google
feat: support comparing Alpine versions locally
This introduces support for comparing Alpine versions locally using the same logic as the apk package manager, along with a generator for generating fixtures.
There is a bit of fuzziness in the behaviour across different versions of apk - the alpine:3.x docker images all use apk v2.x, which is what the fixture generator uses too and at least apk v2.14 (which is used by alpine:3.19) and v2.10 pass; however the current latest upcoming version of apk technically fails on approximately 30 fixtures which I think is because it has fixed https://gitlab.alpinelinux.org/alpine/abuild/-/issues/10088.
Beyond that I was able to find a handful of other edge cases where the comparison results between these versions was different, but they all seemed to be primarily around the handling of invalid versions which are not expected to be present in OSV data anyway and they look to be the result of bugfixes meaning we'd need special "anti" handling to support in a way that ensures valid versions are still compared correctly, so I think it's good enough to ship.
Resolves #952
Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:
Project coverage is 64.97%. Comparing base (
804589a) to head (03a4545).
Additional details and impacted files
@@ Coverage Diff @@
## main #980 +/- ##
==========================================
+ Coverage 64.47% 64.97% +0.49%
==========================================
Files 148 149 +1
Lines 12088 12257 +169
==========================================
+ Hits 7794 7964 +170
+ Misses 3843 3842 -1
Partials 451 451
:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.
