fix: fail closed on incomplete weekly image and CVE surveys

cc-ci-plan/test-advisory-scan.py

@@ -22,6 +22,7 @@ import io
 import json
 import os
 import pathlib
+import tempfile
 import sys
 import unittest
 import unittest.mock
@@ -153,6 +154,12 @@ class TestRegistryUrls(unittest.TestCase):
         p.write_text(text)
         return A.registry_urls("r", tmp)
 
+    def test_prose_ellipsis_is_not_a_security_source(self):
+        with tempfile.TemporaryDirectory() as directory:
+            urls, _ = self._write(directory,
+                                  "https://github.com/cryptpad/cryptpad and example `https://…` URLs")
+        self.assertEqual(urls, ["https://github.com/cryptpad/cryptpad"])
+
     def test_strips_trailing_markdown_punctuation(self):
         # Production defect: a captured backtick 404'd the fetch and rendered n8n/immich as '?'.
         import tempfile
@@ -290,12 +297,14 @@ class TestPerImageWindows(unittest.TestCase):
         self.assertEqual(rep["windows"]["github-advisories:discourse/discourse"],
                          {"from": "3.5.3", "to": "3.5.4"})
 
-    def test_unmatched_image_name_is_silently_ignored(self):
-        # Documents CURRENT behaviour: a typo'd name costs coverage without warning.
+    def test_unmatched_image_name_makes_count_unknown(self):
+        # A typo'd sidecar name must not silently turn its CVEs into a clean zero.
         rep = run_scan([self.APP], v_from="3.5.3", v_to="3.5.4",
                        images=[("nosuchimage", "1", "2")], urls=self.URLS[:1])
         self.assertEqual(list(rep["windows"]), ["github-advisories:discourse/discourse"])
-        self.assertTrue(rep["count_known"])
+        self.assertFalse(rep["count_known"])
+        self.assertEqual(rep["unmatched_image_windows"], ["nosuchimage"])
+        self.assertIsNone(rep["cve_count_fixed"])
 
 
 class TestSchemeChangeDateFallback(unittest.TestCase):
@@ -377,6 +386,13 @@ class TestCountGuarantees(unittest.TestCase):
                        v_from="1.0", v_to="1.1")
         self.assertIn("github-advisories:app/app", rep["sources_failed"])
         self.assertIn("FAILED", A.markdown(rep))
+        self.assertFalse(rep["count_known"])
+
+    def test_only_404_feed_is_not_evidence_of_clean_scan(self):
+        rep = run_scan([gh("app/app", [], status="no-advisories-published")],
+                       v_from="1.0", v_to="1.1")
+        self.assertTrue(rep["no_usable_sources"])
+        self.assertFalse(rep["count_known"])
 
     def test_no_window_given_classifies_nothing(self):
         rep = run_scan([gh("app/app", [adv("CVE-1", patched="1.1")])])