feat: including metric table in Console

[Rexbeast2]

fixes: #3214

[codecov-commenter]

Codecov Report

Merging #3215 (c686fb7) into main (8f10390) will decrease coverage by 4.82%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main    #3215      +/-   ##
==========================================
- Coverage   80.47%   75.66%   -4.82%     
==========================================
  Files         722      722              
  Lines       11209    11237      +28     
  Branches     1502     1508       +6     
==========================================
- Hits         9020     8502     -518     
- Misses       1785     2406     +621     
+ Partials      404      329      -75     

Flag	Coverage Δ
longtests	75.66% <100.00%> (-4.82%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Changed	Coverage Δ
cve_bin_tool/output_engine/console.py	95.54% <100.00%> (+0.05%)	⬆️
test/test_output_engine.py	96.75% <100.00%> (+0.07%)	⬆️

... and 14 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[terriko]

This looks good in and of itself but needs some related changes:

1. A test to make sure this is printed and we don't accidentally regress it in a future change.
2. Documentation to show this table and explain what it's for, preferably with some links to EPSS on the assumption that only some of our users will have any idea what the acronym stands for.
3. What happens here if the metrics table isn't populated with EPSS? Do we get a table with just CVSS or will it throw an error? Do we need a flag to toggle EPSS on/off? (I think I'd rather EPSS default to on, but given the number of network issues we've seen with NVD I don't think it would be too much of a surprise if some people wanted to disable it)

[Rexbeast2]

@terriko
1- I am currently writing test cases and will update this PR by tomorrow.
2- I was thinking of first adding EPSS in output and then creating a separate issue and PR to including EPSS , metrics table and updating database schema in documentation. A separate PR just for documentation.( just don't want to make output PR messy)
3- if for a given CVE epss metrics is not present if by default output "-" in place. Image in issue show an example of this.
And flag for EPSS would be added later. Goal of this PR is to just include metrics in output. Enhancement of output will be done in next few PR.

[terriko]

Having the docs in a separate issue works for me! And yes, I agree that a flag would have to be a separate PR, but no harm in preparing so these PRs can handle a lack of data appropriately via a bit of error handling.

[terriko]

(The tests can also be in separate PRs if you really want, but I find it easier to have those go together with code personally. I'm less picky about docs as long as they're coming soon.)

[Rexbeast2]

@terriko Only docs will be included in separate PR. the test will be included in this PR.

[Rexbeast2]

@terriko Can have a look at why this test case is failing cause there are passing in my own local fork and on my machine. And I am just curious to see it pass window long test while failing every other.

[terriko]

The spell check job is just giving me a message that says "error" so I'm going to re-run it and see if it behaves or can at least give me an error message that we can actually resolve.

[terriko]

Curiosity about the failing spell check aside: if #3224 was a replacement for this PR then maybe this one can be closed?

[Rexbeast2]

@terriko @anthonyharrison told me to add it for now. In the future, we may remove any one of them depending on which reviews.

[terriko]

Ok, do you still want this one merged, then?

[terriko]

(I already merged #3224 )

[Rexbeast2]

@terriko we can merge them for now. And depending on review from user we will keep either this or the other console. (Which user prefer the most or which get more positive review)

[terriko]

Okay, let's get this merged then!