Add toc and include all findings in the report

report_generator/rendering.py

@@ -27,13 +27,19 @@ if TYPE_CHECKING:
 # which stage produced it; the first one a scan carries wins.
 INPUTS = {
     "metadata": ("metadata.json", "meta.json"),
-    "findings": ("sast_scanner_ranked.sarif", "polygraph.sarif", "sast_scanner_combined.sarif", "prism.sarif"),
+    "findings": (
+        "merged.sarif",
+        "sast_scanner_ranked.sarif",
+        "polygraph.sarif",
+        "sast_scanner_combined.sarif",
+        "prism.sarif",
+    ),
     "vulnerabilities": ("vdr.json", "vdr-2.json", "vdr-3.json"),
 }
 
-# What a report cannot be built without. The rest is reported as far as it was found: a scan that
-# ran only half the pipeline is a shorter report, not a refusal.
-REQUIRED = ("metadata",)
+# A report needs at least one of these to have anything to say. The rest is reported as far as it
+# was found: a scan that ran only half the pipeline is a shorter report, not a refusal.
+REQUIRED_ANY = ("findings", "vulnerabilities")
 
 # What the file is called. The scan it is about is in the name, because a directory of these is
 # otherwise unreadable.
@@ -50,17 +56,15 @@ def render(sources: ReportSources, metrics: dict[str, Any] | None = None) -> tup
         The file name the report should be saved under, and its bytes.
 
     Raises:
-        PipelineError: The scan is missing an input the report cannot be built
-            without, or one of its documents cannot be parsed. Both are reported
-            by name: "no PDF was produced" leaves whoever ran it guessing which
-            stage of their pipeline did not finish.
+        PipelineError: The scan carries neither findings nor vulnerabilities, or
+            one of its documents cannot be parsed. Both are reported by name: "no
+            PDF was produced" leaves whoever ran it guessing which stage of their
+            pipeline did not finish.
     """
     documents = {name: _parsed(sources, name, candidates) for name, candidates in INPUTS.items()}
     documents["metrics"] = metrics
-    missing = [name for name in REQUIRED if documents.get(name) is None]
-
-    if missing:
-        message = f"Scan {sources.scan_id} carries no {' and no '.join(missing)}, so no report can be built."
+    if all(documents.get(name) is None for name in REQUIRED_ANY):
+        message = f"Scan {sources.scan_id} carries no {' and no '.join(REQUIRED_ANY)}, so no report can be built."
 
         raise PipelineError(message)