Merge pull request #63 from KoolTheba/feat/add-comparator

Feat: add comparator to monitor
ossf · Jun 3, 2023 · d57f0d0 · d57f0d0
2 parents 1c8d1fa + 2656c8a
commit d57f0d0
Show file tree

Hide file tree

Showing 7 changed files with 14 additions and 8 deletions.
diff --git a/README.md b/README.md
@@ -15,6 +15,7 @@ _soon_
 - Easy to use with great customization
 - Easy to patch the scoring as the reports includes a direct link to [StepSecurity](https://app.stepsecurity.io)
 - Easy way to visualize the scorecard results with [The Scorecard Visualizer](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/nodejs/node) or [deps.dev](https://deps.dev/project/github/nodejs%2Fnode)
+- Cutting-edge feature that effortlessly compares OpenSSF scorecards between previous and current commits with [The Scorecard Visualizer Comparator](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/nodejs/node/compare/39a08ee8b8d3818677eb823cb566f36b1b1c4671/19fa9f1bc47b0666be0747583bea8cb3d8ad5eb1)
 - Discovery mode: list all the repos in one or many organizations that are tracked in the OpenSSF Scorecard
 - Reporting in Markdown with essential information (hash, date, score) and comparative against the prior score.
 - Self-hosted: The reporting data is stored in json format (including previous records) in the repo itself.

diff --git a/__fixtures__/index.js b/__fixtures__/index.js
@@ -78,6 +78,7 @@ const scores = [
     repo: 'fake-repo',
     platform: 'github.com',
     commit: '846b3ddb5f75d95235e94d9eb52e920f4a067338',
+    prevCommit: '39a08ee8b8d3818677eb823cb566f36b1b1c4671',
     score: 10,
     date: '2023-02-20',
     currentDiff: 5

diff --git a/__tests__/__snapshots__/utils.test.js.snap b/__tests__/__snapshots__/utils.test.js.snap
@@ -7,7 +7,7 @@ exports[`Utils generateReportContent Should render template with deps.dev as ren
 
 | Repository | Commit | Score | Date | Score Delta | Report | StepSecurity |
 | -- | -- | -- | -- | -- | -- | -- |
-| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) |  [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 | [View](https://deps.dev/project/github/fake-org%2Ffake-repo) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) |
+| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) |  [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 / [Details](https://deps.dev/project/github/fake-org%2Ffake-repo) | [View](https://deps.dev/project/github/fake-org%2Ffake-repo) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) |
 
 _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._"
 `;
@@ -19,7 +19,7 @@ exports[`Utils generateReportContent Should render template with scorecard-visua
 
 | Repository | Commit | Score | Date | Score Delta | Report | StepSecurity |
 | -- | -- | -- | -- | -- | -- | -- |
-| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) |  [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) |
+| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) |  [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 / [Details](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/compare/39a08ee8b8d3818677eb823cb566f36b1b1c4671/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) |
 
 _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._"
 `;
@@ -31,7 +31,7 @@ exports[`Utils generateReportContent Should render template with scores and titl
 
 | Repository | Commit | Score | Date | Score Delta | Report | StepSecurity |
 | -- | -- | -- | -- | -- | -- | -- |
-| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | 10 | 2023-02-20 | 5 | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) |
+| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | 10 | 2023-02-20 | 5 / [Details](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/compare/39a08ee8b8d3818677eb823cb566f36b1b1c4671/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) |
 
 _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._"
 `;
@@ -43,7 +43,7 @@ exports[`Utils generateReportContent Should render template with scores only 1`]
 
 | Repository | Commit | Score | Date | Score Delta | Report | StepSecurity |
 | -- | -- | -- | -- | -- | -- | -- |
-| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) |  [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) |
+| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) |  [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 / [Details](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/compare/39a08ee8b8d3818677eb823cb566f36b1b1c4671/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) |
 
 _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._"
 `;

diff --git a/src/index.js b/src/index.js
@@ -143,6 +143,7 @@ const generateScores = async ({ scope, database: currentDatabase, maxRequestInPa
       if (storedScore) {
         scoreData.prevScore = storedScore.score
         scoreData.prevDate = storedScore.date
+        scoreData.prevCommit = storedScore.commit
 
         if (storedScore.score !== score) {
           scoreData.currentDiff = parseFloat((score - storedScore.score).toFixed(1))

diff --git a/src/utils.js b/src/utils.js
@@ -42,10 +42,13 @@ const saveScore = ({ database, platform, org, repo, score, date, commit }) => {
   repoRef.current = { score, date, commit }
 }
 
-const generateReportUrl = reportTool => (org, repo, commit) => {
-  if (reportTool === 'scorecard-visualizer') {
+const generateReportUrl = reportTool => (org, repo, commit, prevCommit) => {
+  if (reportTool === 'scorecard-visualizer' && !prevCommit) {
     return `https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/${org}/${repo}/commit/${commit}`
   }
+  if (reportTool === 'scorecard-visualizer' && prevCommit) {
+    return `https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/${org}/${repo}/compare/${prevCommit}/${commit}`
+  }
   return `https://deps.dev/project/github/${org.toLowerCase()}%2F${repo.toLowerCase()}`
 }
 

diff --git a/templates/issue.ejs b/templates/issue.ejs
@@ -13,7 +13,7 @@ There are changes in the following repositories:
 | -- | -- | -- | -- | -- | -- |
 <%_ } -%>
 <%_ scores.forEach( score => { -%>
-| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%> <%_ if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.currentDiff || 0 %> | [View](<%= getReportUrl(score.org, score.repo, score.commit) %>) | [Fix it](https://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) |
+| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%> <%_ if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.currentDiff || 0 %><%_ if (score.prevCommit) { -%> / [Details](<%= getReportUrl(score.org, score.repo, score.commit, score.prevCommit) %>)<%_ } -%> | [View](<%= getReportUrl(score.org, score.repo, score.commit) %>) | [Fix it](https://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) |
 <%_ }); -%> 
 
 _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._
diff --git a/templates/report.ejs b/templates/report.ejs
@@ -9,7 +9,7 @@
 | -- | -- | -- | -- | -- | -- | -- |
 <%_ } -%>
 <%_ scores.forEach( score => { -%>
-| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%><% if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.date %> | <%= score.currentDiff || 0 %> | [View](<%= getReportUrl(score.org, score.repo, score.commit) %>) | [Fix it](https://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) |
+| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%><% if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.date %> | <%= score.currentDiff || 0 %> <%_ if (score.prevCommit) { -%> / [Details](<%= getReportUrl(score.org, score.repo, score.commit, score.prevCommit) %>)<%_ } -%> | [View](<%= getReportUrl(score.org, score.repo, score.commit) %>) | [Fix it](https://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) |
 <%_ }); -%>
 
 _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._