up

src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS.Windows.Chocolatey/ChocolateyPackageAnalyzer.cs

@@ -33,13 +33,15 @@ internal sealed class ChocolateyPackageAnalyzer : OsPackageAnalyzerBase
 
     public override string AnalyzerId => "windows-chocolatey";
 
-    protected override ValueTask<IReadOnlyList<OSPackageRecord>> ExecuteCoreAsync(
+    protected override ValueTask<ExecutionResult> ExecuteCoreAsync(
         OSPackageAnalyzerContext context,
         CancellationToken cancellationToken)
     {
         var records = new List<OSPackageRecord>();
-        var warnings = new List<string>();
+        var warnings = new List<AnalyzerWarning>();
+        var evidenceFactory = OsFileEvidenceFactory.Create(context.RootPath, context.Metadata);
         var chocolateyFound = false;
+        var scannedLibDirs = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
 
         foreach (var chocoPath in ChocolateyPaths)
         {
@@ -49,12 +51,18 @@ internal sealed class ChocolateyPackageAnalyzer : OsPackageAnalyzerBase
                 continue;
             }
 
+            var normalizedDir = Path.GetFullPath(libDir);
+            if (!scannedLibDirs.Add(normalizedDir))
+            {
+                continue;
+            }
+
             chocolateyFound = true;
             Logger.LogInformation("Scanning Chocolatey packages in {Path}", libDir);
 
             try
             {
-                DiscoverPackages(libDir, records, warnings, cancellationToken);
+                DiscoverPackages(context.RootPath, evidenceFactory, libDir, records, warnings, cancellationToken);
             }
             catch (Exception ex) when (ex is not OperationCanceledException)
             {
@@ -65,31 +73,33 @@ internal sealed class ChocolateyPackageAnalyzer : OsPackageAnalyzerBase
         if (!chocolateyFound)
         {
             Logger.LogInformation("Chocolatey installation not found; skipping analyzer.");
-            return ValueTask.FromResult<IReadOnlyList<OSPackageRecord>>(EmptyPackages);
+            return ValueTask.FromResult(ExecutionResult.FromPackages(EmptyPackages));
         }
 
         if (records.Count == 0)
         {
             Logger.LogInformation("No Chocolatey packages found; skipping analyzer.");
-            return ValueTask.FromResult<IReadOnlyList<OSPackageRecord>>(EmptyPackages);
+            return ValueTask.FromResult(ExecutionResult.FromPackages(EmptyPackages));
         }
 
         foreach (var warning in warnings.Take(10))
         {
-            Logger.LogWarning("Chocolatey scan warning: {Warning}", warning);
+            Logger.LogWarning("Chocolatey scan warning ({Code}): {Message}", warning.Code, warning.Message);
         }
 
         Logger.LogInformation("Discovered {Count} Chocolatey packages", records.Count);
 
         // Sort for deterministic output
         records.Sort();
-        return ValueTask.FromResult<IReadOnlyList<OSPackageRecord>>(records);
+        return ValueTask.FromResult(ExecutionResult.From(records, warnings));
     }
 
     private void DiscoverPackages(
+        string rootPath,
+        OsFileEvidenceFactory evidenceFactory,
         string libDir,
         List<OSPackageRecord> records,
-        List<string> warnings,
+        List<AnalyzerWarning> warnings,
         CancellationToken cancellationToken)
     {
         IEnumerable<string> packageDirs;
@@ -112,7 +122,7 @@ internal sealed class ChocolateyPackageAnalyzer : OsPackageAnalyzerBase
                 continue;
             }
 
-            var record = AnalyzePackage(packageDir, warnings, cancellationToken);
+            var record = AnalyzePackage(rootPath, evidenceFactory, packageDir, warnings, cancellationToken);
             if (record is not null)
             {
                 records.Add(record);
@@ -121,8 +131,10 @@ internal sealed class ChocolateyPackageAnalyzer : OsPackageAnalyzerBase
     }
 
     private OSPackageRecord? AnalyzePackage(
+        string rootPath,
+        OsFileEvidenceFactory evidenceFactory,
         string packageDir,
-        List<string> warnings,
+        List<AnalyzerWarning> warnings,
         CancellationToken cancellationToken)
     {
         // Look for .nuspec file
@@ -143,7 +155,9 @@ internal sealed class ChocolateyPackageAnalyzer : OsPackageAnalyzerBase
             var parsed = NuspecParser.ParsePackageDirectory(dirName);
             if (parsed is null)
             {
-                warnings.Add($"Could not parse package info from {packageDir}");
+                warnings.Add(AnalyzerWarning.From(
+                    "windows-chocolatey/unparseable-package-dir",
+                    $"Could not parse package info from {Path.GetFileName(packageDir)}"));
                 return null;
             }
 
@@ -173,12 +187,14 @@ internal sealed class ChocolateyPackageAnalyzer : OsPackageAnalyzerBase
         var files = metadata.InstalledFiles
             .Where(f => IsKeyFile(f))
             .Take(100)  // Limit file evidence
-            .Select(f => new OSPackageFileEvidence(
-                f,
-                layerDigest: null,
-                sha256: null,
-                sizeBytes: null,
-                isConfigFile: IsConfigFile(f)))
+            .Select(f =>
+            {
+                var fullPath = Path.Combine(packageDir, f);
+                var relativePath = OsPath.TryGetRootfsRelative(rootPath, fullPath) ?? OsPath.NormalizeRelative(f);
+                return relativePath is null ? null : evidenceFactory.Create(relativePath, IsConfigFile(f));
+            })
+            .Where(static file => file is not null)
+            .Select(static file => file!)
             .ToList();
 
         return new OSPackageRecord(