Support and log timeout for SCANOSS

[JustinWonjaePark]

Description

This PR supports passing the timeout (-t, --timeout) parameter to the SCANOSS scanner and improves error logging and reporting when a timeout occurs.

Changes

• SCANOSS Timeout Configuration: Pass the -t value to the SCANOSS Scanner constructor (defaults to 120s, aligning with ScanCode).
• Timeout Handling:
  • Detect SCANOSS API timeouts in the output buffer.
  • Log a warning (SCANOSS skipped (Timeout)) and write detailed error info to the debug log.
  • Set appropriate Cover sheet comments (SCANOSS replaced with KB if KB succeeded, otherwise SCANOSS skipped).
• Help Message: Update the -t option description to show that it applies to both ScanCode and SCANOSS.

[coderabbitai]

Warning

Review limit reached

@JustinWonjaePark, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 58 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a1a2c9ed-f130-42a5-b6ed-64fef5dbd681

📥 Commits

Reviewing files that changed from the base of the PR and between 25196e1 and 43ec79a.

📒 Files selected for processing (2)

• src/fosslight_source/cli.py
• src/fosslight_source/run_scanoss.py

📝 Walkthrough

Walkthrough

The SCANOSS scanner now receives the configured timeout and marks scans skipped for API-limit or request-timeout output. Skip state flows through run_scanners() into report generation, which updates the cover comment accordingly. CLI help now documents the timeout for both ScanCode and SCANOSS.

Changes

SCANOSS timeout and skip reporting

Layer / File(s)	Summary
SCANOSS timeout and skip detection src/fosslight_source/run_scanoss.py, src/fosslight_source/_help.py	run_scanoss_py() accepts and applies a timeout, detects API-limit and request-timeout messages, returns skip state, and CLI help describes the timeout for both scanners.
Skip state and report wiring src/fosslight_source/cli.py	run_scanners() propagates scanoss_skipped to report generation, which selects either “SCANOSS replaced with KB” or “SCANOSS skipped”.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant run_scanners
  participant run_scanoss_py
  participant Scanner
  participant create_report_file
  run_scanners->>run_scanoss_py: pass configured timeout
  run_scanoss_py->>Scanner: start SCANOSS scan with timeout
  Scanner-->>run_scanoss_py: return captured output
  run_scanoss_py-->>run_scanners: return result and skip state
  run_scanners->>create_report_file: pass scanoss_skipped
  create_report_file-->>run_scanners: set report cover comment

Loading

Possibly related PRs

• fosslight/fosslight_source_scanner#264: Both changes modify the SCANOSS integration and its wiring through cli.py.

Suggested labels: enhancement

Suggested reviewers: soimkim

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is related to the main change: adding timeout support for the SCANOSS scanner, despite being a bit duplicated and noisy.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/set-scanoss-timeout

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

src/fosslight_source/run_scanoss.py (2)

52-52: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Catch a more specific exception for missing dependencies.

Catching Exception here is overly broad and might mask unexpected issues. Since the goal is to check whether the scanoss package is installed, it is safer to catch importlib_metadata.PackageNotFoundError.

♻️ Proposed refactor

-    except Exception as error:
+    except importlib_metadata.PackageNotFoundError as error:

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/fosslight_source/run_scanoss.py` at line 52, Update the dependency-check
import handling around the `scanoss` package lookup to catch only
`importlib_metadata.PackageNotFoundError` instead of the broad `Exception`,
while preserving the existing missing-package behavior and allowing unexpected
errors to propagate.

Source: Linters/SAST tools

---

62-101: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Differentiate between scanning and parsing errors.

The try block spanning lines 62-98 covers both the scan execution and the result parsing. However, the except block on line 99 logs the error as SCANOSS Parsing, which can be misleading if the failure actually occurred during the scan execution phase.

Consider splitting the try...except blocks or updating the error message to accurately reflect the failure context.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/fosslight_source/run_scanoss.py` around lines 62 - 101, Differentiate
failures in the SCANOSS execution from failures in result parsing within the
surrounding scan flow. Update the exception handling around Scanner
initialization and scan_folder_with_options to log a scanning-specific error,
while the JSON loading and parsing path should log a parsing-specific error;
preserve the existing skip detection and result-processing behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/fosslight_source/run_scanoss.py`:
- Line 52: Update the dependency-check import handling around the `scanoss`
package lookup to catch only `importlib_metadata.PackageNotFoundError` instead
of the broad `Exception`, while preserving the existing missing-package behavior
and allowing unexpected errors to propagate.
- Around line 62-101: Differentiate failures in the SCANOSS execution from
failures in result parsing within the surrounding scan flow. Update the
exception handling around Scanner initialization and scan_folder_with_options to
log a scanning-specific error, while the JSON loading and parsing path should
log a parsing-specific error; preserve the existing skip detection and
result-processing behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 98fbdb05-6b09-4b3a-884f-acbda33ee618

📥 Commits

Reviewing files that changed from the base of the PR and between c8b93d0 and 25196e1.

📒 Files selected for processing (3)

• src/fosslight_source/_help.py
• src/fosslight_source/cli.py
• src/fosslight_source/run_scanoss.py