feat: add AdvisoryInfo schema to RemediationInfo

[ruromero]

Summary

• Add AdvisoryInfo schema (id required, title optional, url optional) to the OpenAPI v5 spec
• Add optional advisory property to RemediationInfo referencing AdvisoryInfo
• Enables clients and IDE extensions to display advisory attribution for each remediation

Ref: TC-5018

Test plan

• mvn validate passes
• mvn generate-sources produces AdvisoryInfo in both Java and TypeScript targets
• Generated RemediationInfo includes advisory field in both languages

Summary by Sourcery

Add advisory metadata support to remediation information in the OpenAPI v5 specification.

New Features:

• Introduce an AdvisoryInfo schema with required identifier and optional title and URL fields.
• Allow RemediationInfo objects to include optional advisory information referencing AdvisoryInfo.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adds an AdvisoryInfo schema to the OpenAPI v5 spec and wires it into RemediationInfo so generated clients can surface advisory attribution per remediation.

Entity relationship diagram for RemediationInfo and AdvisoryInfo

erDiagram
  RemediationInfo {
    string url
    AdvisoryInfo advisory
  }

  AdvisoryInfo {
    string id
    string title
    string url
  }

  RemediationInfo ||--o| AdvisoryInfo : advisory

Loading

File-Level Changes

Change	Details	Files
Extend RemediationInfo schema with an optional advisory field referencing a new AdvisoryInfo schema.	Add advisory property to RemediationInfo that references components/schemas/AdvisoryInfo Ensure advisory field is optional to preserve backward compatibility of the API	api/v5/openapi.yaml
Introduce AdvisoryInfo schema to describe source advisory attribution for a remediation.	Define AdvisoryInfo as an object with id, title, and url properties Mark id as a required field while keeping title and url optional Document expected formats and usage for the AdvisoryInfo fields (e.g., RHSA/GHSA identifiers, advisory URLs)	api/v5/openapi.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider adding format: uri to the url properties in both RemediationInfo and AdvisoryInfo to enable stronger validation and better tooling support.
• If advisory identifiers follow a well-defined pattern (e.g., RHSA-YYYY:NNNN, GHSA-xxxx-xxxx-xxxx), you might want to add a pattern to the id field to capture that structure explicitly.
• Double-check whether an advisory-like schema already exists elsewhere in the spec and, if so, consider reusing or aligning this AdvisoryInfo schema to avoid duplication and keep the API model consistent.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider adding `format: uri` to the `url` properties in both `RemediationInfo` and `AdvisoryInfo` to enable stronger validation and better tooling support.
- If advisory identifiers follow a well-defined pattern (e.g., RHSA-YYYY:NNNN, GHSA-xxxx-xxxx-xxxx), you might want to add a `pattern` to the `id` field to capture that structure explicitly.
- Double-check whether an advisory-like schema already exists elsewhere in the spec and, if so, consider reusing or aligning this `AdvisoryInfo` schema to avoid duplication and keep the API model consistent.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.00%. Comparing base (c3fd37c) to head (51f6b6d).

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #115   +/-   ##
=========================================
  Coverage     95.00%   95.00%           
  Complexity       35       35           
=========================================
  Files             4        4           
  Lines           100      100           
  Branches          9        9           
=========================================
  Hits             95       95           
  Misses            4        4           
  Partials          1        1           

Flag	Coverage Δ
unit-tests	95.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ruromero]

Verification Report — TC-5018

Task: DA API Spec: Add advisory attribution to RemediationInfo and release 2.0.10
Overall: PASS

Check	Verdict	Summary
Scope Containment	✅ PASS	PR modifies exactly api/v5/openapi.yaml as specified
Diff Size	✅ PASS	+19 lines across 1 file, proportionate to task
Commit Traceability	✅ PASS	Both commits reference TC-5018
Sensitive Patterns	✅ PASS	No secrets or credentials in added lines
CI Status	✅ PASS	Sourcery review passed
Acceptance Criteria	✅ PASS	All verifiable criteria satisfied
Verification Commands	✅ PASS	mvn validate and mvn generate-sources succeed
Test Quality	N/A	No test files in PR
Test Change Classification	N/A	No test files in PR

Review Comments (3 suggestions from sourcery-ai)

#	Suggestion	Status
1	format: uri on url properties	Addressed in commit 51f6b6d
2	pattern on advisory id field	Not adopted — diverse ID formats make single regex impractical
3	Check for existing advisory schema	Verified — no pre-existing schema exists

Correctness Details

• Generated Java model AdvisoryInfo.java (225 lines): id as @Nonnull, title/url as @Nullable, url typed as URI
• Generated TypeScript model AdvisoryInfo.ts (59 lines): correct fields and types
• RemediationInfo.java updated with advisory field typed as AdvisoryInfo with @Nullable annotation

Post-merge remaining: Acceptance criterion 5 (release 2.0.10) is a post-merge activity.

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.11.0.

[a-oren]

LGTM