refactor(hardened): remove UBI recommendation code and configuration

[a-oren]

Summary

• Remove all UBI (Universal Base Image) recommendation code, configuration, and tests from the backend
• The Hummingbird-powered Hardened Images provider (TC-4809) now serves dynamic image recommendations, making the static UBI config-based mappings redundant
• Set imageMapping template parameter to "[]" to preserve UI compatibility

Changes

• Delete UBIRecommendation.java config interface and ubi/ package
• Remove UBI import, @Inject field, getUBIRecommendation() method, and mergedRecommendations.putAll() call from TrustifyIntegration.java
• Remove UBI import, @Inject field, and getImageMapping() method from ReportTemplate.java
• Remove all trustedcontent.recommendation.ubi.* properties from application.properties
• Remove UBI mock setup and testProcessRecommendationsWithSbomId test from TrustifyResponseHandlerTest.java
• Update RecommendationAggregation.java comment to remove UBI reference
• Update batch_report.json to remove UBI recommendation fixture data
• Update CONVENTIONS.md directory tree to remove ubi/ entry

Implements TC-4971

Summary by Sourcery

Remove legacy UBI-based image recommendation support in favor of the hardened image provider while preserving report template compatibility.

Enhancements:

• Remove UBI recommendation integration from TrustifyIntegration and report generation flows, relying solely on the hardened image provider.
• Simplify report template image mapping configuration by replacing UBI-derived mappings with an empty mapping placeholder string for UI compatibility.
• Clean up obsolete UBI configuration properties, tests, fixtures, and documentation references.

Documentation:

• Update conventions documentation to drop the UBI provider entry from the module layout.

Tests:

• Delete UBI-specific recommendation processing test coverage and related mocked dependencies from TrustifyResponseHandlerTest.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Refactors the trusted-content integration by removing the legacy UBI-based image recommendation configuration and plumbing in favor of the hardened image provider, simplifying report templating and preserving UI compatibility with a static empty imageMapping.

File-Level Changes

Change	Details	Files
Remove UBI recommendation plumbing from Trustify integration and tests so recommendations now come solely from the hardened image provider.	Delete UBIRecommendation injection and helper method that converted SBOM IDs to UBI recommendations. Stop merging UBI-based recommendations into the indexed recommendation map in processRecommendations. Remove the SBOM_ID-based UBI recommendation test and associated UBIRecommendation mocking from TrustifyResponseHandlerTest.	src/main/java/io/github/guacsec/trustifyda/integration/providers/trustify/TrustifyIntegration.java src/test/java/io/github/guacsec/trustifyda/integration/providers/trustify/TrustifyResponseHandlerTest.java
Simplify report templating by removing dynamic UBI image mapping and replacing it with a static empty imageMapping to keep the UI contract stable.	Remove UBIRecommendation injection and helper method that built a JSON image mapping from config. Set the imageMapping template variable to the literal string "[]" instead of a generated JSON array.	src/main/java/io/github/guacsec/trustifyda/integration/report/ReportTemplate.java
Remove UBI recommendation configuration, implementation, and documentation from the project.	Delete the UBIRecommendation configuration interface and its package. Remove all trustedcontent.recommendation.ubi.* entries from application.properties. Update RecommendationAggregation Javadoc to drop UBI-specific wording while still documenting legacy single-value support. Update conventions docs and test fixtures to remove UBI-related entries and data.	src/main/java/io/github/guacsec/trustifyda/integration/providers/trustify/ubi/UBIRecommendation.java src/main/resources/application.properties src/main/java/io/github/guacsec/trustifyda/integration/providers/trustify/RecommendationAggregation.java CONVENTIONS.md src/test/resources/__files/reports/batch_report.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.97%. Comparing base (5a0b9c4) to head (eb391d0).

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #647      +/-   ##
============================================
- Coverage     57.19%   56.97%   -0.23%     
+ Complexity      878      871       -7     
============================================
  Files            92       92              
  Lines          5021     4999      -22     
  Branches        690      688       -2     
============================================
- Hits           2872     2848      -24     
- Misses         1841     1842       +1     
- Partials        308      309       +1     

Flag	Coverage Δ
integration-tests	56.97% <100.00%> (-0.23%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
.../providers/trustify/RecommendationAggregation.java	82.47% <ø> (-2.07%)	⬇️
...ration/providers/trustify/TrustifyIntegration.java	78.11% <ø> (-0.85%)	⬇️
.../trustifyda/integration/report/ReportTemplate.java	84.74% <100.00%> (-2.22%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[a-oren]

Verification Report for TC-4971 (commit ad6eae7)

Check	Result	Details
Review Feedback	N/A	No review feedback on this PR
Root-Cause Investigation	N/A	No sub-tasks created
Scope Containment	WARN	RecommendationAggregationTest.java in task spec but not in PR diff (reviewed, no UBI refs found — no changes needed)
Diff Size	PASS	8 files, +6/-152 — proportionate for code removal task
Commit Traceability	PASS	Commit references TC-4971 via "Implements TC-4971"
Sensitive Patterns	PASS	No secrets or credentials in added lines
CI Status	PASS	All 3 checks pass (Integration Tests, Sourcery review, commitlint)
Acceptance Criteria	PASS	11 of 11 criteria met
Test Quality	N/A	No new test code; Eval Quality: N/A
Test Change Classification	REDUCTIVE	Test for deleted UBI feature removed (justified — tested non-existent code)
Verification Commands	PASS	mvn spotless:apply + mvn verify passed (296 tests, 0 failures)

Overall: WARN

Scope Containment is WARN because RecommendationAggregationTest.java appears in the task's Files to Modify but was not changed in the PR. The task specified "review and update UBI-specific test cases" — after review, the file contained no UBI references, so no changes were needed. This is a justified omission.

All functional checks pass. CI green. All 11 acceptance criteria satisfied.

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.13.2.

[ruromero]

LGTM