feat(shirabe): resolve advisory instanceof TODOs via AnySecurityAdvisory

Add an Ignored variant to the advisory enum (renamed to AnySecurityAdvisory)
so the PHP three-class hierarchy PartialSecurityAdvisory -> SecurityAdvisory
-> IgnoredSecurityAdvisory maps one-to-one onto enum variants.

Replace the hard-coded auditor downcasts with as_security_advisory()
(PHP `instanceof SecurityAdvisory`, true for both full and ignored) and
as_ignored(), implementing severity/cve/source ignore filtering, the
toIgnoredAdvisory conversion, and the table/plain row output faithfully.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

4 files changed, 19 insertions, 23 deletions

diff --git a/crates/shirabe/src/repository/advisory_provider_interface.rs b/crates/shirabe/src/repository/advisory_provider_interface.rs
index 6b94ca9..9d0c5ac 100644
--- a/crates/shirabe/src/repository/advisory_provider_interface.rs
+++ b/crates/shirabe/src/repository/advisory_provider_interface.rs
@@ -1,13 +1,13 @@
 //! ref: composer/src/Composer/Repository/AdvisoryProviderInterface.php
 
-use crate::advisory::{PartialOrFullSecurityAdvisory, PartialSecurityAdvisory, SecurityAdvisory};
+use crate::advisory::{AnySecurityAdvisory, PartialSecurityAdvisory, SecurityAdvisory};
 use indexmap::IndexMap;
 use shirabe_semver::constraint::AnyConstraint;
 
 #[derive(Debug)]
 pub struct SecurityAdvisoryResult {
     pub names_found: Vec<String>,
-    pub advisories: IndexMap<String, Vec<PartialOrFullSecurityAdvisory>>,
+    pub advisories: IndexMap<String, Vec<AnySecurityAdvisory>>,
 }
 
 pub trait AdvisoryProviderInterface {
diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs
index 0d2fa2f..f9fa551 100644
--- a/crates/shirabe/src/repository/composer_repository.rs
+++ b/crates/shirabe/src/repository/composer_repository.rs
@@ -14,7 +14,7 @@ use shirabe_semver::constraint::AnyConstraint;
 use shirabe_semver::constraint::MatchAllConstraint;
 use shirabe_semver::constraint::SimpleConstraint;
 
-use crate::advisory::{PartialOrFullSecurityAdvisory, PartialSecurityAdvisory};
+use crate::advisory::{AnySecurityAdvisory, PartialSecurityAdvisory};
 use crate::cache::Cache;
 use crate::config::Config;
 use crate::downloader::TransportException;
@@ -896,7 +896,7 @@ impl ComposerRepository {
             });
         }
 
-        let mut advisories: IndexMap<String, Vec<PartialOrFullSecurityAdvisory>> = IndexMap::new();
+        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
         let mut names_found: IndexMap<String, bool> = IndexMap::new();
 
         let api_url = self
@@ -919,9 +919,9 @@ impl ComposerRepository {
         let create = |data: &IndexMap<String, PhpMixed>,
                       name: &str,
                       package_constraint_map: &IndexMap<String, AnyConstraint>|
-         -> anyhow::Result<Option<PartialOrFullSecurityAdvisory>> {
+         -> anyhow::Result<Option<AnySecurityAdvisory>> {
             let advisory = PartialSecurityAdvisory::create(name, data, &parser)?;
-            let is_full = matches!(advisory, PartialOrFullSecurityAdvisory::Full(_));
+            let is_full = matches!(advisory, AnySecurityAdvisory::Full(_));
             if !allow_partial_advisories && !is_full {
                 let data_mixed = PhpMixed::Array(
                     data.iter()
@@ -940,10 +940,7 @@ impl ComposerRepository {
                 }
                 .into());
             }
-            let affected_versions: &AnyConstraint = match &advisory {
-                PartialOrFullSecurityAdvisory::Partial(p) => &p.affected_versions,
-                PartialOrFullSecurityAdvisory::Full(p) => p.affected_versions(),
-            };
+            let affected_versions: &AnyConstraint = advisory.affected_versions();
             let constraint = package_constraint_map.get(name);
             if let Some(c) = constraint {
                 if !affected_versions.matches(c) {
@@ -995,7 +992,7 @@ impl ComposerRepository {
 
                 names_found.insert(name.clone(), true);
                 if !sec_advs_arr.is_empty() {
-                    let mut entries: Vec<PartialOrFullSecurityAdvisory> = Vec::new();
+                    let mut entries: Vec<AnySecurityAdvisory> = Vec::new();
                     for (_k, data_mixed) in sec_advs_arr.iter() {
                         if let Some(data) = data_mixed.as_array() {
                             let data_map: IndexMap<String, PhpMixed> = data
@@ -1086,7 +1083,7 @@ impl ComposerRepository {
                         None => continue,
                     };
                     if !list.is_empty() {
-                        let mut entries: Vec<PartialOrFullSecurityAdvisory> = Vec::new();
+                        let mut entries: Vec<AnySecurityAdvisory> = Vec::new();
                         for data_mixed in list.iter() {
                             if let Some(data) = data_mixed.as_array() {
                                 let data_map: IndexMap<String, PhpMixed> = data
@@ -1106,7 +1103,7 @@ impl ComposerRepository {
             }
         }
 
-        let advisories_filtered: IndexMap<String, Vec<PartialOrFullSecurityAdvisory>> = advisories
+        let advisories_filtered: IndexMap<String, Vec<AnySecurityAdvisory>> = advisories
             .into_iter()
             .filter(|(_, adv)| !adv.is_empty())
             .collect();
diff --git a/crates/shirabe/src/repository/package_repository.rs b/crates/shirabe/src/repository/package_repository.rs
index c264eaf..273cde0 100644
--- a/crates/shirabe/src/repository/package_repository.rs
+++ b/crates/shirabe/src/repository/package_repository.rs
@@ -1,7 +1,7 @@
 //! ref: composer/src/Composer/Repository/PackageRepository.php
 
 use crate::advisory::SecurityAdvisory;
-use crate::advisory::{PartialOrFullSecurityAdvisory, PartialSecurityAdvisory};
+use crate::advisory::{AnySecurityAdvisory, PartialSecurityAdvisory};
 use crate::package::loader::ArrayLoader;
 use crate::package::loader::ValidatingArrayLoader;
 use crate::package::version::VersionParser;
@@ -93,7 +93,7 @@ impl AdvisoryProviderInterface for PackageRepository {
     ) -> anyhow::Result<SecurityAdvisoryResult> {
         let parser = VersionParser::new();
 
-        let mut advisories: IndexMap<String, Vec<PartialOrFullSecurityAdvisory>> = IndexMap::new();
+        let mut advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = IndexMap::new();
         for (package_name, package_advisories) in &self.security_advisories {
             let Some(package_constraint) = package_constraint_map.get(package_name) else {
                 continue;
@@ -103,7 +103,7 @@ impl AdvisoryProviderInterface for PackageRepository {
                 PhpMixed::List(list) => list,
                 _ => continue,
             };
-            let mut items: Vec<PartialOrFullSecurityAdvisory> = Vec::new();
+            let mut items: Vec<AnySecurityAdvisory> = Vec::new();
             for data in list {
                 let data_map: IndexMap<String, PhpMixed> = match data.as_ref() {
                     PhpMixed::Array(m) => m.iter().map(|(k, v)| (k.clone(), *v.clone())).collect(),
@@ -114,8 +114,7 @@ impl AdvisoryProviderInterface for PackageRepository {
                         Ok(a) => a,
                         Err(_) => continue,
                     };
-                if !allow_partial_advisories
-                    && matches!(advisory, PartialOrFullSecurityAdvisory::Partial(_))
+                if !allow_partial_advisories && matches!(advisory, AnySecurityAdvisory::Partial(_))
                 {
                     return Err(anyhow::anyhow!(RuntimeException {
                         message: format!(
@@ -138,7 +137,7 @@ impl AdvisoryProviderInterface for PackageRepository {
         }
 
         let names_found: Vec<String> = advisories.keys().cloned().collect();
-        let advisories: IndexMap<String, Vec<PartialOrFullSecurityAdvisory>> = advisories
+        let advisories: IndexMap<String, Vec<AnySecurityAdvisory>> = advisories
             .into_iter()
             .filter(|(_, adv)| !adv.is_empty())
             .collect();
diff --git a/crates/shirabe/src/repository/repository_set.rs b/crates/shirabe/src/repository/repository_set.rs
index 367a46a..62b25cb 100644
--- a/crates/shirabe/src/repository/repository_set.rs
+++ b/crates/shirabe/src/repository/repository_set.rs
@@ -13,7 +13,7 @@ use shirabe_semver::constraint::MatchAllConstraint;
 use shirabe_semver::constraint::MultiConstraint;
 use shirabe_semver::constraint::SimpleConstraint;
 
-use crate::advisory::{PartialOrFullSecurityAdvisory, PartialSecurityAdvisory, SecurityAdvisory};
+use crate::advisory::{AnySecurityAdvisory, PartialSecurityAdvisory, SecurityAdvisory};
 use crate::dependency_resolver::Pool;
 use crate::dependency_resolver::PoolBuilder;
 use crate::dependency_resolver::PoolOptimizer;
@@ -371,8 +371,8 @@ impl RepositorySet {
         allow_partial_advisories: bool,
         ignore_unreachable: bool,
         unreachable_repos: &mut Vec<String>,
-    ) -> Result<IndexMap<String, Vec<PartialOrFullSecurityAdvisory>>> {
-        let mut repo_advisories: Vec<IndexMap<String, Vec<PartialOrFullSecurityAdvisory>>> = vec![];
+    ) -> Result<IndexMap<String, Vec<AnySecurityAdvisory>>> {
+        let mut repo_advisories: Vec<IndexMap<String, Vec<AnySecurityAdvisory>>> = vec![];
         for repository in &self.repositories {
             let attempt: Result<()> = (|| -> Result<()> {
                 let mut repo_ref = repository.borrow_mut();
@@ -664,6 +664,6 @@ impl RepositorySet {
 
 #[derive(Debug)]
 pub struct SecurityAdvisoriesResult {
-    pub advisories: IndexMap<String, Vec<PartialOrFullSecurityAdvisory>>,
+    pub advisories: IndexMap<String, Vec<AnySecurityAdvisory>>,
     pub unreachable_repos: Vec<String>,
 }