fix(machine-health): refresh an empty CISA KEV cache file

[kyle-sexton]

Closes #3436

Summary

An empty or whitespace CISA KEV cache left needsRefresh false, so a truncated file never self-healed.

Fix

Treat empty/whitespace content as the missing-file path (needsRefresh = true). machine-health 0.12.2.

Verification

Pester Get-CisaKevCache.Tests.ps1: 14 passed, including the new empty/whitespace fixture. Official runner is Windows-only; this lib suite also ran on Linux.

Related

N/A

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T08:53:24.459248Z	5779363	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 50s —— View job

---

Security review complete

• Gather context (PR diff, changed files)
• Apply skip gate
• Review changed files for security-relevant surface
• Post findings / no-issue result

No security issues found.

This PR is a narrow bug fix: Get-CisaKevCache.ps1 now sets $needsRefresh = $true when the cache file content is empty or whitespace-only, matching the existing missing-file/unparsable-file handling. The rest of the diff is a matching Pester test case, a version bump, and a changelog entry.

• No new external/untrusted input is introduced — the fetch URL ($script:CisaKevUrl) remains a hardcoded constant.
• File path handling ($CachePath, $tempPath) and JSON parsing (ConvertFrom-Json) are unchanged.
• The change only affects when a refresh is triggered, not how the fetch, download, or cache-write logic works.

Skip gate condition 2 applies (no security-relevant surface in this diff) — nothing further to report.

[github-actions]

Last security-reviewed head: 5779363d28f8233c64ceb3f1c0c97eba4c7228a8. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @kyle-sexton's task in 1m 23s —— View job

---

Claude finished the code review

• Gather context (PR diff, changed files)
• Apply /review:code-review skip gate
• Review changed files for correctness/maintainability
• Post findings (inline + summary)

Summary

Small, well-scoped fix. Get-CisaKevCache.ps1 previously left needsRefresh false when the cache file existed but its content was empty/whitespace, so $cached stayed null and the function fell through to the final return [pscustomobject]@{ vulnerabilities = @() } without ever attempting a refresh — a truncated cache never self-healed. The fix sets needsRefresh = $true on that path, matching the missing-file behavior. Version bump (0.12.1 → 0.12.2) and changelog entry match the fix. The new Pester test (Get-CisaKevCache.Tests.ps1:55-64) exercises the empty/whitespace fixture and asserts a refetch occurs — logic checks out against the rest of the function (needsRefresh skips the vulnerabilities-empty/staleness block at lines 70-80 and proceeds straight to Invoke-KevFetch at line 82-84).

Findings

Minor — docstring doesn't cover the new refresh case (Get-CisaKevCache.ps1#L9-L15)

The function's .DESCRIPTION enumerates the refresh policy as an exhaustive list ("refresh when ... file missing ... file unparsable ... vulnerabilities array empty ... mtime older"). It doesn't mention the new empty/whitespace-content case, and it's not quite covered by "file unparsable" either — the fix (lines 54-61) skips ConvertFrom-Json entirely for blank content rather than hitting a parse failure. Worth adding a bullet to the docstring so it stays the single source of truth for the refresh policy — a future reader diffing behavior against this comment would otherwise miss this case. Could not anchor this inline since the docstring lines fall outside the PR's diff hunks.

Fix this →

No other correctness, security, or maintainability issues found in the changed files (plugin.json, CHANGELOG.md, the fix, and the test).

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.