[BUG] Remove unused data-model values and dead code paths #293

Summary

Several enum values and code paths exist in the data model and the vulnerability configuration handling but are never produced or are unreachable: an image version source that is never written, a relationship type and an update finding type that nothing creates, two vulnerability sources no provider reports, and a Trivy "base URL missing" path that startup validation makes impossible. They suggest features that do not exist, show up as UI labels and test fixtures, and make the area documents describe behavior that cannot happen. They are removed, and the remaining "registered by" field of an image version gets documented semantics.

Area

• docs/areas/image-catalog.md, docs/areas/base-images.md, docs/areas/update-detection.md, docs/areas/vulnerabilities.md (added in [Docs] Describe the current behavior by area #263); also docs/areas/web-ui.md (dashboard configuration hint).
• Security area: None (no schema change; see Implementation notes).

Current behavior

All enums are persisted as integers (no HasConversion for them; e.g. b.Property<int>("Source"), b.Property<int>("RelationshipType"), b.Property<int>("Type") in src/DockerUpdateGuard.Data/Migrations/DockerUpdateGuardDbContextModelSnapshot.cs:185, :263, :316, :374, :678), and every member has an explicit number.

1. ImageVersionSource.RegistryMetadata is never written; the field is last-writer-wins. src/DockerUpdateGuard.Data/Entities/ImageVersionSource.cs:31 (RegistryMetadata = 4). Writers only set ObservedImage (ImageRegistrationService.cs:68, DockerHubAccountImageDiscoveryService.cs:211), RuntimeContainer (RuntimeContainerScanOrchestrator.cs:582) and BaseImageResolution (ImageScanOrchestrator.cs:598), each overwriting the previous value of a shared catalog entry. No production code reads ImageVersion.Source (only tests, e.g. RuntimeContainerScanOrchestratorTests.cs:168).
2. ImageRelationshipType.BuildStage is never produced. src/DockerUpdateGuard.Data/Entities/ImageRelationshipType.cs:21. The only writer creates BaseImage (ImageScanOrchestrator.cs:621); every reader filters on BaseImage (SharedBaseImageQueryService.cs:94, :181, LiveImageInventoryQueryService.cs:99, ApplicationViewService.cs:890, :1181, ApplicationTelemetry.cs:151, ImageScanOrchestrator.cs:530).
3. UpdateFindingType.BaseImageUpdate is never created. src/DockerUpdateGuard.Data/Entities/UpdateFindingType.cs:16. Findings are created only as RuntimeImageUpdate / TagRecommendation (RuntimeContainerScanOrchestrator.cs:877-879) and DerivedBaseRuntimeUpdate (base-runtime findings). The value is only formatted for the UI (ApplicationViewService.cs:678, "Base image update") and used as test data (ApplicationViewServiceTests.cs:334, VulnerabilityEnrichmentServiceTests.cs:193, src/Tests/DockerUpdateGuard.Data.Tests/MappingTests.cs:219).
4. Trivy "base URL missing" is unreachable. Validation requires TrivyBaseUrl when vulnerability scanning is enabled with provider Trivy (src/DockerUpdateGuard/Configuration/DockerUpdateGuardOptionsValidator.cs:139-144, options registered with ValidateOnStart, ServiceCollectionExtensions.cs:53-56), and the Trivy provider is only resolved when Enabled is true and Provider is Trivy (src/DockerUpdateGuard/Vulnerabilities/VulnerabilityProviderResolver.cs:62-76). Still present:
   • not-configured branch TrivyVulnerabilityProvider.cs:269-274 with message VulnerabilityProviderMessages.TrivyBaseUrlNotConfigured (VulnerabilityProviderMessages.cs:14) and log TrivyNotConfigured (TrivyVulnerabilityProviderLogging.cs:14-18, event id 3420);
   • dashboard hint VulnerabilityConfigurationHintKind.TrivyBaseUrlMissing (src/DockerUpdateGuard/UI/VulnerabilityConfigurationHintKind.cs:21), resolved in VulnerabilityConfigurationHintResolver.cs:40-44 from a scan-run message containing "TrivyBaseUrl is not configured", rendered in src/DockerUpdateGuard/Components/Pages/Dashboard.razor:127-131;
   • tests for these paths: TrivyVulnerabilityProviderTests.cs:334 (…ReturnsNotConfiguredWithoutBaseUrlAsync), ApplicationViewServiceTests.cs:2897 (…DashboardTrivyNotConfiguredReportsTrivyBaseUrlHintAsync), DashboardRenderTests.cs:103 (DashboardWithMissingTrivyBaseUrlRendersWarningBanner).
5. VulnerabilitySource.RegistryAdvisory and VulnerabilitySource.Manual are never produced. src/DockerUpdateGuard.Data/Entities/VulnerabilitySource.cs:26, :31. The source is derived from the provider kind only (VulnerabilityEnrichmentService.cs:108-116: DockerScout, Trivy, else NotSet); both values are only formatted for the UI (ApplicationViewService.cs:716-717).

Expected behavior

• ImageVersionSource has NotSet = 0, ObservedImage = 1, RuntimeContainer = 2, BaseImageResolution = 3; RegistryMetadata is removed. Decision on semantics: the field records which kind of component registered or last refreshed the image version and is informational only — last writer wins, no logic may depend on it. This is stated in the XML documentation of ImageVersion.Source and in docs/areas/image-catalog.md.
• ImageRelationshipType has NotSet = 0, BaseImage = 1; BuildStage is removed.
• UpdateFindingType has NotSet = 0, RuntimeImageUpdate = 2, TagRecommendation = 3, DerivedBaseRuntimeUpdate = 4; BaseImageUpdate = 1 is removed and its number is not reused. The UI formatting has no branch for it.
• VulnerabilitySource has NotSet = 0, Trivy = 1, DockerScout = 2; RegistryAdvisory and Manual are removed, with their UI labels.
• The Trivy not-configured branch, its message constant, its log method, the TrivyBaseUrlMissing hint kind, its resolver branch and its dashboard banner are removed. The remaining hints (scanning disabled, Docker Hub credentials missing) behave as today; VulnerabilityConfigurationHintKind keeps the numbers of the remaining members.
• Remaining enum members keep their numeric values (they are stored as integers).

Acceptance criteria

• The enum members listed above are removed; no remaining member changes its number.
• The UI formatters (FormatUpdateFindingType, FormatVulnerabilitySource) no longer have branches for removed values; unknown values still fall back to the existing default (type.ToString() / "Not set").
• TrivyVulnerabilityProvider no longer returns not configured; the Trivy-related hint is gone from VulnerabilityConfigurationHintKind, VulnerabilityConfigurationHintResolver and Dashboard.razor.
• Tests that used removed values are rewritten to use produced values (ApplicationViewServiceTests.cs:334, VulnerabilityEnrichmentServiceTests.cs:193, MappingTests.cs:219); tests of removed paths are deleted (TrivyVulnerabilityProviderTests.cs:334, ApplicationViewServiceTests.cs:2897, DashboardRenderTests.cs:103), and the remaining hint tests still pass.
• A test proves that a row with a removed numeric value still materializes (e.g. MappingTestsUpdateFindingWithRetiredTypeValueLoads) and that the UI formats it without error (e.g. ApplicationViewServiceFormatUpdateFindingTypeUnknownValueFallsBack).
• dotnet ef migrations has-pending-model-changes (or an equivalent check) reports no pending model change; no migration is added.
• The area documents docs/areas/image-catalog.md, docs/areas/base-images.md, docs/areas/update-detection.md and docs/areas/vulnerabilities.md describe the new behavior and their Known gaps entries for these items are removed; docs/areas/web-ui.md no longer lists the Trivy hint.

Implementation notes

• Persistence / migration impact: enums are stored as int columns without check constraints (the only check constraints on these tables are CK_ImageRelationships_ChildAndBaseDifferent and CK_ImageRelationships_DepthGreaterThanZero). Removing enum members changes no column, index or constraint, so the EF model snapshot does not change and no migration is required. Since no production code ever wrote the removed values, existing databases should contain none; if one exists (e.g. from manual edits), EF materializes it as an undefined enum value without failing, and the UI shows the fallback label. A data migration is therefore not recommended. RelationshipType is part of the unique index on ImageRelationships — unaffected.
• Trivy provider: after removing the not-configured branch, the URL comes from validated options. Read it inside the existing try block (TrivyVulnerabilityProvider.cs:276-330) so that a theoretically missing value (e.g. a test that bypasses validation) ends as failed ("Trivy scan failed: …") through the existing catch instead of an unhandled exception; do not add a new configuration status. Free the log event id 3420 (do not reuse it for another message).
• Keep the ExternalOperationResult.NotConfigured status itself: other clients (Docker Scout, Portainer, Docker Hub) still use it (guarantee in .squad/project.md).
• XML documentation of the changed enums and of ImageVersion.Source must be updated; regions stay as they are.
• docs/ARCHITECTURE.md (Data layer) — update if it lists the removed values.
• No configuration change; README.md's TrivyBaseUrl row ("Required for Trivy") stays correct.
• DockerHubBaseImageResolver dead code is tracked in F-031 (P3) — DockerHubBaseImageResolver is dead code #9 and is out of scope here.

Related

• F-031 (P3) — DockerHubBaseImageResolver is dead code #9 (DockerHubBaseImageResolver is dead code) — related cleanup, out of scope.
• [Docs] Describe the current behavior by area #263 (area documents).

Generated by Claude Code