Create pipeline for symbol reachability

[ziadhany]

Issues

• cravex2-reachability: Create pipeline for symbol reachability #1756

Changes

Add Pipeline(s) that can retrieve vulnerable / fix symbols, collect local symbols (pur2sym) and match them
Pipeline Graph:

flowchart TD
    %% Main Entry Point
    Start([collect_and_store_symbol_reachability_results]) --> GetResources[Filter candidate_resources]
    GetResources --> GroupPatches[Group fixed_in_patches by vcs_url]
    GroupPatches --> RepoLoop{For each repository}

    %% Repository Processing
    RepoLoop -->|Process Repo| GitContext[GitRepositoryContext]
    GitContext -->|Clone & Enter| PatchLoop{For each patch}
    
    %% Patch Processing
    PatchLoop -->|Next Patch| GitCheckout[Checkout commit_hash]
    GitCheckout --> GenReport[generate_reachability_report]
    
    %% Patch Analysis Stage
    GenReport --> PatchAnalyzer[PatchAnalyzer.collect_patch_symbols]
    PatchAnalyzer --> AnalyzeDiff[Get Diff & Changed Files]
    AnalyzeDiff --> PatchAnalyzeLoop[Analyze vulnerable & fixed texts]
    PatchAnalyzeLoop --> DetectLang[detect_language_with_scancode]
    DetectLang --> ParsePatchAST[LanguageQuery.parse_code_to_ast]
    ParsePatchAST --> ExtractPatchSymbols[SymbolExtractor: Extract Changed Symbols]
    ExtractPatchSymbols --> DiffSymbols[diff_changed_symbols]
    DiffSymbols --> ResourceLoop{For each candidate_resource}

    %% Resource Matching Stage
    ResourceLoop -->|Next Resource| LangCheck{Language matches patch?}
    LangCheck -->|No| ResourceLoop
    LangCheck -->|Yes| ResAnalyzer[ResourceAnalyzer.build_index]
    
    ResAnalyzer --> ParseResAST[Parse Resource to AST]
    ParseResAST --> IndexResSymbols[Extract definitions, imports, calls]
    IndexResSymbols --> Matcher[ResourcePatchMatcher.match]
    
    Matcher --> MatchVuln[Match Vulnerable Symbols]
    Matcher --> MatchFixed[Match Fixed Symbols]
    
    MatchVuln & MatchFixed --> CheckEvidence{Evidence found?}
    CheckEvidence -->|No| ResourceLoop
    
    %% Reporting Stage
    CheckEvidence -->|Yes| Classify[classify_reachability]
    Classify --> StatusReach[REACHABLE / POTENTIALLY / NOT_REACHABLE]
    StatusReach --> UpdateData[Update resource.extra_data]
    UpdateData --> ResourceLoop

    %% Loop Backs and Exit
    ResourceLoop -->|All resources checked| PatchLoop
    PatchLoop -->|All patches checked| RepoLoop
    RepoLoop -->|All repos checked| End([End Process])

    %% Styling
    classDef functionNode fill:#e1f5fe,stroke:#03a9f4,stroke-width:2px;
    classDef logicNode fill:#fff3e0,stroke:#ff9800,stroke-width:2px;
    classDef loopNode fill:#f3e5f5,stroke:#9c27b0,stroke-width:2px;
    
    class Start,GenReport,PatchAnalyzer,ResAnalyzer,Matcher,Classify functionNode;
    class RepoLoop,PatchLoop,ResourceLoop loopNode;
    class LangCheck,CheckEvidence logicNode;

Loading

Checklist

• I have read the contributing guidelines
• I have linked an existing issue above
• I have added unit tests covering the new code
• I have reviewed and understood every line of this PR

[ziadhany]

The pipeline requires the unidiff dependency to parse diffs/patch text

[ziadhany]

This depends on:

• Migrate VulnerableCode integration to API v3 #2148

We have an API support for patching VulnerableCode, see:

• fedcode-next: Support UI and API for patches and diffs vulnerablecode#2152

[ziadhany]

I'm not sure if we need to update all these dependency. I just ran uv add unidiff, which updated it automatically.

[ziadhany]

I'm also not sure why Run unit tests on macOS / run-unit-tests (3.13) is failing.

[TG1999]

@ziadhany try to fix the failing test please

[TG1999]

You should only go for reachability if collect_symbols_reachability has called it, not for every VCIO call

[TG1999]

Add explaination comment

[TG1999]

Add docstring please

[TG1999]

@ziadhany this mostly looks good, let's have a session soon and do a demo and understand the limitations of the current approach

[tdruez]

Is this absolutely needed? No built-in solutions available?

[tdruez]

analyze_symbols_reachability / collect_symbols_reachability
We need consistency, same for step and pipe names