Fix empty dependency list page
Summary
SBOM occurrences are overridden with each ingestion of SBOM reports, which is expected behavior. In the case of CS for registry, this leads to an empty dependency list, causing CVS to run only for the registry image and not for the container scanning configured in the project.
Steps to reproduce
- Set up a container scanning job for the project.
- Activate the CS for registry feature in security settings.
- Push a new image, which will override all previously identified occurrences and dependencies
What is the current bug behavior?
Old occurrences are overridden in case of cs for registry.
What is the expected correct behavior?
Old occurrences should persist in case of cs for registry.
Possible fixes
Add a filter during SBOM ingestion to create new records when the occurrence source is a registry.