Find roxctl reports also using benchmark offliner

[simonbaird]

We're moving from clair-scan to roxctl-scan. This change should ensure that the benchmark offliner utility finds the roxctl-scan reports the same way it finds the clair-scan reports.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 6a3117f4-0ca0-4586-8bb2-933d475dc22b

📥 Commits

Reviewing files that changed from the base of the PR and between 047e1ae and c401448.

📒 Files selected for processing (1)

• benchmark/offliner/scans.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The offliner scan report filter now processes tasks named clair-scan and roxctl-scan. Other task names remain ignored. Report extraction and error handling are unchanged.

Changes

Scan task support

Layer / File(s)	Summary
Recognize supported scan tasks benchmark/offliner/scans.go	The task filter now accepts both clair-scan and roxctl-scan.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to c4014

The benchmark offliner is updated to find roxctl-scan reports alongside clair-scan reports; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states that the benchmark offliner will find roxctl reports. It matches the main change.
Description check	✅ Passed	The description explains what changes and why. It does not include the template headings or a ticket link, but it provides the main required context.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Discover roxctl scan reports in benchmark offliner

✨ Enhancement 🕐 Less than 5 minutes

AI Description

• Recognizes roxctl-scan tasks while traversing provenance attestations.
• Preserves clair-scan report discovery during the scanner migration.

Diagram

graph TD
  A["Attestation Image"] --> B["SLSA Tasks"] --> C{"Known Scanner?"}
  C -->|yes| D["REPORTS Result"] --> E["Report References"]
  C -->|no| F["Skip Task"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Match scanner task references

• ➕ Avoids dependence on mutable task names or aliases
• ➕ Aligns with the existing TODO and identifies task implementations precisely
• ➖ Requires reliable task-reference data in all supported provenance payloads
• ➖ Introduces broader compatibility and validation work than this migration fix

Recommendation: Keep the dual-name check for this focused migration change because it preserves clair compatibility with minimal risk. Consider reference-based matching separately once provenance inputs consistently expose stable task references.

Files changed (1) +1 / -1

Enhancement (1) +1 / -1

scans.goRecognize roxctl scanner tasks during report discovery +1/-1

Recognize roxctl scanner tasks during report discovery

• Extends scanner task filtering to accept 'roxctl-scan' alongside 'clair-scan'. Both task types now use the existing 'REPORTS' result parsing and report-reference resolution path.

benchmark/offliner/scans.go

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can turn on the rule miner and Qodo learns your standards from review history

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:16 PM UTC · Completed 6:24 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.90

[fullsend-ai-review]

Risk Assessment: low (1/5)

Details

Minimal 1-file, 2-line change in a benchmark utility by a returning contributor with no protected paths, no security-sensitive files, and no dependency changes; the only elevated signal is the file's age (525 days untouched), but overall risk remains low.

[fullsend-ai-review]

Looks good to me

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.46% <ø> (ø)
generative	12.27% <ø> (ø)
integration	23.59% <ø> (ø)
unit	72.21% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.