Invoke MavenResolverExtrator when scanning pom.xml

[cuixq]

#35

In this PR, MavenResolverExtrator is invoked when scanning pom.xml to report vulnerabilities in transitive dependencies.
However, the default Maven extractor is still being used with offline mode.

[cuixq]

this is to avoid import cycle :(

[oliverchang]

I think this makes sense also. the OSV-Scanner ErrAPIFailed seems like it should be kept just to OSV-specific API calls.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 66.66667% with 11 lines in your changes missing coverage. Please review.

Project coverage is 65.30%. Comparing base (ace9154) to head (5e603d7).

Files	Patch %	Lines
pkg/osvscanner/osvscanner.go	70.96%	6 Missing and 3 partials ⚠️
internal/resolution/datasource/maven_registry.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1028      +/-   ##
==========================================
+ Coverage   65.28%   65.30%   +0.01%     
==========================================
  Files         150      150              
  Lines       12498    12525      +27     
==========================================
+ Hits         8159     8179      +20     
- Misses       3879     3882       +3     
- Partials      460      464       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[oliverchang]

AWESOME!

[oliverchang]

I think this makes sense also. the OSV-Scanner ErrAPIFailed seems like it should be kept just to OSV-specific API calls.

[G-Rath]

sorry, after posting my review and seeing all my comments together it's very clear they're all just a single comment 😅:

comparing locally is different from comparing offline - only the latter requires the former; we should continue checking if we're offline, not if we're comparing locally

[cuixq]

@another-rex @G-Rath PTAL- thanks!

[oliverchang]

LGTM, but are your concerns addressed @G-Rath ?

[another-rex]

LGTM, though the test packages seem to have a lot of vulnerabilities though, can we pick one with only a few vulns?

[cuixq]

I updated the fixtures with the example in the blog post.