github-issue-tower-defence-management 1.148.4 → 1.148.6

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [1.148.6](https://github.com/HiromiShikata/npm-cli-github-issue-tower-defence-management/compare/v1.148.5...v1.148.6) (2026-08-09)
+
+
+### Bug Fixes
+
+* **security-scan:** fix silent scan failures and issue deduplication ([#1479](https://github.com/HiromiShikata/npm-cli-github-issue-tower-defence-management/issues/1479)) ([7cdc714](https://github.com/HiromiShikata/npm-cli-github-issue-tower-defence-management/commit/7cdc7149fe1420bfb4581014220e8b70c6043b34))
+
+## [1.148.5](https://github.com/HiromiShikata/npm-cli-github-issue-tower-defence-management/compare/v1.148.4...v1.148.5) (2026-08-09)
+
+
+### Bug Fixes
+
+* **security-scan:** report KEV additions only for products present in the workspace ([#1475](https://github.com/HiromiShikata/npm-cli-github-issue-tower-defence-management/issues/1475)) ([70b9442](https://github.com/HiromiShikata/npm-cli-github-issue-tower-defence-management/commit/70b9442f21c46948319a32f8f296b1e290f450ec))
+
 ## [1.148.4](https://github.com/HiromiShikata/npm-cli-github-issue-tower-defence-management/compare/v1.148.3...v1.148.4) (2026-08-09)
 
 

package/bin/domain/usecases/DailySecurityScanUseCase.js

@@ -7,6 +7,8 @@ const isKevVulnerability = (value) => {
     }
     const record = { ...value };
     return (typeof record.cveID === 'string' &&
+        typeof record.vendorProject === 'string' &&
+        typeof record.product === 'string' &&
         typeof record.vulnerabilityName === 'string' &&
         typeof record.dateAdded === 'string');
 };
@@ -38,10 +40,8 @@ class DailySecurityScanUseCase {
         this.scanRepositories = async (org, manager, today, config) => {
             const { stdout: findOutput } = await this.localCommandRunner.runCommand('find', [
                 config.scanBaseDirectory,
-                '-mindepth',
-                '4',
                 '-maxdepth',
-                '4',
+                '5',
                 '-name',
                 '.git',
                 '-type',
@@ -51,6 +51,10 @@ class DailySecurityScanUseCase {
                 .split('\n')
                 .filter((line) => line.length > 0)
                 .map((gitDirectory) => gitDirectory.replace(/\/\.git$/, ''));
+            if (repositoryDirectories.length === 0) {
+                console.error(`No repositories found in scan base directory: ${config.scanBaseDirectory}`);
+                return;
+            }
             for (const repositoryDirectory of repositoryDirectories) {
                 const { stdout: remoteUrl, exitCode: remoteExitCode } = await this.localCommandRunner.runCommand('git', [
                     '-C',
@@ -70,16 +74,34 @@ class DailySecurityScanUseCase {
                 }
                 const repositoryOrg = remoteMatch[1];
                 const repositoryName = remoteMatch[2];
-                const { stdout: scanOutput, exitCode: scanExitCode } = await this.localCommandRunner.runCommand('osv-scanner', [
+                const { stdout: scanOutput, stderr: scanStderr, exitCode: scanExitCode, } = await this.localCommandRunner.runCommand('osv-scanner', [
                     'scan',
                     'source',
                     '-r',
                     repositoryDirectory,
                 ]);
+                if (scanExitCode === 0) {
+                    continue;
+                }
                 if (scanExitCode !== 1) {
+                    console.error(`osv-scanner failed with exit code ${scanExitCode} for ${repositoryDirectory}: ${scanStderr}`);
                     continue;
                 }
-                await this.issueRepository.createNewIssue(repositoryOrg, repositoryName, `Daily security scan findings: ${today}`, `## OSV-Scanner findings\n\n\`\`\`\n${scanOutput}\n\`\`\``, [manager], []);
+                const findingsBody = `## OSV-Scanner findings\n\n### ${today}\n\n\`\`\`\n${scanOutput}\n\`\`\``;
+                const existingIssues = await this.issueRepository.searchIssue({
+                    owner: repositoryOrg,
+                    repositoryName,
+                    type: 'issue',
+                    state: 'open',
+                    title: 'Daily security scan findings',
+                });
+                const existingIssue = existingIssues.find((issue) => issue.title === 'Daily security scan findings');
+                if (existingIssue) {
+                    await this.issueRepository.createCommentByUrl(existingIssue.url, findingsBody);
+                }
+                else {
+                    await this.issueRepository.createNewIssue(repositoryOrg, repositoryName, 'Daily security scan findings', findingsBody, [manager], []);
+                }
             }
         };
         this.reportKevAdditions = async (org, manager, lastTargetDate, config) => {
@@ -94,13 +116,46 @@ class DailySecurityScanUseCase {
             if (!isKevCatalog(parsedKev)) {
                 throw new Error(`Unexpected CISA KEV catalog format from ${KEV_CATALOG_URL}`);
             }
-            const newKevEntries = parsedKev.vulnerabilities
-                .filter((vulnerability) => vulnerability.dateAdded >= yesterdayYmd)
-                .map((vulnerability) => `- ${vulnerability.dateAdded} ${vulnerability.cveID} ${vulnerability.vulnerabilityName}`);
-            if (newKevEntries.length === 0) {
+            const newKevEntries = parsedKev.vulnerabilities.filter((vulnerability) => vulnerability.dateAdded >= yesterdayYmd);
+            const usedKevEntries = [];
+            for (const vulnerability of newKevEntries) {
+                if (await this.isProductPresentInScannedWorkspace(config.scanBaseDirectory, vulnerability.product)) {
+                    usedKevEntries.push(vulnerability);
+                }
+            }
+            if (usedKevEntries.length === 0) {
                 return;
             }
-            await this.issueRepository.createNewIssue(org, config.kevReportRepo, `CISA KEV new additions since ${yesterdayYmd}`, newKevEntries.join('\n'), [manager], []);
+            await this.issueRepository.createNewIssue(org, config.kevReportRepo, `CISA KEV new additions since ${yesterdayYmd}`, usedKevEntries
+                .map((vulnerability) => `- ${vulnerability.dateAdded} ${vulnerability.cveID} ${vulnerability.vulnerabilityName}`)
+                .join('\n'), [manager], []);
+        };
+        this.isProductPresentInScannedWorkspace = async (scanBaseDirectory, product) => {
+            const { stdout: findOutput } = await this.localCommandRunner.runCommand('find', [scanBaseDirectory, '-maxdepth', '3', '-name', '.git', '-type', 'd']);
+            const repositoryDirectories = findOutput
+                .split('\n')
+                .filter((line) => line.length > 0)
+                .map((gitDirectory) => gitDirectory.replace(/\/\.git$/, ''));
+            for (const repositoryDirectory of repositoryDirectories) {
+                const { stderr, exitCode } = await this.localCommandRunner.runCommand('git', [
+                    '-C',
+                    repositoryDirectory,
+                    'grep',
+                    '-I',
+                    '-i',
+                    '-q',
+                    '-F',
+                    '-e',
+                    product,
+                ]);
+                if (exitCode === 0) {
+                    return true;
+                }
+                if (exitCode !== 1) {
+                    console.error(`Failed to search ${repositoryDirectory} for ${product}: ${stderr}`);
+                }
+            }
+            return false;
         };
     }
 }

package/bin/domain/usecases/DailySecurityScanUseCase.js.map

@@ -1 +1 @@
-{"version":3,"file":"DailySecurityScanUseCase.js","sourceRoot":"","sources":["../../../src/domain/usecases/DailySecurityScanUseCase.ts"],"names":[],"mappings":";;;AAsBA,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAA6B,EAAE;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IACrD,OAAO,CACL,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;QAC5C,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CACrC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IACrD,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QACrC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,CACjD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GACnB,qFAAqF,CAAC;AAExF,MAAa,wBAAwB;IACnC,YACW,kBAAsC,EACtC,eAAwD,EACxD,cAA8B;QAF9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,oBAAe,GAAf,eAAe,CAAyC;QACxD,mBAAc,GAAd,cAAc,CAAgB;QAGzC,QAAG,GAAG,KAAK,EAAE,KAKZ,EAAiB,EAAE;YAClB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CACtC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,iBAAiB,CAAC,aAAa;gBAClE,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,CACnC,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAExD,MAAM,IAAI,CAAC,gBAAgB,CACzB,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,OAAO,EACb,KAAK,EACL,KAAK,CAAC,iBAAiB,CACxB,CAAC;YAEF,MAAM,IAAI,CAAC,kBAAkB,CAC3B,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,iBAAiB,CACxB,CAAC;QACJ,CAAC,CAAC;QAEM,qBAAgB,GAAG,KAAK,EAC9B,GAAW,EACX,OAAuB,EACvB,KAAa,EACb,MAA+B,EAChB,EAAE;YACjB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACrE,MAAM,EACN;gBACE,MAAM,CAAC,iBAAiB;gBACxB,WAAW;gBACX,GAAG;gBACH,WAAW;gBACX,GAAG;gBACH,OAAO;gBACP,MAAM;gBACN,OAAO;gBACP,GAAG;aACJ,CACF,CAAC;YAEF,MAAM,qBAAqB,GAAG,UAAU;iBACrC,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;iBACjC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YAE/D,KAAK,MAAM,mBAAmB,IAAI,qBAAqB,EAAE,CAAC;gBACxD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,GACnD,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAK,EAAE;oBAC9C,IAAI;oBACJ,mBAAmB;oBACnB,QAAQ;oBACR,SAAS;oBACT,QAAQ;iBACT,CAAC,CAAC;gBACL,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;oBACzB,SAAS;gBACX,CAAC;gBAED,MAAM,WAAW,GAAG,SAAS;qBAC1B,IAAI,EAAE;qBACN,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC7C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC3C,SAAS;gBACX,CAAC;gBACD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBACrC,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAEtC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,GAClD,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,aAAa,EAAE;oBACtD,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,mBAAmB;iBACpB,CAAC,CAAC;gBACL,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;oBACvB,SAAS;gBACX,CAAC;gBAED,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CACvC,aAAa,EACb,cAAc,EACd,iCAAiC,KAAK,EAAE,EACxC,sCAAsC,UAAU,UAAU,EAC1D,CAAC,OAAO,CAAC,EACT,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEM,uBAAkB,GAAG,KAAK,EAChC,GAAW,EACX,OAAuB,EACvB,cAAoB,EACpB,MAA+B,EAChB,EAAE;YACjB,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC;YAC3C,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAE1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,2CAA2C,eAAe,EAAE,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,SAAS,CAAC,eAAe;iBAC5C,MAAM,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,IAAI,YAAY,CAAC;iBAClE,GAAG,CACF,CAAC,aAAa,EAAE,EAAE,CAChB,KAAK,aAAa,CAAC,SAAS,IAAI,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAC3F,CAAC;YACJ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YAED,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CACvC,GAAG,EACH,MAAM,CAAC,aAAa,EACpB,gCAAgC,YAAY,EAAE,EAC9C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EACxB,CAAC,OAAO,CAAC,EACT,EAAE,CACH,CAAC;QACJ,CAAC,CAAC;IAjJC,CAAC;CAkJL;AAvJD,4DAuJC"}
+{"version":3,"file":"DailySecurityScanUseCase.js","sourceRoot":"","sources":["../../../src/domain/usecases/DailySecurityScanUseCase.ts"],"names":[],"mappings":";;;AAwBA,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAA6B,EAAE;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IACrD,OAAO,CACL,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACxC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;QAC5C,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CACrC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IACrD,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;QACrC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,kBAAkB,CAAC,CACjD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GACnB,qFAAqF,CAAC;AAExF,MAAa,wBAAwB;IACnC,YACW,kBAAsC,EACtC,eAGR,EACQ,cAA8B;QAL9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,oBAAe,GAAf,eAAe,CAGvB;QACQ,mBAAc,GAAd,cAAc,CAAgB;QAGzC,QAAG,GAAG,KAAK,EAAE,KAKZ,EAAiB,EAAE;YAClB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CACtC,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,iBAAiB,CAAC,aAAa;gBAClE,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,CACnC,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAExD,MAAM,IAAI,CAAC,gBAAgB,CACzB,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,OAAO,EACb,KAAK,EACL,KAAK,CAAC,iBAAiB,CACxB,CAAC;YAEF,MAAM,IAAI,CAAC,kBAAkB,CAC3B,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,OAAO,EACb,cAAc,EACd,KAAK,CAAC,iBAAiB,CACxB,CAAC;QACJ,CAAC,CAAC;QAEM,qBAAgB,GAAG,KAAK,EAC9B,GAAW,EACX,OAAuB,EACvB,KAAa,EACb,MAA+B,EAChB,EAAE;YACjB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACrE,MAAM,EACN;gBACE,MAAM,CAAC,iBAAiB;gBACxB,WAAW;gBACX,GAAG;gBACH,OAAO;gBACP,MAAM;gBACN,OAAO;gBACP,GAAG;aACJ,CACF,CAAC;YAEF,MAAM,qBAAqB,GAAG,UAAU;iBACrC,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;iBACjC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YAE/D,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,KAAK,CACX,iDAAiD,MAAM,CAAC,iBAAiB,EAAE,CAC5E,CAAC;gBACF,OAAO;YACT,CAAC;YAED,KAAK,MAAM,mBAAmB,IAAI,qBAAqB,EAAE,CAAC;gBACxD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,GACnD,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAK,EAAE;oBAC9C,IAAI;oBACJ,mBAAmB;oBACnB,QAAQ;oBACR,SAAS;oBACT,QAAQ;iBACT,CAAC,CAAC;gBACL,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;oBACzB,SAAS;gBACX,CAAC;gBAED,MAAM,WAAW,GAAG,SAAS;qBAC1B,IAAI,EAAE;qBACN,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC7C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC3C,SAAS;gBACX,CAAC;gBACD,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBACrC,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAEtC,MAAM,EACJ,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,YAAY,GACvB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,aAAa,EAAE;oBAC1D,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,mBAAmB;iBACpB,CAAC,CAAC;gBACH,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;oBACvB,SAAS;gBACX,CAAC;gBACD,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;oBACvB,OAAO,CAAC,KAAK,CACX,qCAAqC,YAAY,QAAQ,mBAAmB,KAAK,UAAU,EAAE,CAC9F,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,MAAM,YAAY,GAAG,kCAAkC,KAAK,eAAe,UAAU,UAAU,CAAC;gBAChG,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;oBAC5D,KAAK,EAAE,aAAa;oBACpB,cAAc;oBACd,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,MAAM;oBACb,KAAK,EAAE,8BAA8B;iBACtC,CAAC,CAAC;gBACH,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CACvC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,8BAA8B,CAC1D,CAAC;gBACF,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAC3C,aAAa,CAAC,GAAG,EACjB,YAAY,CACb,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CACvC,aAAa,EACb,cAAc,EACd,8BAA8B,EAC9B,YAAY,EACZ,CAAC,OAAO,CAAC,EACT,EAAE,CACH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEM,uBAAkB,GAAG,KAAK,EAChC,GAAW,EACX,OAAuB,EACvB,cAAoB,EACpB,MAA+B,EAChB,EAAE;YACjB,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC;YAC3C,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAE1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,2CAA2C,eAAe,EAAE,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,SAAS,CAAC,eAAe,CAAC,MAAM,CACpD,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,IAAI,YAAY,CAC3D,CAAC;YACF,MAAM,cAAc,GAAuB,EAAE,CAAC;YAC9C,KAAK,MAAM,aAAa,IAAI,aAAa,EAAE,CAAC;gBAC1C,IACE,MAAM,IAAI,CAAC,kCAAkC,CAC3C,MAAM,CAAC,iBAAiB,EACxB,aAAa,CAAC,OAAO,CACtB,EACD,CAAC;oBACD,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YACD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO;YACT,CAAC;YAED,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CACvC,GAAG,EACH,MAAM,CAAC,aAAa,EACpB,gCAAgC,YAAY,EAAE,EAC9C,cAAc;iBACX,GAAG,CACF,CAAC,aAAa,EAAE,EAAE,CAChB,KAAK,aAAa,CAAC,SAAS,IAAI,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,iBAAiB,EAAE,CAC3F;iBACA,IAAI,CAAC,IAAI,CAAC,EACb,CAAC,OAAO,CAAC,EACT,EAAE,CACH,CAAC;QACJ,CAAC,CAAC;QAEM,uCAAkC,GAAG,KAAK,EAChD,iBAAyB,EACzB,OAAe,EACG,EAAE;YACpB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACrE,MAAM,EACN,CAAC,iBAAiB,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CACrE,CAAC;YACF,MAAM,qBAAqB,GAAG,UAAU;iBACrC,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;iBACjC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;YAE/D,KAAK,MAAM,mBAAmB,IAAI,qBAAqB,EAAE,CAAC;gBACxD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CACnE,KAAK,EACL;oBACE,IAAI;oBACJ,mBAAmB;oBACnB,MAAM;oBACN,IAAI;oBACJ,IAAI;oBACJ,IAAI;oBACJ,IAAI;oBACJ,IAAI;oBACJ,OAAO;iBACR,CACF,CAAC;gBACF,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;oBACnB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;oBACnB,OAAO,CAAC,KAAK,CACX,oBAAoB,mBAAmB,QAAQ,OAAO,KAAK,MAAM,EAAE,CACpE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;IAtOC,CAAC;CAuOL;AA/OD,4DA+OC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-issue-tower-defence-management",
-  "version": "1.148.4",
+  "version": "1.148.6",
   "description": "",
   "main": "bin/index.js",
   "scripts": {

package/src/domain/usecases/DailySecurityScanUseCase.test.ts

@@ -64,6 +64,8 @@ describe('DailySecurityScanUseCase', () => {
       const { useCase, mockLocalCommandRunner, mockIssueRepository } =
         buildUseCase();
 
+      mockIssueRepository.searchIssue.mockResolvedValue([]);
+
       mockLocalCommandRunner.runCommand.mockImplementation(
         async (program, args) => {
           if (program === 'find') {
@@ -107,7 +109,7 @@ describe('DailySecurityScanUseCase', () => {
       );
       expect(mockIssueRepository.createNewIssue.mock.calls[0][1]).toBe('app');
       expect(mockIssueRepository.createNewIssue.mock.calls[0][2]).toBe(
-        'Daily security scan findings: 2024-01-02',
+        'Daily security scan findings',
       );
       expect(mockIssueRepository.createNewIssue.mock.calls[0][4]).toEqual([
         'manager-name',
@@ -233,10 +235,22 @@ describe('DailySecurityScanUseCase', () => {
       const { useCase, mockLocalCommandRunner, mockHttpRepository } =
         buildUseCase();
 
-      mockLocalCommandRunner.runCommand.mockResolvedValue({
-        stdout: '',
-        stderr: '',
-        exitCode: 0,
+      mockLocalCommandRunner.runCommand.mockImplementation(async (program) => {
+        if (program === 'find') {
+          return {
+            stdout: '/repos/example-org/app/.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'git') {
+          return {
+            stdout: 'git@github.com:example-org/app.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        return { stdout: '', stderr: '', exitCode: 0 };
       });
 
       await useCase.run({
@@ -257,10 +271,22 @@ describe('DailySecurityScanUseCase', () => {
       const { useCase, mockLocalCommandRunner, mockHttpRepository } =
         buildUseCase();
 
-      mockLocalCommandRunner.runCommand.mockResolvedValue({
-        stdout: '',
-        stderr: '',
-        exitCode: 0,
+      mockLocalCommandRunner.runCommand.mockImplementation(async (program) => {
+        if (program === 'find') {
+          return {
+            stdout: '/repos/example-org/app/.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'git') {
+          return {
+            stdout: 'git@github.com:example-org/app.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        return { stdout: '', stderr: '', exitCode: 0 };
       });
 
       await useCase.run({
@@ -285,21 +311,28 @@ describe('DailySecurityScanUseCase', () => {
         mockHttpRepository,
       } = buildUseCase();
 
-      mockLocalCommandRunner.runCommand.mockResolvedValue({
-        stdout: '',
-        stderr: '',
-        exitCode: 0,
-      });
+      mockLocalCommandRunner.runCommand.mockImplementation(
+        async (program, args) => {
+          if (program === 'find' && args.includes('-maxdepth')) {
+            return { stdout: '/repos/app/.git\n', stderr: '', exitCode: 0 };
+          }
+          return { stdout: '', stderr: '', exitCode: 0 };
+        },
+      );
       mockHttpRepository.get.mockResolvedValue(
         JSON.stringify({
           vulnerabilities: [
             {
               cveID: 'CVE-2024-0001',
+              vendorProject: 'Example',
+              product: 'NewProduct',
               vulnerabilityName: 'New Vulnerability',
               dateAdded: '2024-01-02',
             },
             {
               cveID: 'CVE-2023-9999',
+              vendorProject: 'Example',
+              product: 'OldProduct',
               vulnerabilityName: 'Old Vulnerability',
               dateAdded: '2023-12-31',
             },
@@ -347,16 +380,30 @@ describe('DailySecurityScanUseCase', () => {
         mockHttpRepository,
       } = buildUseCase();
 
-      mockLocalCommandRunner.runCommand.mockResolvedValue({
-        stdout: '',
-        stderr: '',
-        exitCode: 0,
+      mockLocalCommandRunner.runCommand.mockImplementation(async (program) => {
+        if (program === 'find') {
+          return {
+            stdout: '/repos/example-org/app/.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'git') {
+          return {
+            stdout: 'git@github.com:example-org/app.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        return { stdout: '', stderr: '', exitCode: 0 };
       });
       mockHttpRepository.get.mockResolvedValue(
         JSON.stringify({
           vulnerabilities: [
             {
               cveID: 'CVE-2023-9999',
+              vendorProject: 'Example',
+              product: 'OldProduct',
               vulnerabilityName: 'Old Vulnerability',
               dateAdded: '2023-12-31',
             },
@@ -381,14 +428,238 @@ describe('DailySecurityScanUseCase', () => {
       expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(0);
     });
 
+    it('does not create a KEV report issue when the product is absent from the scanned workspace', async () => {
+      const {
+        useCase,
+        mockLocalCommandRunner,
+        mockIssueRepository,
+        mockHttpRepository,
+      } = buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockImplementation(
+        async (program, args) => {
+          if (program === 'find' && args.includes('-maxdepth')) {
+            return {
+              stdout: '/repos/app/.git\n/repos/site/.git\n',
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'git' && args.includes('grep')) {
+            return { stdout: '', stderr: '', exitCode: 1 };
+          }
+          return { stdout: '', stderr: '', exitCode: 0 };
+        },
+      );
+      mockHttpRepository.get.mockResolvedValue(
+        JSON.stringify({
+          vulnerabilities: [
+            {
+              cveID: 'CVE-2024-0001',
+              vendorProject: 'Progress',
+              product: 'LoadMaster',
+              vulnerabilityName: 'Progress LoadMaster Command Injection',
+              dateAdded: '2024-01-02',
+            },
+          ],
+        }),
+      );
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+          enableKevNvdReport: true,
+          kevReportRepo: 'security-reports',
+        },
+      });
+
+      const gitGrepCalls = mockLocalCommandRunner.runCommand.mock.calls.filter(
+        (call) => call[0] === 'git' && call[1].includes('grep'),
+      );
+      expect(gitGrepCalls.map((call) => call[1])).toEqual([
+        [
+          '-C',
+          '/repos/app',
+          'grep',
+          '-I',
+          '-i',
+          '-q',
+          '-F',
+          '-e',
+          'LoadMaster',
+        ],
+        [
+          '-C',
+          '/repos/site',
+          'grep',
+          '-I',
+          '-i',
+          '-q',
+          '-F',
+          '-e',
+          'LoadMaster',
+        ],
+      ]);
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(0);
+    });
+
+    it('reports only the new KEV entries whose product is present in the scanned workspace', async () => {
+      const {
+        useCase,
+        mockLocalCommandRunner,
+        mockIssueRepository,
+        mockHttpRepository,
+      } = buildUseCase();
+
+      mockLocalCommandRunner.runCommand.mockImplementation(
+        async (program, args) => {
+          if (program === 'find' && args.includes('-maxdepth')) {
+            return { stdout: '/repos/app/.git\n', stderr: '', exitCode: 0 };
+          }
+          if (program === 'git' && args.includes('grep')) {
+            return {
+              stdout: '',
+              stderr: '',
+              exitCode: args.includes('LoadMaster') ? 1 : 0,
+            };
+          }
+          return { stdout: '', stderr: '', exitCode: 0 };
+        },
+      );
+      mockHttpRepository.get.mockResolvedValue(
+        JSON.stringify({
+          vulnerabilities: [
+            {
+              cveID: 'CVE-2024-0001',
+              vendorProject: 'Progress',
+              product: 'LoadMaster',
+              vulnerabilityName: 'Progress LoadMaster Command Injection',
+              dateAdded: '2024-01-02',
+            },
+            {
+              cveID: 'CVE-2024-0002',
+              vendorProject: 'Example',
+              product: 'ExampleLibrary',
+              vulnerabilityName: 'Example Library Deserialization',
+              dateAdded: '2024-01-02',
+            },
+          ],
+        }),
+      );
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+          enableKevNvdReport: true,
+          kevReportRepo: 'security-reports',
+        },
+      });
+
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(1);
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][3]).toContain(
+        'CVE-2024-0002',
+      );
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][3]).not.toContain(
+        'CVE-2024-0001',
+      );
+    });
+
+    it('logs a failed repository search and keeps searching the remaining repositories', async () => {
+      const {
+        useCase,
+        mockLocalCommandRunner,
+        mockIssueRepository,
+        mockHttpRepository,
+      } = buildUseCase();
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => undefined);
+
+      mockLocalCommandRunner.runCommand.mockImplementation(
+        async (program, args) => {
+          if (program === 'find' && args.includes('-maxdepth')) {
+            return {
+              stdout: '/repos/broken/.git\n/repos/app/.git\n',
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'git' && args.includes('grep')) {
+            return args.includes('/repos/broken')
+              ? {
+                  stdout: '',
+                  stderr: 'fatal: not a git repository',
+                  exitCode: 128,
+                }
+              : { stdout: '', stderr: '', exitCode: 0 };
+          }
+          return { stdout: '', stderr: '', exitCode: 0 };
+        },
+      );
+      mockHttpRepository.get.mockResolvedValue(
+        JSON.stringify({
+          vulnerabilities: [
+            {
+              cveID: 'CVE-2024-0001',
+              vendorProject: 'Progress',
+              product: 'LoadMaster',
+              vulnerabilityName: 'Progress LoadMaster Command Injection',
+              dateAdded: '2024-01-02',
+            },
+          ],
+        }),
+      );
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+          enableKevNvdReport: true,
+          kevReportRepo: 'security-reports',
+        },
+      });
+
+      expect(errorSpy).toHaveBeenCalledWith(
+        'Failed to search /repos/broken for LoadMaster: fatal: not a git repository',
+      );
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(1);
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][3]).toContain(
+        'CVE-2024-0001',
+      );
+      errorSpy.mockRestore();
+    });
+
     it('throws when the KEV catalog format is unexpected', async () => {
       const { useCase, mockLocalCommandRunner, mockHttpRepository } =
         buildUseCase();
 
-      mockLocalCommandRunner.runCommand.mockResolvedValue({
-        stdout: '',
-        stderr: '',
-        exitCode: 0,
+      mockLocalCommandRunner.runCommand.mockImplementation(async (program) => {
+        if (program === 'find') {
+          return {
+            stdout: '/repos/example-org/app/.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'git') {
+          return {
+            stdout: 'git@github.com:example-org/app.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        return { stdout: '', stderr: '', exitCode: 0 };
       });
       mockHttpRepository.get.mockResolvedValue(
         JSON.stringify({ unexpected: 'structure' }),
@@ -408,5 +679,195 @@ describe('DailySecurityScanUseCase', () => {
         }),
       ).rejects.toThrow('Unexpected CISA KEV catalog format');
     });
+
+    it('logs an error and returns without throwing when no repositories are found in the scan base directory', async () => {
+      const { useCase, mockLocalCommandRunner } = buildUseCase();
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => undefined);
+
+      mockLocalCommandRunner.runCommand.mockImplementation(async (program) => {
+        if (program === 'find') {
+          return { stdout: '', stderr: '', exitCode: 0 };
+        }
+        return { stdout: '', stderr: '', exitCode: 0 };
+      });
+
+      await expect(
+        useCase.run({
+          targetDates: [new Date('2024-01-02T05:00:00Z')],
+          org: 'example-org',
+          manager: 'manager-name',
+          dailySecurityScan: {
+            scanBaseDirectory: '/repos',
+            targetHourUtc: 5,
+          },
+        }),
+      ).resolves.toBeUndefined();
+
+      expect(errorSpy).toHaveBeenCalledWith(
+        'No repositories found in scan base directory: /repos',
+      );
+
+      errorSpy.mockRestore();
+    });
+
+    it('logs an error and continues scanning remaining repositories when osv-scanner exits with an unexpected code', async () => {
+      const { useCase, mockLocalCommandRunner, mockIssueRepository } =
+        buildUseCase();
+      const errorSpy = jest
+        .spyOn(console, 'error')
+        .mockImplementation(() => undefined);
+
+      mockIssueRepository.searchIssue.mockResolvedValue([]);
+
+      mockLocalCommandRunner.runCommand.mockImplementation(
+        async (program, args) => {
+          if (program === 'find') {
+            return {
+              stdout:
+                '/repos/example-org/broken/.git\n/repos/example-org/app/.git\n',
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'git') {
+            const dir = args[1];
+            const repo = dir.split('/').pop() ?? '';
+            return {
+              stdout: `git@github.com:example-org/${repo}.git\n`,
+              stderr: '',
+              exitCode: 0,
+            };
+          }
+          if (program === 'osv-scanner') {
+            const dir = args[args.length - 1];
+            if (dir.includes('broken')) {
+              return {
+                stdout: '',
+                stderr: 'osv-scanner: command not found',
+                exitCode: 127,
+              };
+            }
+            return { stdout: 'vulnerability found', stderr: '', exitCode: 1 };
+          }
+          return { stdout: '', stderr: '', exitCode: 0 };
+        },
+      );
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(errorSpy).toHaveBeenCalledWith(
+        expect.stringContaining('osv-scanner failed with exit code 127'),
+      );
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(1);
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][1]).toBe('app');
+      errorSpy.mockRestore();
+    });
+
+    it('adds a comment to the existing open issue for the repository instead of creating a new one', async () => {
+      const { useCase, mockLocalCommandRunner, mockIssueRepository } =
+        buildUseCase();
+
+      mockIssueRepository.searchIssue.mockResolvedValue([
+        {
+          url: 'https://github.com/example-org/app/issues/42',
+          title: 'Daily security scan findings',
+          number: '42',
+        },
+      ]);
+
+      mockLocalCommandRunner.runCommand.mockImplementation(async (program) => {
+        if (program === 'find') {
+          return {
+            stdout: '/repos/example-org/app/.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'git') {
+          return {
+            stdout: 'git@github.com:example-org/app.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'osv-scanner') {
+          return { stdout: 'vulnerability found', stderr: '', exitCode: 1 };
+        }
+        return { stdout: '', stderr: '', exitCode: 0 };
+      });
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(0);
+      expect(mockIssueRepository.createCommentByUrl.mock.calls).toHaveLength(1);
+      expect(mockIssueRepository.createCommentByUrl.mock.calls[0][0]).toBe(
+        'https://github.com/example-org/app/issues/42',
+      );
+      expect(mockIssueRepository.createCommentByUrl.mock.calls[0][1]).toContain(
+        '2024-01-02',
+      );
+    });
+
+    it('creates a new issue when no existing open issue exists for the repository', async () => {
+      const { useCase, mockLocalCommandRunner, mockIssueRepository } =
+        buildUseCase();
+
+      mockIssueRepository.searchIssue.mockResolvedValue([]);
+
+      mockLocalCommandRunner.runCommand.mockImplementation(async (program) => {
+        if (program === 'find') {
+          return {
+            stdout: '/repos/example-org/app/.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'git') {
+          return {
+            stdout: 'git@github.com:example-org/app.git\n',
+            stderr: '',
+            exitCode: 0,
+          };
+        }
+        if (program === 'osv-scanner') {
+          return { stdout: 'vulnerability found', stderr: '', exitCode: 1 };
+        }
+        return { stdout: '', stderr: '', exitCode: 0 };
+      });
+
+      await useCase.run({
+        targetDates: [new Date('2024-01-02T05:00:00Z')],
+        org: 'example-org',
+        manager: 'manager-name',
+        dailySecurityScan: {
+          scanBaseDirectory: '/repos',
+          targetHourUtc: 5,
+        },
+      });
+
+      expect(mockIssueRepository.createNewIssue.mock.calls).toHaveLength(1);
+      expect(mockIssueRepository.createNewIssue.mock.calls[0][2]).toBe(
+        'Daily security scan findings',
+      );
+      expect(mockIssueRepository.createCommentByUrl.mock.calls).toHaveLength(0);
+    });
   });
 });

package/src/domain/usecases/DailySecurityScanUseCase.ts

@@ -12,6 +12,8 @@ export type DailySecurityScanConfig = {
 
 type KevVulnerability = {
   cveID: string;
+  vendorProject: string;
+  product: string;
   vulnerabilityName: string;
   dateAdded: string;
 };
@@ -27,6 +29,8 @@ const isKevVulnerability = (value: unknown): value is KevVulnerability => {
   const record: Record<string, unknown> = { ...value };
   return (
     typeof record.cveID === 'string' &&
+    typeof record.vendorProject === 'string' &&
+    typeof record.product === 'string' &&
     typeof record.vulnerabilityName === 'string' &&
     typeof record.dateAdded === 'string'
   );
@@ -49,7 +53,10 @@ const KEV_CATALOG_URL =
 export class DailySecurityScanUseCase {
   constructor(
     readonly localCommandRunner: LocalCommandRunner,
-    readonly issueRepository: Pick<IssueRepository, 'createNewIssue'>,
+    readonly issueRepository: Pick<
+      IssueRepository,
+      'createNewIssue' | 'searchIssue' | 'createCommentByUrl'
+    >,
     readonly httpRepository: HttpRepository,
   ) {}
 
@@ -96,10 +103,8 @@ export class DailySecurityScanUseCase {
       'find',
       [
         config.scanBaseDirectory,
-        '-mindepth',
-        '4',
         '-maxdepth',
-        '4',
+        '5',
         '-name',
         '.git',
         '-type',
@@ -112,6 +117,13 @@ export class DailySecurityScanUseCase {
       .filter((line) => line.length > 0)
       .map((gitDirectory) => gitDirectory.replace(/\/\.git$/, ''));
 
+    if (repositoryDirectories.length === 0) {
+      console.error(
+        `No repositories found in scan base directory: ${config.scanBaseDirectory}`,
+      );
+      return;
+    }
+
     for (const repositoryDirectory of repositoryDirectories) {
       const { stdout: remoteUrl, exitCode: remoteExitCode } =
         await this.localCommandRunner.runCommand('git', [
@@ -134,25 +146,52 @@ export class DailySecurityScanUseCase {
       const repositoryOrg = remoteMatch[1];
       const repositoryName = remoteMatch[2];
 
-      const { stdout: scanOutput, exitCode: scanExitCode } =
-        await this.localCommandRunner.runCommand('osv-scanner', [
-          'scan',
-          'source',
-          '-r',
-          repositoryDirectory,
-        ]);
+      const {
+        stdout: scanOutput,
+        stderr: scanStderr,
+        exitCode: scanExitCode,
+      } = await this.localCommandRunner.runCommand('osv-scanner', [
+        'scan',
+        'source',
+        '-r',
+        repositoryDirectory,
+      ]);
+      if (scanExitCode === 0) {
+        continue;
+      }
       if (scanExitCode !== 1) {
+        console.error(
+          `osv-scanner failed with exit code ${scanExitCode} for ${repositoryDirectory}: ${scanStderr}`,
+        );
         continue;
       }
 
-      await this.issueRepository.createNewIssue(
-        repositoryOrg,
+      const findingsBody = `## OSV-Scanner findings\n\n### ${today}\n\n\`\`\`\n${scanOutput}\n\`\`\``;
+      const existingIssues = await this.issueRepository.searchIssue({
+        owner: repositoryOrg,
         repositoryName,
-        `Daily security scan findings: ${today}`,
-        `## OSV-Scanner findings\n\n\`\`\`\n${scanOutput}\n\`\`\``,
-        [manager],
-        [],
+        type: 'issue',
+        state: 'open',
+        title: 'Daily security scan findings',
+      });
+      const existingIssue = existingIssues.find(
+        (issue) => issue.title === 'Daily security scan findings',
       );
+      if (existingIssue) {
+        await this.issueRepository.createCommentByUrl(
+          existingIssue.url,
+          findingsBody,
+        );
+      } else {
+        await this.issueRepository.createNewIssue(
+          repositoryOrg,
+          repositoryName,
+          'Daily security scan findings',
+          findingsBody,
+          [manager],
+          [],
+        );
+      }
     }
   };
 
@@ -178,13 +217,21 @@ export class DailySecurityScanUseCase {
       );
     }
 
-    const newKevEntries = parsedKev.vulnerabilities
-      .filter((vulnerability) => vulnerability.dateAdded >= yesterdayYmd)
-      .map(
-        (vulnerability) =>
-          `- ${vulnerability.dateAdded} ${vulnerability.cveID} ${vulnerability.vulnerabilityName}`,
-      );
-    if (newKevEntries.length === 0) {
+    const newKevEntries = parsedKev.vulnerabilities.filter(
+      (vulnerability) => vulnerability.dateAdded >= yesterdayYmd,
+    );
+    const usedKevEntries: KevVulnerability[] = [];
+    for (const vulnerability of newKevEntries) {
+      if (
+        await this.isProductPresentInScannedWorkspace(
+          config.scanBaseDirectory,
+          vulnerability.product,
+        )
+      ) {
+        usedKevEntries.push(vulnerability);
+      }
+    }
+    if (usedKevEntries.length === 0) {
       return;
     }
 
@@ -192,9 +239,54 @@ export class DailySecurityScanUseCase {
       org,
       config.kevReportRepo,
       `CISA KEV new additions since ${yesterdayYmd}`,
-      newKevEntries.join('\n'),
+      usedKevEntries
+        .map(
+          (vulnerability) =>
+            `- ${vulnerability.dateAdded} ${vulnerability.cveID} ${vulnerability.vulnerabilityName}`,
+        )
+        .join('\n'),
       [manager],
       [],
     );
   };
+
+  private isProductPresentInScannedWorkspace = async (
+    scanBaseDirectory: string,
+    product: string,
+  ): Promise<boolean> => {
+    const { stdout: findOutput } = await this.localCommandRunner.runCommand(
+      'find',
+      [scanBaseDirectory, '-maxdepth', '3', '-name', '.git', '-type', 'd'],
+    );
+    const repositoryDirectories = findOutput
+      .split('\n')
+      .filter((line) => line.length > 0)
+      .map((gitDirectory) => gitDirectory.replace(/\/\.git$/, ''));
+
+    for (const repositoryDirectory of repositoryDirectories) {
+      const { stderr, exitCode } = await this.localCommandRunner.runCommand(
+        'git',
+        [
+          '-C',
+          repositoryDirectory,
+          'grep',
+          '-I',
+          '-i',
+          '-q',
+          '-F',
+          '-e',
+          product,
+        ],
+      );
+      if (exitCode === 0) {
+        return true;
+      }
+      if (exitCode !== 1) {
+        console.error(
+          `Failed to search ${repositoryDirectory} for ${product}: ${stderr}`,
+        );
+      }
+    }
+    return false;
+  };
 }

package/types/domain/usecases/DailySecurityScanUseCase.d.ts

@@ -10,9 +10,9 @@ export type DailySecurityScanConfig = {
 };
 export declare class DailySecurityScanUseCase {
     readonly localCommandRunner: LocalCommandRunner;
-    readonly issueRepository: Pick<IssueRepository, 'createNewIssue'>;
+    readonly issueRepository: Pick<IssueRepository, 'createNewIssue' | 'searchIssue' | 'createCommentByUrl'>;
     readonly httpRepository: HttpRepository;
-    constructor(localCommandRunner: LocalCommandRunner, issueRepository: Pick<IssueRepository, 'createNewIssue'>, httpRepository: HttpRepository);
+    constructor(localCommandRunner: LocalCommandRunner, issueRepository: Pick<IssueRepository, 'createNewIssue' | 'searchIssue' | 'createCommentByUrl'>, httpRepository: HttpRepository);
     run: (input: {
         targetDates: Date[];
         org: string;
@@ -21,5 +21,6 @@ export declare class DailySecurityScanUseCase {
     }) => Promise<void>;
     private scanRepositories;
     private reportKevAdditions;
+    private isProductPresentInScannedWorkspace;
 }
 //# sourceMappingURL=DailySecurityScanUseCase.d.ts.map

package/types/domain/usecases/DailySecurityScanUseCase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DailySecurityScanUseCase.d.ts","sourceRoot":"","sources":["../../../src/domain/usecases/DailySecurityScanUseCase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,MAAM,uBAAuB,GAAG;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAsCF,qBAAa,wBAAwB;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB;IAC/C,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACjE,QAAQ,CAAC,cAAc,EAAE,cAAc;gBAF9B,kBAAkB,EAAE,kBAAkB,EACtC,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,EACxD,cAAc,EAAE,cAAc;IAGzC,GAAG,GAAU,OAAO;QAClB,WAAW,EAAE,IAAI,EAAE,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,iBAAiB,EAAE,uBAAuB,CAAC;KAC5C,KAAG,OAAO,CAAC,IAAI,CAAC,CA0Bf;IAEF,OAAO,CAAC,gBAAgB,CAoEtB;IAEF,OAAO,CAAC,kBAAkB,CAwCxB;CACH"}
+{"version":3,"file":"DailySecurityScanUseCase.d.ts","sourceRoot":"","sources":["../../../src/domain/usecases/DailySecurityScanUseCase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,MAAM,uBAAuB,GAAG;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AA0CF,qBAAa,wBAAwB;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB;IAC/C,QAAQ,CAAC,eAAe,EAAE,IAAI,CAC5B,eAAe,EACf,gBAAgB,GAAG,aAAa,GAAG,oBAAoB,CACxD;IACD,QAAQ,CAAC,cAAc,EAAE,cAAc;gBAL9B,kBAAkB,EAAE,kBAAkB,EACtC,eAAe,EAAE,IAAI,CAC5B,eAAe,EACf,gBAAgB,GAAG,aAAa,GAAG,oBAAoB,CACxD,EACQ,cAAc,EAAE,cAAc;IAGzC,GAAG,GAAU,OAAO;QAClB,WAAW,EAAE,IAAI,EAAE,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,iBAAiB,EAAE,uBAAuB,CAAC;KAC5C,KAAG,OAAO,CAAC,IAAI,CAAC,CA0Bf;IAEF,OAAO,CAAC,gBAAgB,CAoGtB;IAEF,OAAO,CAAC,kBAAkB,CAqDxB;IAEF,OAAO,CAAC,kCAAkC,CAsCxC;CACH"}