cravex2-reachability: Report and process reachability results

[pombredanne]

Display and report the reachability determination, including ranking

[ziadhany]

@pombredanne I need your input here. Could you explain a bit more about how we want the reachability status and ranking to work? Should this be part of the reachability pipeline in ScanCode.io, with the results included in the output JSON file, or should it be displayed in the UI, similar to the vulnerabilities count?

[ziadhany]

Let's say we have Flask-1.1.4

pallets/flask@089cb86
Affected Resources V1:

• CHANGES.rst

• src/flask/
  |- app.py: REACHABLE
  |- ctx.py: UNKNOWN
  |- sessions.py: REACHABLE
  |- templating.py: UNKNOWN

• tests/
  |- test_basic.py NOT_REACHABLE

pallets/flask@70f906c
Affected Resources V2:

• src/flask/
  |- sessions.py UNKNOWN

• tests/
  |- test_basic.py REACHABLE

---

Every resource will have a reachability status for every patch URL, which means we may have duplicate statuses for the same resource across different commits.

For example:

• V1 sessions.py is REACHABLE

• V1 ctx.py is NOT_REACHABLE

• V1 templating.py is UNKNOWN

• V2 sessions.py is UNKNOWN

• V2 test_basic.py is REACHABLE

The reachability statuses should be determined and ranked. Because it is difficult to definitively determine if an entire commit is reachable, we can determine its overall status using one of two methods:

• The Safe Assumption: If a commit contains at least one REACHABLE resource, the overall status of the commit is considered REACHABLE. If there are no reachable resources, but at least one UNKNOWN resource, the status falls back to UNKNOWN else NOT_REACHABLE

• Weighted Scoring: We can rank commits by assigning weights to statuses ( REACHABLE = 10, UNKNOWN = 5, NOT_REACHABLE = 0 ) and dividing the sum by the total number of resources to get an average reachability score.

Example for V1: (10 + 0 + 10 + 5 + 0) / 5 resources = Score: 5.0 UNKNOWN
Example for V2: (5 + 10) / 2 resources = Score: 7.5 ~= 8 REACHABLE

[ziadhany]

This is done now. For every affected resource, we have a reachability report. For every advisory, if a fix commit contains at least one REACHABLE resource, the overall status of the commit is considered REACHABLE. If there are no reachable resources but at least one UNKNOWN resource, the status falls back to UNKNOWN; otherwise, it is NOT_REACHABLE.

see:

• Create pipeline for symbol reachability #2151

An example of the pipeline output:

reachability-2026-08-28-21-28-18.json