feat(rescoring): Harmonise and fix rescoring scopes

[8R0WNI3]

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes open-component-model/open-delivery-gear#106

Special notes for your reviewer:

Release note:

The latest rescoring is now always also the effective one (the specificity is not considered anymore)

The `artefact` scope will now restrict the rescoring to the exact artefact (ignoring its version). Previously, it was applied to all artefacts sharing the same name and type.

An empty artefact kind and/or type is now also supported for the `component` and `global` scopes

The `version` property (if present) is now purged from the extra identity in case the `artefact` scope is used

[coderabbitai]

📝 Walkthrough

Walkthrough

Rescoring selection logic changed to order candidates purely by creation date rather than scope specificity. Artefact identity construction for scoped rescorings now strips the version field from extra identity for ARTEFACT scope and gates artefact fields by scope. Finding-to-rescoring matching logic was updated to compare normalized, version-stripped extra identities.

Changes

Rescoring logic updates

Layer / File(s)	Summary
Rescoring selection by creation date only src/util.js, src/findings.js	orderRescoringsBySpecificity removed; mostSpecificRescoring now sorts solely by meta.creation_date descending; findingIsResolved calls mostSpecificRescoring(...).data.severity directly.
Artefact identity scoping and version stripping src/rescoring.js, src/util.js	scopedComponentArtefactId strips version from extra identity for ARTEFACT scope and only populates artefact fields for ARTEFACT/SINGLE scopes; filterRescoringsForFinding strips version from both finding and rescoring extra identities and compares them via normaliseExtraIdentity, with artefact_kind/artefact_type treated as optional match criteria.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant findingIsResolved
  participant mostSpecificRescoring
  participant Rescorings

  findingIsResolved->>mostSpecificRescoring: mostSpecificRescoring(applicable_rescorings)
  mostSpecificRescoring->>Rescorings: sort by meta.creation_date (desc)
  Rescorings-->>mostSpecificRescoring: sorted list
  mostSpecificRescoring-->>findingIsResolved: most recent rescoring.data.severity

Loading

Poem

A rabbit hopped through code so neat,
Stripped the version, made scope complete,
No more specificity-first delay,
Newest rescoring wins the day! 🐰
Thump thump — the tests all pass, hooray!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise, specific, and matches the main rescoring-scope changes.
Linked Issues check	✅ Passed	The code updates match #845 and #106 by removing version from artefact extra identity and making severity depend on creation time.
Out of Scope Changes check	✅ Passed	The changes stay within rescoring scope handling and related finding resolution logic, with no clear unrelated additions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The description follows the template and includes issue linkage and release notes; only the overview section is left blank.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[8R0WNI3]

@coderabbitai review

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/util.js`:
- Around line 148-151: `mostSpecificRescoring()` is mutating its input by
calling `sort()` directly on the `rescorings` array, which can reorder
`finding.rescorings` and `rescoring.applicable_rescorings` unexpectedly. Update
the function to sort a shallow copy instead of the original array, while keeping
the existing creation-date comparison and return of the first item.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4ce2d551-7903-4ad2-9c45-234a809ef656

📥 Commits

Reviewing files that changed from the base of the PR and between b084dac and 3d560b0.

📒 Files selected for processing (3)

• src/findings.js
• src/rescoring.js
• src/util.js

[zkdev]

/lgtm