to zero and skipping detailed output.	docker-image/scripts/trustify-da.sh

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="docker-image/scripts/trustify-da.sh" line_range="118" />
<code_context>
+              (.issues // [])[] | select(.remediation.trustedContent.ref != null) |
+              {ref: $t.ref, tc: .remediation.trustedContent.ref, cves: ((.cves // [.id]) | join(", "))}
+            ]
+          ] | flatten | unique_by(.ref + .tc) | .[] |
+          "      \(.ref)\n        → \(.tc)\n        CVEs: \(.cves)"
+        ' <<< "$report"
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Avoid potential collisions in `unique_by(.ref + .tc)` by using a composite key.

Concatenating `ref` and `tc` can cause collisions when different `(ref, tc)` pairs produce the same string (e.g. `"ab" + "c"` vs `"a" + "bc"`). Use a composite key instead:

```jq
unique_by({ref, tc})
```

This keeps the intended behavior while ensuring correct deduplication.

```suggestion
          ] | flatten | unique_by({ref, tc}) | .[] |
```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.84%. Comparing base (156bb77) to head (1f2ef75).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #586      +/-   ##
==========================================
- Coverage   91.01%   90.84%   -0.18%     
==========================================
  Files          38       39       +1     
  Lines        8001     8363     +362     
  Branches     1395     1453      +58     
==========================================
+ Hits         7282     7597     +315     
- Misses        719      766      +47     

Flag	Coverage Δ
unit-tests	90.84% <ø> (-0.18%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ruromero]

The second commit correctly fixes word-splitting for source names (while IFS= read -r), but the new code added in the same PR repeats the original anti-pattern:

for rec_source in $rec_sources; do   # ← same word-splitting problem

If recommendation source names contain spaces, this will break the same way. Should use while IFS= read -r rec_source; do ... done <<< "$rec_sources" for consistency.