Refactor type assertions in malwareMatcher.ts with proper type aliases

[Copilot]

Complex as unknown as {...} type assertions were used instead of leveraging existing interface properties and proper type aliases.

Changes

• Remove redundant type assertions: withdrawnAt, publishedAt, and updatedAt are already defined on MalwareAdvisoryNode — access them directly
• Add EnumeratedPackage type alias: Replaces inline intersection type in enumeratePackages return type
• Add PkgLike type alias: Replaces inline object type for package iteration

Before

if ((adv as unknown as { withdrawnAt?: string | null }).withdrawnAt) continue;
const pub = new Date((adv as unknown as { publishedAt?: string }).publishedAt || 0);
const pkgAny = pkg as unknown as { purl?: string; externalRefs?: Array<...>; ... };

After

if (adv.withdrawnAt) continue;
const pub = new Date(adv.publishedAt || 0);
const pkgAny = pkg as unknown as PkgLike;

Original prompt

Please apply the following diffs and create a pull request.
Once the PR is ready, give it a title based on the messages of the fixes being applied.

[{"message":"Type assertion to unknown then to specific type is overly complex and indicates missing proper type definitions. Consider extending the MalwareAdvisoryNode interface to include the withdrawnAt property.","fixFiles":[{"filePath":"src/malwareMatcher.ts","diff":"diff --git a/src/malwareMatcher.ts b/src/malwareMatcher.ts\n--- a/src/malwareMatcher.ts\n+++ b/src/malwareMatcher.ts\n@@ -112,7 +112,7 @@\n   const index = new Map<string, MalwareAdvisoryNode[]>();\n   for (const adv of advisories) {\n     // Ignore advisories that have been withdrawn\n-    if ((adv as unknown as { withdrawnAt?: string | null }).withdrawnAt) continue;\n+    if (adv.withdrawnAt) continue;\n     // Ignore advisories older than cutoff (must be before cutoff in BOTH publishedAt & updatedAt to be excluded)\n     if (cutoffDate) {\n       const pub = new Date((adv as unknown as { publishedAt?: string }).publishedAt || 0);\n"}]},{"message":"Type assertion to unknown then to specific type is overly complex and indicates missing proper type definitions. Consider extending the MalwareAdvisoryNode interface to include the updatedAt property.","fixFiles":[{"filePath":"src/malwareMatcher.ts","diff":"diff --git a/src/malwareMatcher.ts b/src/malwareMatcher.ts\n--- a/src/malwareMatcher.ts\n+++ b/src/malwareMatcher.ts\n@@ -112,11 +112,11 @@\n   const index = new Map<string, MalwareAdvisoryNode[]>();\n   for (const adv of advisories) {\n     // Ignore advisories that have been withdrawn\n-    if ((adv as unknown as { withdrawnAt?: string | null }).withdrawnAt) continue;\n+    if (adv.withdrawnAt) continue;\n     // Ignore advisories older than cutoff (must be before cutoff in BOTH publishedAt & updatedAt to be excluded)\n     if (cutoffDate) {\n-      const pub = new Date((adv as unknown as { publishedAt?: string }).publishedAt || 0);\n-      const upd = new Date((adv as unknown as { updatedAt?: string }).updatedAt || 0);\n+      const pub = new Date(adv.publishedAt || 0);\n+      const upd = new Date(adv.updatedAt || 0);\n       if (pub < cutoffDate && upd < cutoffDate) continue;\n     }\n     for (const vuln of adv.vulnerabilities) {\n"}]},{"message":"Complex inline type definition makes the function signature difficult to read. Consider extracting this intersection type to a separate type alias for better readability.","fixFiles":[{"filePath":"src/malwareMatcher.ts","diff":"diff --git a/src/malwareMatcher.ts b/src/malwareMatcher.ts\n--- a/src/malwareMatcher.ts\n+++ b/src/malwareMatcher.ts\n@@ -23,6 +23,12 @@\n   reason: string;\n }\n \n+// Type alias for packages used in enumeratePackages\n+export type EnumeratedPackage = SbomPackage & {\n+  externalRefs?: { referenceType?: string; referenceLocator?: string }[];\n+  versionInfo?: string;\n+};\n+\n // Map GitHub ecosystem enums to purl types\n const ecosystemToPurlType: Record<string, string> = {\n   ACTIONS: \"githubactions\",\n@@ -131,12 +137,12 @@\n   }\n \n   // Helper to enumerate packages with fallback to raw SPDX packages inside repoSbom.sbom if flattened list empty\n-  const enumeratePackages = (repo: RepositorySbom): Array<SbomPackage & { externalRefs?: { referenceType?: string; referenceLocator?: string }[]; versionInfo?: string }> => {\n+  const enumeratePackages = (repo: RepositorySbom): EnumeratedPackage[] => {\n     const explicit: SbomPackage[] = Array.isArray(repo.packages) ? repo.packages : [];\n-    if (explicit.length > 0) return explicit as Array<SbomPackage & { externalRefs?: { referenceType?: string; referenceLocator?: string }[]; versionInfo?: string }>;\n+    if (explicit.length > 0) return explicit as EnumeratedPackage[];\n     const rawMaybe: unknown = repo.sbom?.packages;\n     if (Array.isArray(rawMaybe)) {\n-      return rawMaybe as Array<SbomPackage & { externalRefs?: { referenceType?: string; referenceLocator?: string }[]; versionInfo?: string }>;\n+      return rawMaybe as EnumeratedPackage[];\n     }\n     return [];\n   };\n"}]},{"message":"Complex type assertion with inline type definition reduces code readability and maintainability. Consider defining a proper interface or type alias for this structure.","fixFiles":[{"filePath":"src/malwareMatcher.ts","diff":"diff --git a/src/malwareMatcher.ts b/src/malwareMatcher.ts\n--- a/src/malwareMatcher.ts\n+++ b/src/malwareMatcher.ts\n@@ -2,6 +2,16 @@\n import { RepositorySbom, SbomPackage } from \"./types.js\";\n import { createOctokit } from \"./octokit.js\";\n import fs from \"fs\";\n+\n+\n+// Type alias to improve readability for complex package shape\n+type PkgLike = {\n+  purl?: string;\n+  externalRefs?: Array<{ referenceType?: string; referenceLocator?: string }>;\n+  name?: string;\n+  version?: string;\n+  versionInfo?: string;\n+};\n import path from \"path\";\n import zlib from \"zlib\";\n import * as semver from \"semver\";\n@@ -146,7 +15...

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR refactors type assertions in malwareMatcher.ts to improve code readability and maintainability by introducing proper type aliases and removing redundant type casts.

Key Changes:

• Replaced complex as unknown as { ... } type assertions with direct property access for withdrawnAt, publishedAt, and updatedAt (properties already defined on MalwareAdvisoryNode)
• Introduced PkgLike type alias to replace inline object type definitions for package structures
• Introduced EnumeratedPackage type alias to replace verbose inline intersection types

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
src/malwareMatcher.ts	Adds two type aliases (PkgLike and EnumeratedPackage) and removes redundant type assertions by accessing properties directly from MalwareAdvisoryNode interface
package-lock.json	Contains unrelated lockfile changes removing "peer": true flags from multiple dependencies - appears accidental and should be addressed separately

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.