fix(snyk-report): Improve calculation of latest patch release

[olivergondza]

The script is used by https://github.com/argoproj/argo-cd/actions/workflows/update-snyk.yaml

Last successful run is from March 16, on March 17 there was commit tagged with v3.0.0-rc1 breaking the calculation. The calculation used to rely on the fact that the minor version can be correctly decremented to get to the previous version.

Checklist:

• [x] Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
• [x] The title of the PR states what changed and the related issues number (used for the release note).
• [x] The title of the PR conforms to the Toolchain Guide
• [x] I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
• [n/a] I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
• [] Does this PR require documentation updates?
• [n/a] I've updated documentation as required by this PR.
• [x] I have signed off all my commits as required by DCO
• [n/a] I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• [ ] My build is green (troubleshooting builds).
• [n/a] My new feature complies with the feature status guidelines.
• [x] I have added a brief description of why this PR is necessary and/or what this PR solves.
• [x] Optional. My organization is added to USERS.md.
• [x] Optional. For bug fixes, I've indicated what older releases this fix should be cherry-picked into (this may or may not happen depending on risk/complexity).

[bunnyshell[bot]]

:x: Preview Environment deleted from Bunnyshell

Available commands (reply to this comment):

• :rocket: /bns:deploy to deploy the environment

[olivergondza]

This was verified manually - up to a point of actual snyk invocation. To be "fully" verified by the GH Actions invocation after merge.

[olivergondza]

I'm a little confused about why the reports were not available although you mentioned the reason. Would you mind providing a better explanation for why the report was failing?

Sure, before any report generation, it calculates recent 3-4 argo versions - latest patch of every minor "stream". To do so, it used to separate the 2 from, say, 14 and find previous stream by decrementing 14 and so on. This works well iff minor version number is above 4, that it was for quite some time, but it is not any longer on 3.0. So it ended up chocking on 3.-1 stream...

New impl takes latest tags from sorted lists, thus being agnostic to problems like that.

[olivergondza]

Did you try testing this on your fork?

I did test that it produces the desirable version numbers to run the report against. What I did not test is the snyk service integration (code i did not touch) as I do not have the credentials / snyk account.

[nitishfy]

Did you try testing this on your fork?

I did test that it produces the desirable version numbers to run the report against. What I did not test is the snyk service integration (code i did not touch) as I do not have the credentials / snyk account.

Yep! That's the problem. Testing that thing on the fork is difficult due to lack of credentials. I'll let some other maintainer touch this PR. cc @rumstead

[codecov[bot]]

Codecov Report

:white_check_mark: All modified and coverable lines are covered by tests. :white_check_mark: Project coverage is 60.11%. Comparing base (81ac621) to head (ada3aa3). :warning: Report is 414 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #23223      +/-   ##
==========================================
+ Coverage   60.09%   60.11%   +0.02%     
==========================================
  Files         342      342              
  Lines       57845    57845              
==========================================
+ Hits        34760    34775      +15     
+ Misses      20314    20311       -3     
+ Partials     2771     2759      -12     

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

[crenshaw-dev]

Huge improvement! https://github.com/argoproj/argo-cd/pull/23245/files

@olivergondza do you have time for a follow-up PR? A couple things to fix would be:

1. re-introduce "master" to the generated list
2. return to reverse-chronological order in the generated doc (i.e. most recent minor version first)

[olivergondza]

@crenshaw-dev, yeah, let me take a look