fix: openvex report oci id bug

[robert-cronin]

Summary of changes

Adds logic to qualify the actual SHA of the patched image
Changes patch.go to uses the correct pURL format (e.g. nginx@sha256:...) for the namespace for oci container names
Falls back to patchedImageName if digest not found.

Fixes #667

Validation

Vex report output from a test run on nginx, the tail of the generated vex report:

[codecov]

Codecov Report

Attention: Patch coverage is 54.54545% with 15 lines in your changes missing coverage. Please review.

Project coverage is 48.25%. Comparing base (d13288e) to head (d9c1031).

Files with missing lines	Patch %	Lines
pkg/patch/patch.go	54.54%	14 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #928      +/-   ##
==========================================
+ Coverage   48.12%   48.25%   +0.13%     
==========================================
  Files          18       18              
  Lines        2261     2292      +31     
==========================================
+ Hits         1088     1106      +18     
- Misses       1114     1126      +12     
- Partials       59       60       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ashnamehrotra]

LGTM, thank you! Can we update the golang.org/x/crypto package for vuln-check and fix lint errs?

[sozercan]

i think linter failure is due to incompat between go 1.24 and golang-ci lint version. opened #930 to bump linter

[Copilot]

PR Overview

This PR addresses the openvex report OCI ID bug by adding logic to qualify the patched image’s SHA and use the correct image format for generating the report.

• Added logic to determine the repository name with digest using a new helper function.
• Updated vex document generation to use the qualified image name.
• Modified the error handling in patchWithContext to explicitly capture and return errors.

Reviewed Changes

File	Description
pkg/patch/patch.go	Introduces a new helper (getRepoNameWithDigest) to derive image names with digest and updates usage in vex report generation.

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

pkg/patch/patch.go:403

• [nitpick] Consider adding tests for the new getRepoNameWithDigest function to verify its behavior in both success and failure cases.

// e.g. "docker.io/library/nginx:1.21.6-patched"

[sozercan]

can we do this without docker cli?

[robert-cronin]

I’m wondering if we could make use of the BuildKit exporter response, since it should include the digest of the patched image. The challenge is that this information only becomes available once we’ve finished generating the VEX report, because everything happens within the same build command. I’d really appreciate any tips or guidance on how to make that work!