Keep image versions enriched by a run out of its stale finding pass

src/DockerUpdateGuard/Images/VulnerabilityEnrichmentService.cs

@@ -323,18 +323,24 @@ private async Task<int> UpsertVulnerabilityFindingsAsync(ScanRun scanRun,
     }
 
     /// <summary>
-    /// Deactivate active vulnerability findings whose image version is no longer part of the live inventory
+    /// Deactivate active vulnerability findings whose image version is neither part of the live inventory nor enriched by the current run
     /// </summary>
     /// <param name="scanRun">Owning scan run</param>
+    /// <param name="processedImageVersionIds">Identifiers of the image versions enriched by the current run</param>
     /// <param name="cancellationToken">Cancellation token</param>
     /// <returns>Number of deactivated findings</returns>
-    private async Task<int> DeactivateStaleFindingsAsync(ScanRun scanRun, CancellationToken cancellationToken)
+    private async Task<int> DeactivateStaleFindingsAsync(ScanRun scanRun,
+                                                         IReadOnlyCollection<Guid> processedImageVersionIds,
+                                                         CancellationToken cancellationToken)
     {
         var liveImageVersionIds = await _liveImageInventoryQueryService.GetLiveImageVersionIdsAsync(cancellationToken).ConfigureAwait(false);
-        var liveImageVersionIdList = liveImageVersionIds.ToList();
+
+        // Image versions enriched by this run are never stale for this run, no matter whether their enrichment succeeded or failed
+        var retainedImageVersionIds = liveImageVersionIds.Union(processedImageVersionIds)
+                                                         .ToList();
 
         var staleFindings = await _dbContext.VulnerabilityFindings.Where(entity => entity.IsActive
-                                                                                   && liveImageVersionIdList.Contains(entity.ImageVersionId) == false)
+                                                                                   && retainedImageVersionIds.Contains(entity.ImageVersionId) == false)
                                                                   .ToListAsync(cancellationToken)
                                                                   .ConfigureAwait(false);
 
@@ -396,6 +402,9 @@ await _dbContext.SaveChangesAsync(cancellationToken)
                                                        .ToListAsync(cancellationToken)
                                                        .ConfigureAwait(false);
 
+            var processedImageVersionIds = images.Select(entity => entity.Id)
+                                                 .ToList();
+
             processedImageCount = images.Count;
 
             if (processedImageCount == 0)
@@ -422,7 +431,9 @@ await _dbContext.SaveChangesAsync(cancellationToken)
                                 .ConfigureAwait(false);
             }
 
-            var deactivatedFindingCount = await DeactivateStaleFindingsAsync(scanRun, cancellationToken).ConfigureAwait(false);
+            var deactivatedFindingCount = await DeactivateStaleFindingsAsync(scanRun,
+                                                                             processedImageVersionIds,
+                                                                             cancellationToken).ConfigureAwait(false);
 
             if (deactivatedFindingCount > 0)
             {