Let the caller state the project's version

--version replaces the commit hash on the cover and the project page, for
generate and from-folder alike. Without it the report still falls back to
repository_version from the metadata, else the scanned commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

report_generator/context.py

@@ -61,6 +61,7 @@ def build_context(
     *,
     project: str | None = None,
     manufacturer: str | None = None,
+    version: str | None = None,
 ) -> dict[str, Any]:
     """Build the report context from a scan's parsed artifacts.
 
@@ -70,6 +71,7 @@ def build_context(
             ``vulnerabilities`` -- each absent where the scan stored none.
         project: The project name the caller supplied. Wins over the one in the metadata.
         manufacturer: The manufacturer the caller supplied. The artifacts never name one.
+        version: The version the caller supplied. Wins over the one in the metadata.
 
     Returns:
         The context :func:`layout.render_pdf`
@@ -78,11 +80,12 @@ def build_context(
     """
     metadata = documents.get("metadata") or {}
     project = project or (metadata.get("configuration") or {}).get("repository_name")
+    version = version or _version(metadata)
     tools = _tools(documents.get("findings"))
     sca = summarize_vdr(documents["vulnerabilities"]) if documents.get("vulnerabilities") else None
 
     context: dict[str, Any] = {
-        "cover": _cover(sources, metadata, tools, sca, project=project, manufacturer=manufacturer),
+        "cover": _cover(sources, tools, sca, project=project, manufacturer=manufacturer, version=version),
         "summary": _summary(tools, sca, documents.get("metrics")),
         "sections": ([_sca_section(sca)] if sca is not None else [])
         + [_tool_section(name, report) for name, report in tools],
@@ -90,7 +93,7 @@ def build_context(
 
     # Without the pipeline's metadata or cloc's count this page would be nothing but gaps.
     if metadata or documents.get("cloc"):
-        context["project"] = _project(metadata, project, documents.get("cloc"))
+        context["project"] = _project(project, version, documents.get("cloc"))
 
     critical = _critical(tools, sca)
 
@@ -181,12 +184,12 @@ def _stated(value: Any) -> str:  # noqa: ANN401
 
 def _cover(
     sources: ReportSources,
-    metadata: dict[str, Any],
     tools: list[tuple[str, SarifReport]],
     sca: VdrReport | None,
     *,
     project: str | None,
     manufacturer: str | None,
+    version: str | None,
 ) -> dict[str, Any]:
     """The first page."""
     technologies = ([SCA] if sca is not None else []) + [name for name, _ in tools]
@@ -200,7 +203,7 @@ def _cover(
         "identity": [
             _fact("Manufacturer", manufacturer),
             _fact("Project", project),
-            _fact("Version", _version(metadata), kind="mono"),
+            _fact("Version", version, kind="mono"),
             _fact("Technology", ", ".join(technologies) or None, gap=True),
             _fact("Report Created", datetime.now(UTC).strftime("%A, %B %d, %Y")),
             _fact("Scan Identifier", sources.scan_id, kind="mono"),
@@ -248,14 +251,14 @@ def _version(metadata: dict[str, Any]) -> str | None:
     return commit if isinstance(commit, str) and _COMMIT.fullmatch(commit) else None
 
 
-def _project(metadata: dict[str, Any], project: str | None, cloc: dict[str, Any] | None) -> dict[str, Any]:
+def _project(project: str | None, version: str | None, cloc: dict[str, Any] | None) -> dict[str, Any]:
     """What was scanned, and how much of it there is, as cloc counted it."""
     return {
         "id": "project",
         "title": "Project Information",
         "overview": [
             _fact("Project", project),
-            _fact("Version", _version(metadata), kind="mono"),
+            _fact("Version", version, kind="mono"),
             _fact("Analysed lines of code", f"{cloc['code']:,} in {cloc['files']:,} files" if cloc else None),
         ],
         "languages": {"title": "Main languages", "rows": _languages(cloc)},