[fffinkel]

Description

Policy condition expressions may now return a string instead of a bool. A non-blank string records a violation and uses the string as the violation message. A blank string records no violation. Boolean expressions behave as before.

The message is stored on the violation and included in POLICY_VIOLATION and NEW_POLICY_VIOLATIONS_SUMMARY notifications, including the default email, Slack, Teams, and Mattermost templates.

This lets a policy explain what matched, for example which CVE or which license, without the consumer re-deriving it from the subject.

Implements ADR 043 (#7322).

Addressed Issue

Refs #6553. A follow-up PR will have the legacy condition builders (EPSS, severity, CWE, vulnerability ID, license, license group) generate string-returning expressions so existing policies get messages too.

Additional Details

• Result type is checked at compile time for COMPONENT policies. Expressions must return bool or string, otherwise the API rejects the condition. VULNERABILITY policies stay unchecked, as today.
• Messages are trimmed and truncated to 1024 characters. POLICYVIOLATION.TEXT changes from VARCHAR to TEXT (no table rewrite in Postgres).
• Violation reconciliation upserts the message. A changed message updates the existing row without re-triggering a NEW_POLICY_VIOLATIONS notification. RETURNING (xmax = 0) distinguishes inserted from updated rows.
• cel.bind is enabled on the compiler to make string construction less repetitive. Runtime evaluation failures are unchanged: logged, treated as not violated.
• New message fields on the PolicyViolation and NewPolicyViolationsSummarySubject.Violation protobuf messages.

Docs PR: DependencyTrack/docs#304

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have updated the migration changelog accordingly
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly
• This PR is a substantial change (per the ADR criteria), and I have added an ADR under docs/adr/

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 9 complexity

Metric	Results
Complexity	9

View in Codacy

🟢 Coverage 95.08% diff coverage

Metric	Results
Coverage variation	Report missing for 859ed8e1
Diff coverage	✅ 95.08% diff coverage (70.00%)

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (859ed8e)	Report Missing	Report Missing	Report Missing
Head commit (a197621)	45870	40286	87.83%

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#7641)	61	58	95.08%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[nscuro]

A few minor adjustments please, otherwise this looks good to go.