You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Visualizing the dependency-diffs (package names, versions, change types, etc.) between the two branches in a pull request is straightforward for users to get a quick understanding of their arriving dependencies. However, it is difficult to visualize all the information in a DependencyDiffCheckResult struct in a pull request comment, otherwise, it could be too long for users to read (imagining a giant dependency check result JSON in the PR comment without json parser).
Still, our goal is to surface Scorecard check results for those dependencies, I am considering giving the complete dependency-diff check results in the Action workflow, or maybe providing an option to sign&publish the JSON results, just like what the current Scorecard Action is doing for the original Scorecard checks running on a repo.
They might be other options or positions to surface the complete results. A similar example is CodeCov putting a clear and short table in the PR comment, and giving the detailed code coverage (line xx - line yy are not covered by tests) in the PR File Changed tag as inline code annotations.
The text was updated successfully, but these errors were encountered:
aidenwang9867
changed the title
Feature: give JSON dependency-diff results in the Action workflow / sign&publish the results
Feature: give the complete dependency-diff results in the Action workflow / sign&publish the JSON results
Jul 26, 2022
This is an extended feature of ossf/scorecard#2008.
Visualizing the dependency-diffs (package names, versions, change types, etc.) between the two branches in a pull request is straightforward for users to get a quick understanding of their arriving dependencies. However, it is difficult to visualize all the information in a DependencyDiffCheckResult struct in a pull request comment, otherwise, it could be too long for users to read (imagining a giant dependency check result JSON in the PR comment without json parser).
Still, our goal is to surface Scorecard check results for those dependencies, I am considering giving the complete dependency-diff check results in the Action workflow, or maybe providing an option to sign&publish the JSON results, just like what the current Scorecard Action is doing for the original Scorecard checks running on a repo.
They might be other options or positions to surface the complete results. A similar example is CodeCov putting a clear and short table in the PR comment, and giving the detailed code coverage (line xx - line yy are not covered by tests) in the PR
File Changed
tag as inline code annotations.The text was updated successfully, but these errors were encountered: