Add null guard for input.v0.osv in aliased_records rule

[Copilot]

Iterating input.v0.osv in aliased_records without a null check causes a type error when osv is null or absent, breaking evaluation entirely.

Changes

• baseline/high-risk-vulnerability.rego: Added input.v0.osv != null guard before iterating in aliased_records, consistent with the pattern in malware-block.rego

aliased_records[k] := records if {
    input.v0.osv != null  # added
    some v_seed in input.v0.osv
    some k in vuln_keys(v_seed)
    records := {v | some v in input.v0.osv; k in vuln_keys(v)}
}

Existing tests test_no_match_null_osv and test_no_match_missing_osv cover both failure modes.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• openpolicyagent.org
  • Triggering command: /usr/bin/curl curl -L -o /tmp/opa REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Adds a null guard (input.v0.osv != null) to the aliased_records rule in high-risk-vulnerability.rego to prevent type errors when osv is null or absent, matching the existing defensive pattern used in malware-block.rego.

Changes:

• Added input.v0.osv != null guard before iterating input.v0.osv in the aliased_records rule

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.