fix(scan): a source nobody configured is not a source that failed

[maksimtech]

The defect (audit finding PR-05)

Without VULDB_API_KEY, which is how most installations run, no scan could end in an all-clear:

⚠️  VulDB no_api_key: set VULDB_API_KEY to use VulDB — results for 7-zip are incomplete
… one line per target …
⚠️  VulDB answered for none of the 8 targets scanned — every CVE above comes from NVD, MSRC, CISA KEV.

"no CVEs found" needs every source to have answered, so it never appeared. Over HTTP, VulDB's refusal sat in errors of every scan.

A mock hid it. The autouse fixture vuldb_offline_by_default replaced the VulDB collector, in the CLI and the API, with one returning nothing. Its own docstring said why: otherwise the missing key "breaks every test that asserts errors == []".

Fix

• CLI _scan_target and API _scan_one query VulDB only when its key is set.
• The silent-sources summary counts only the sources that were asked, so VulDB is never named as one that answered.
• A scan without the key says once: ℹ️ VulDB was not asked: set VULDB_API_KEY to add it to the scan.
• The conftest fixture now only removes VULDB_API_KEY from the environment. This is isolation, not a mock.
• vuldb.fetch_cves still refuses before any request without a key. The NIS2 evidence test checks this.
• README: VulDB's status says it needs the key.

Tests (TDD, no mocks in the new file)

• The mock was removed first. Seven existing tests then failed (test_collector_failures, test_scan_hardening, test_scan_source_outage), as did the two new behaviour tests. That is the defect in the real configuration.
• New file tests/test_scan_unconfigured_source.py. NVD answers from the recording nvd_no_results.json, MSRC with 404, KEV with conftest's cached empty catalogue. It checks:
  • "no CVEs found" and no "incomplete";
  • VulDB never asked;
  • the information line printed once;
  • the API's errors hold the other sources' 503s and nothing from VulDB;
  • the summary of a 2-target scan with NVD down reads "every CVE above comes from MSRC, CISA KEV."
• Changed: test_nis2_evidence.py::test_the_web_scan_asks_debian_and_the_command_line_scan_does_not now checks what it is about (no debian_fetch in the CLI scan) instead of the exact old loop line.
• Mutation check: 4 mutations (CLI fan-out, API fan-out, summary, information line), each caught.
• Windows: 2095 passed. WSL: 2054 passed. ruff and mypy: clean.
• Real run: patchradar scan zzqxnonexistentproduct --days 2 now prints no CVEs found in last 2 days and the one information line.

This PR adds an entry at the top of ### Fixed, like #56. Whichever is merged second will need a one-line conflict fixed, which I'll do by merging main into it.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed]

Merging this PR will not alter performance

⚠️ 11 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• test_add_to_watchlist
• test_get_watchlist
• test_init_db
• test_api_cves_filtered
• test_api_cve_detail
• test_get_cves
• test_api_cves
• test_nvd_fetch_cves
• test_get_cves_by_software
• test_api_watchlist
• …and 1 more

✅ 17 untouched benchmarks

---

_{Comparing fix/an-unconfigured-source-is-not-a-failed-one (d878419) with main (314e04a)}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud