Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature: give the complete dependency-diff results in the Action workflow / sign&publish the JSON results #777

Closed
aidenwang9867 opened this issue Jul 26, 2022 · 1 comment

Comments

@aidenwang9867
Copy link

aidenwang9867 commented Jul 26, 2022

This is an extended feature of ossf/scorecard#2008.

Visualizing the dependency-diffs (package names, versions, change types, etc.) between the two branches in a pull request is straightforward for users to get a quick understanding of their arriving dependencies. However, it is difficult to visualize all the information in a DependencyDiffCheckResult struct in a pull request comment, otherwise, it could be too long for users to read (imagining a giant dependency check result JSON in the PR comment without json parser).

Still, our goal is to surface Scorecard check results for those dependencies, I am considering giving the complete dependency-diff check results in the Action workflow, or maybe providing an option to sign&publish the JSON results, just like what the current Scorecard Action is doing for the original Scorecard checks running on a repo.

They might be other options or positions to surface the complete results. A similar example is CodeCov putting a clear and short table in the PR comment, and giving the detailed code coverage (line xx - line yy are not covered by tests) in the PR File Changed tag as inline code annotations.

@aidenwang9867 aidenwang9867 changed the title Feature: give JSON dependency-diff results in the Action workflow / sign&publish the results Feature: give the complete dependency-diff results in the Action workflow / sign&publish the JSON results Jul 26, 2022
@aidenwang9867
Copy link
Author

complete results will be given in the annotation raw_details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant