Rework OWASP mapping importers as shared eval fixtures

[northdpole]

Summary

• Keep the landed Add standalone OWASP Kubernetes resource importers #953/Add standalone OWASP AI and Top 10 resource importers #960 JSON as eval/test gold behind application.utils.mapping_fixtures (list / load / load_all).
• Collapse the six OWASP mapping parsers onto OwaspMappingFixtureParser so they are no longer production catalog sources.
• CLI flags stay opt-in and are labeled eval gold, not import-all.

Follow-up: rebase #1088 so B2 scoring loads this same gold (force-push after this lands).

Test plan

• python -m unittest application.tests.owasp_mapping_fixtures_test application.tests.owasp_aisvs_parser_test application.tests.owasp_api_top10_2023_parser_test application.tests.owasp_llm_top10_2025_parser_test application.tests.owasp_top10_2025_parser_test application.tests.owasp_kubernetes_top10_2022_parser_test application.tests.owasp_kubernetes_top10_2025_parser_test application.tests.cheatsheets_parser_test
• CI green, then maintainer admin rebase-merge

Made with Cursor

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Advanced

Run ID: 777fd7b3-9eb7-4b36-ab90-f275b3c61e40

📥 Commits

Reviewing files that changed from the base of the PR and between 96a3344 and ad27d81.

📒 Files selected for processing (12)

• application/cmd/cre_main.py
• application/tests/owasp_mapping_fixtures_test.py
• application/utils/external_project_parsers/parsers/cheatsheets_parser.py
• application/utils/external_project_parsers/parsers/owasp_aisvs.py
• application/utils/external_project_parsers/parsers/owasp_api_top10_2023.py
• application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2022.py
• application/utils/external_project_parsers/parsers/owasp_kubernetes_top10_2025.py
• application/utils/external_project_parsers/parsers/owasp_llm_top10_2025.py
• application/utils/external_project_parsers/parsers/owasp_mapping_fixture_parser.py
• application/utils/external_project_parsers/parsers/owasp_top10_2025.py
• application/utils/mapping_fixtures.py
• cre.py

💤 Files with no reviewable changes (1)

• application/cmd/cre_main.py

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Summary by CodeRabbit

• New Features

  • Added support for loading OWASP evaluation mappings from standardized fixtures.
  • Added fallback resolution for related CRE mappings, including Kubernetes 2025 entries.
  • Added consistent OWASP and CRE links to imported standards.

• Bug Fixes

  • Improved handling of missing or invalid mapping fixtures with clearer errors.
  • Corrected fixture-based path resolution for OWASP cheatsheet mappings.

• Documentation

  • Updated OWASP CLI option descriptions to clarify that they use evaluation mapping fixtures.

Walkthrough

The change adds shared OWASP mapping fixture utilities and a common parser base. OWASP parser classes now declare fixture names instead of duplicating JSON loading and CRE-linking logic. Tests cover fixture APIs and fallback resolution. CLI descriptions and fixture paths are updated.

Changes

OWASP mapping parser consolidation

Layer / File(s)	Summary
Fixture loading and CRE resolution application/utils/mapping_fixtures.py, application/tests/owasp_mapping_fixtures_test.py	Adds fixture discovery, JSON loading, validation, fallback CRE resolution, and linked standard construction. Tests cover these APIs and fixture shapes.
Shared OWASP parser implementation application/utils/external_project_parsers/parsers/owasp_mapping_fixture_parser.py, application/utils/external_project_parsers/parsers/owasp_*	Adds the shared parser base and moves six OWASP parsers to fixture-name declarations with optional Kubernetes fallback fixtures.
Fixture path and CLI integration application/utils/external_project_parsers/parsers/cheatsheets_parser.py, application/cmd/cre_main.py, cre.py	Uses the shared fixture directory, keeps Kubernetes imports local, and updates OWASP CLI help descriptions to reference evaluation mapping fixtures.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Refactor

Merge Risk: ⚪ Minimal · up to ad27d

No merge-blocking behavior issue was identified in the fixture-parser consolidation.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 41.18% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 17 functions across 11 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: consolidating OWASP mapping importers around shared evaluation fixtures.
Description check	✅ Passed	The description directly explains the shared fixture module, parser consolidation, CLI labeling, and test plan. It is related to the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/owasp-mapping-fixture-loader

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}