graph: surface referrers + deletions in the query/CLI core (part of #205) - #208
Merged
Conversation
Adds the CLI/query slice of #205 (graph-service + dashboard follow to come): - queries.referrers(ref|digest, depth): REFERS_TO edges (referrer -> subject) with artifactType, recursive for referrers-of-referrers. - Occurrence nodes now carry deletedAt/deleteReason; show() reports the deletion tombstone and the subject's referrers. - New cssc-graph referrers command; show/export surface deletion. - Export labels disambiguate occurrences by short digest and mark deleted nodes; referrer edges label with artifactType. 47 cssc_graph + 16 graph-service tests pass; referrers verified against the live data branch. Refs #205
Contributor
There was a problem hiding this comment.
Pull request overview
Surfaces REFERS_TO referrer relationships and deletion tombstones in the shared cssc_graph query/export layer and CLI, so the CLI (and later graph-service/dashboard) can display referrers and deleted occurrences alongside existing supply-chain path traversal.
Changes:
- Added
queries.referrers()traversal forREFERS_TOedges (includingartifactType) and surfaced referrers + deletion state inshow(). - Enhanced export labeling to disambiguate occurrences by short digest and mark deleted nodes; edge labels now include referrer
artifactType. - Added
cssc-graph referrersCLI command and expanded test coverage for referrers/deletions/labels/CLI.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| apps/python-app/libs/cssc_graph/tests/test_queries.py | Adds tests covering referrers query behavior, show() deletion/referrer surfacing, label formatting, and the new CLI command. |
| apps/python-app/libs/cssc_graph/cssc_graph/queries.py | Implements referrers() query traversal, deletion fields in occurrence reads, and updated export labeling for nodes/edges. |
| apps/python-app/libs/cssc_graph/cssc_graph/cli.py | Adds referrers subcommand and updates text output to display referrer artifact types and deletion tombstones. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Key REFERS_TO edge dedup on (from, to, artifactType, observedAt) so distinct observations/artifact types between the same pair are kept (matching the indexer's append-only merge), and fix the seen_edges type annotation to the 4-tuple. - referrers() now loops range(depth): depth=0 returns only the subject, consistent with traverse(). Add a test for it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First slice of #205 — the CLI + query core (graph-service and dashboard surfacing follow separately, as agreed).
What
Referrers and deletions are indexed (from #201/#202) but the query/visualization layer only traversed
MIRRORED_FROM/PROMOTED_FROM/BUILT_FROM. This exposes them:queries.referrers(ref|digest, depth)— returns theREFERS_TOedges (referrer → subject) withartifactType, recursively (referrers-of-referrers, e.g. a signature on an SBOM).deletedAt/deleteReason;show()reports the tombstone and the subject's referrers.cssc-graph referrerscommand (--ref/--digest,--depth,--format text|json).artifactTypein mermaid/cytoscape and text.Validation
cssc_graphsuite: 47 passed (5 new — referrers query, show referrers, show marks deleted, node-label disambiguation, CLIreferrers).graph-service: 16 passed (shared query layer; additive node fields).cssc-graph referrers --ref golden/python@<digest>shows the in-toto referrer edge.Follow-up (rest of #205)
graph-serviceendpoint /includeparam for referrers + deletion, and the dashboard observability view.Refs #205