Report the scanned commit as the project version

The pipeline leaves repository_version empty, but tags the Dependency-Track
upload with the commit it scanned. Use that when no version is stated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

report_generator/context.py

@@ -52,6 +52,9 @@ SEVERITY_OF_LEVEL = {
 
 SEVERITY_ORDER = ("Critical", "High", "Medium", "Low")
 
+# A full git commit SHA.
+_COMMIT = re.compile(r"[0-9a-f]{40}")
+
 
 def build_context(
     sources: ReportSources,
@@ -167,7 +170,6 @@ def _cover(
     manufacturer: str | None,
 ) -> dict[str, Any]:
     """The first page."""
-    configuration = metadata.get("configuration") or {}
     technologies = [name for name, _ in tools] + (["SCA"] if sca is not None else [])
 
     return {
@@ -180,7 +182,7 @@ def _cover(
             _fact("Scan Identifier", sources.scan_id, kind="mono"),
             _fact("Technology", ", ".join(technologies) or None),
             _fact("Project", project, gap=True),
-            _fact("Version", configuration.get("repository_version")),
+            _fact("Version", _version(metadata), kind="mono"),
             _fact("Report Created", datetime.now(UTC).strftime("%A, %B %d, %Y")),
             _fact("Manufacturer", manufacturer),
         ],
@@ -250,16 +252,31 @@ def _stage(stage: dict[str, Any], sources: ReportSources) -> dict[str, Any]:
     }
 
 
+def _version(metadata: dict[str, Any]) -> str | None:
+    """What version of the project was scanned: the stated one, else the commit the SBOM was uploaded for.
+
+    The pipeline leaves ``repository_version`` empty but tags the Dependency-Track upload with the
+    commit it scanned, which is the most precise version there is.
+    """
+    configuration = metadata.get("configuration") or {}
+    stated = configuration.get("repository_version")
+
+    if stated:
+        return str(stated)
+
+    commit = (configuration.get("deptrace_upload") or {}).get("project_version")
+
+    return commit if isinstance(commit, str) and _COMMIT.fullmatch(commit) else None
+
+
 def _project(metadata: dict[str, Any], project: str | None) -> dict[str, Any]:
     """What was scanned."""
-    configuration = metadata.get("configuration") or {}
-
     return {
         "id": "project",
         "title": "Project Information",
         "overview": [
             _fact("Project", project),
-            _fact("Version", configuration.get("repository_version")),
+            _fact("Version", _version(metadata), kind="mono"),
             # Nothing in the pipeline counts lines, so nothing here can report them.
             _fact("Analysed lines of code", None),
         ],