From 1e98a11af761e09b2d13f3b6213869490697e477 Mon Sep 17 00:00:00 2001 From: KoolTheba Date: Sat, 3 Jun 2023 16:31:20 +0200 Subject: [PATCH 1/5] feat: added condition for generating comparator url --- src/utils.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/utils.js b/src/utils.js index 124c637..db2a70a 100644 --- a/src/utils.js +++ b/src/utils.js @@ -42,10 +42,13 @@ const saveScore = ({ database, platform, org, repo, score, date, commit }) => { repoRef.current = { score, date, commit } } -const generateReportUrl = reportTool => (org, repo, commit) => { - if (reportTool === 'scorecard-visualizer') { +const generateReportUrl = reportTool => (org, repo, commit, prevCommit) => { + if (reportTool === 'scorecard-visualizer' && !prevCommit) { return `https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/${org}/${repo}/commit/${commit}` } + if (reportTool === 'scorecard-visualizer' && prevCommit) { + return `https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/${org}/${repo}/compare/${prevCommit}/${commit}` + } return `https://deps.dev/project/github/${org.toLowerCase()}%2F${repo.toLowerCase()}` } From 7ab5913e625ede13a8f068461d5d4d2a02923f25 Mon Sep 17 00:00:00 2001 From: KoolTheba Date: Sat, 3 Jun 2023 16:32:02 +0200 Subject: [PATCH 2/5] feat: added previous commit as score data property --- __fixtures__/index.js | 1 + src/index.js | 1 + 2 files changed, 2 insertions(+) diff --git a/__fixtures__/index.js b/__fixtures__/index.js index 2dca385..61522d5 100644 --- a/__fixtures__/index.js +++ b/__fixtures__/index.js @@ -78,6 +78,7 @@ const scores = [ repo: 'fake-repo', platform: 'github.com', commit: '846b3ddb5f75d95235e94d9eb52e920f4a067338', + prevCommit: '39a08ee8b8d3818677eb823cb566f36b1b1c4671', score: 10, date: '2023-02-20', currentDiff: 5 diff --git a/src/index.js b/src/index.js index a4e5f86..d47858b 100644 --- a/src/index.js +++ b/src/index.js @@ -143,6 +143,7 @@ const generateScores = async ({ scope, database: currentDatabase, maxRequestInPa if (storedScore) { scoreData.prevScore = storedScore.score scoreData.prevDate = storedScore.date + scoreData.prevCommit = storedScore.commit if (storedScore.score !== score) { scoreData.currentDiff = parseFloat((score - storedScore.score).toFixed(1)) From 290c15a143523094a41a67a7c5014c8cf5aa5cf2 Mon Sep 17 00:00:00 2001 From: KoolTheba Date: Sat, 3 Jun 2023 16:32:32 +0200 Subject: [PATCH 3/5] feat: adapted templates adding new score delta details link --- templates/issue.ejs | 2 +- templates/report.ejs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/issue.ejs b/templates/issue.ejs index 67e8413..27a436a 100644 --- a/templates/issue.ejs +++ b/templates/issue.ejs @@ -13,7 +13,7 @@ There are changes in the following repositories: | -- | -- | -- | -- | -- | -- | <%_ } -%> <%_ scores.forEach( score => { -%> -| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%> <%_ if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.currentDiff || 0 %> | [View](<%= getReportUrl(score.org, score.repo, score.commit) %>) | [Fix it](https://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) | +| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%> <%_ if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.currentDiff || 0 %><%_ if (score.prevCommit) { -%> / [Details](<%= getReportUrl(score.org, score.repo, score.commit, score.prevCommit) %>)<%_ } -%> | [View](<%= getReportUrl(score.org, score.repo, score.commit) %>) | [Fix it](https://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) | <%_ }); -%> _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._ \ No newline at end of file diff --git a/templates/report.ejs b/templates/report.ejs index 1f57a6b..af68fd8 100644 --- a/templates/report.ejs +++ b/templates/report.ejs @@ -9,7 +9,7 @@ | -- | -- | -- | -- | -- | -- | -- | <%_ } -%> <%_ scores.forEach( score => { -%> -| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%><% if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.date %> | <%= score.currentDiff || 0 %> | [View](<%= getReportUrl(score.org, score.repo, score.commit) %>) | [Fix it](https://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) | +| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%><% if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.date %> | <%= score.currentDiff || 0 %> <%_ if (score.prevCommit) { -%> / [Details](<%= getReportUrl(score.org, score.repo, score.commit, score.prevCommit) %>)<%_ } -%> | [View](<%= getReportUrl(score.org, score.repo, score.commit) %>) | [Fix it](https://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) | <%_ }); -%> _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._ \ No newline at end of file From 0383589948cdb246775a52e0e3e7d1078b445396 Mon Sep 17 00:00:00 2001 From: KoolTheba Date: Sat, 3 Jun 2023 16:32:44 +0200 Subject: [PATCH 4/5] test: updated snapshots --- __tests__/__snapshots__/utils.test.js.snap | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/__tests__/__snapshots__/utils.test.js.snap b/__tests__/__snapshots__/utils.test.js.snap index 3f771f8..3c90e4c 100644 --- a/__tests__/__snapshots__/utils.test.js.snap +++ b/__tests__/__snapshots__/utils.test.js.snap @@ -7,7 +7,7 @@ exports[`Utils generateReportContent Should render template with deps.dev as ren | Repository | Commit | Score | Date | Score Delta | Report | StepSecurity | | -- | -- | -- | -- | -- | -- | -- | -| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 | [View](https://deps.dev/project/github/fake-org%2Ffake-repo) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) | +| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 / [Details](https://deps.dev/project/github/fake-org%2Ffake-repo) | [View](https://deps.dev/project/github/fake-org%2Ffake-repo) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) | _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._" `; @@ -19,7 +19,7 @@ exports[`Utils generateReportContent Should render template with scorecard-visua | Repository | Commit | Score | Date | Score Delta | Report | StepSecurity | | -- | -- | -- | -- | -- | -- | -- | -| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) | +| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 / [Details](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/compare/39a08ee8b8d3818677eb823cb566f36b1b1c4671/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) | _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._" `; @@ -31,7 +31,7 @@ exports[`Utils generateReportContent Should render template with scores and titl | Repository | Commit | Score | Date | Score Delta | Report | StepSecurity | | -- | -- | -- | -- | -- | -- | -- | -| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | 10 | 2023-02-20 | 5 | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) | +| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | 10 | 2023-02-20 | 5 / [Details](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/compare/39a08ee8b8d3818677eb823cb566f36b1b1c4671/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) | _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._" `; @@ -43,7 +43,7 @@ exports[`Utils generateReportContent Should render template with scores only 1`] | Repository | Commit | Score | Date | Score Delta | Report | StepSecurity | | -- | -- | -- | -- | -- | -- | -- | -| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) | +| [fake-org/fake-repo](https://github.com/fake-org/fake-repo) | [846b3dd](https://github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo/badge)](https://api.securityscorecards.dev/projects/github.com/fake-org/fake-repo) | 2023-02-20 | 5 / [Details](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/compare/39a08ee8b8d3818677eb823cb566f36b1b1c4671/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [View](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/fake-org/fake-repo/commit/846b3ddb5f75d95235e94d9eb52e920f4a067338) | [Fix it](https://app.stepsecurity.io/securerepo?repo=fake-org/fake-repo) | _Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._" `; From 2656c8a19149afcbe631abc19ee24eaa6d189a4d Mon Sep 17 00:00:00 2001 From: KoolTheba Date: Sat, 3 Jun 2023 16:44:27 +0200 Subject: [PATCH 5/5] docs: improved documentation --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 3d8ca30..4ed94e6 100644 --- a/README.md +++ b/README.md @@ -15,6 +15,7 @@ _soon_ - Easy to use with great customization - Easy to patch the scoring as the reports includes a direct link to [StepSecurity](https://app.stepsecurity.io) - Easy way to visualize the scorecard results with [The Scorecard Visualizer](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/nodejs/node) or [deps.dev](https://deps.dev/project/github/nodejs%2Fnode) +- Cutting-edge feature that effortlessly compares OpenSSF scorecards between previous and current commits with [The Scorecard Visualizer Comparator](https://kooltheba.github.io/openssf-scorecard-api-visualizer/#/projects/github.com/nodejs/node/compare/39a08ee8b8d3818677eb823cb566f36b1b1c4671/19fa9f1bc47b0666be0747583bea8cb3d8ad5eb1) - Discovery mode: list all the repos in one or many organizations that are tracked in the OpenSSF Scorecard - Reporting in Markdown with essential information (hash, date, score) and comparative against the prior score. - Self-hosted: The reporting data is stored in json format (including previous records) in the repo itself.