@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,18 @@
+# @red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot
+
+## 0.2.0
+
+### Minor Changes
+
+- 526b9f3: added dependabot scorecard
+- d706601: Backstage version bump to v1.49.3
+
+### Patch Changes
+
+- 1657da3: Added github.com/dependabot annotation
+- Updated dependencies [d706601]
+- Updated dependencies [55226c2]
+- Updated dependencies [243ad0a]
+- Updated dependencies [c83b206]
+  - @red-hat-developer-hub/backstage-plugin-scorecard-common@2.5.0
+  - @red-hat-developer-hub/backstage-plugin-scorecard-node@2.5.0

package/README.md

@@ -0,0 +1,9 @@
+# Scorecard Backend Module: Dependabot
+
+Adds Dependabot alerts as a scorecard metric (`dependabot.alerts`, 0–9 from severity).
+
+**Install:** `yarn workspace backend add @red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot` then `backend.add(import('@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot'))`.
+
+**Setup:** Entities need `github.com/project-slug: owner/repo` and `github.com/dependabot: 'true'` (exact string) to opt in. GitHub token must have `security_events` (or Dependabot read) so the backend can call the Dependabot API.
+
+**How it works:** **DependabotClient** fetches open alerts from the GitHub API (by severity, with pagination). **DependabotMetricProvider** (one per severity) uses the client to score entities. The **factory** (`createDependabotMetricProvider` / `createDependabotMetricProviders`) builds single or all-four providers; the module registers the four (critical, high, medium, low) with the scorecard backend.

package/dist/clients/DependabotClient.cjs.js

@@ -0,0 +1,73 @@
+'use strict';
+
+var integration = require('@backstage/integration');
+var rest = require('@octokit/rest');
+
+const PER_PAGE = 100;
+class DependabotClient {
+  integrations;
+  logger;
+  constructor(config, logger) {
+    this.integrations = integration.ScmIntegrations.fromConfig(config);
+    this.logger = logger.child({ component: "DependabotClient" });
+  }
+  async getOctokit(url) {
+    const githubIntegration = this.integrations.github.byUrl(url);
+    if (!githubIntegration) {
+      throw new Error(`Missing GitHub integration for '${url}'`);
+    }
+    const baseUrl = githubIntegration.config.apiBaseUrl;
+    if (!baseUrl) {
+      throw new Error(`Missing GitHub API base URL for '${url}'`);
+    }
+    const credentialsProvider = integration.DefaultGithubCredentialsProvider.fromIntegrations(this.integrations);
+    const { token } = await credentialsProvider.getCredentials({
+      url
+    });
+    if (!token) {
+      throw new Error(`Missing GitHub token for '${url}'`);
+    }
+    return new rest.Octokit({
+      auth: token,
+      baseUrl: baseUrl.replace(/\/$/, "")
+    });
+  }
+  /**
+   * @param url - The URL of the repository.
+   * @param repository - The repository owner and name.
+   * @param severity - The severity of the alerts to fetch.
+   * @returns All alerts for the given repository and severity.
+   */
+  async getAlerts(url, repository, severity) {
+    this.logger.debug(
+      `Fetching Dependabot ${severity} alerts for ${repository.owner}/${repository.repo}`
+    );
+    try {
+      const octokit = await this.getOctokit(url);
+      const allAlerts = await octokit.paginate(
+        "GET /repos/{owner}/{repo}/dependabot/alerts",
+        {
+          owner: repository.owner,
+          repo: repository.repo,
+          state: "open",
+          severity,
+          per_page: PER_PAGE
+        }
+      );
+      this.logger.debug(
+        `Fetched ${allAlerts.length} Dependabot ${severity} alert(s) for ${repository.owner}/${repository.repo}`
+      );
+      return allAlerts;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(
+        `Failed to fetch Dependabot ${severity} alerts for ${repository.owner}/${repository.repo}: ${message}`,
+        error
+      );
+      throw error;
+    }
+  }
+}
+
+exports.DependabotClient = DependabotClient;
+//# sourceMappingURL=DependabotClient.cjs.js.map

package/dist/clients/DependabotClient.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DependabotClient.cjs.js","sources":["../../src/clients/DependabotClient.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { LoggerService } from '@backstage/backend-plugin-api';\nimport type { Config } from '@backstage/config';\nimport {\n  DefaultGithubCredentialsProvider,\n  ScmIntegrations,\n} from '@backstage/integration';\nimport { Octokit } from '@octokit/rest';\nimport {\n  DependabotRepository,\n  DependabotSeverity,\n} from '../metricProviders/DependabotConfig';\n\ninterface GitHubDependabotAlert {\n  number: number;\n  description: string;\n  createdAt: string;\n  state: string;\n  securityAdvisory: {\n    severity: string;\n  };\n}\n\nconst PER_PAGE = 100;\nexport class DependabotClient {\n  private readonly integrations: ScmIntegrations;\n  private readonly logger: LoggerService;\n\n  constructor(config: Config, logger: LoggerService) {\n    this.integrations = ScmIntegrations.fromConfig(config);\n    this.logger = logger.child({ component: 'DependabotClient' });\n  }\n\n  private async getOctokit(url: string): Promise<Octokit> {\n    const githubIntegration = this.integrations.github.byUrl(url);\n    if (!githubIntegration) {\n      throw new Error(`Missing GitHub integration for '${url}'`);\n    }\n\n    const baseUrl = githubIntegration.config.apiBaseUrl;\n    if (!baseUrl) {\n      throw new Error(`Missing GitHub API base URL for '${url}'`);\n    }\n\n    const credentialsProvider =\n      DefaultGithubCredentialsProvider.fromIntegrations(this.integrations);\n\n    const { token } = await credentialsProvider.getCredentials({\n      url,\n    });\n\n    if (!token) {\n      throw new Error(`Missing GitHub token for '${url}'`);\n    }\n\n    return new Octokit({\n      auth: token,\n      baseUrl: baseUrl.replace(/\\/$/, ''),\n    });\n  }\n  /**\n   * @param url - The URL of the repository.\n   * @param repository - The repository owner and name.\n   * @param severity - The severity of the alerts to fetch.\n   * @returns All alerts for the given repository and severity.\n   */\n  async getAlerts(\n    url: string,\n    repository: DependabotRepository,\n    severity: DependabotSeverity,\n  ): Promise<GitHubDependabotAlert[]> {\n    this.logger.debug(\n      `Fetching Dependabot ${severity} alerts for ${repository.owner}/${repository.repo}`,\n    );\n    try {\n      const octokit = await this.getOctokit(url);\n\n      const allAlerts = (await octokit.paginate(\n        'GET /repos/{owner}/{repo}/dependabot/alerts',\n        {\n          owner: repository.owner,\n          repo: repository.repo,\n          state: 'open',\n          severity,\n          per_page: PER_PAGE,\n        },\n      )) as unknown as GitHubDependabotAlert[];\n\n      this.logger.debug(\n        `Fetched ${allAlerts.length} Dependabot ${severity} alert(s) for ${repository.owner}/${repository.repo}`,\n      );\n      return allAlerts;\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error);\n      this.logger.warn(\n        `Failed to fetch Dependabot ${severity} alerts for ${repository.owner}/${repository.repo}: ${message}`,\n        error,\n      );\n      throw error;\n    }\n  }\n}\n"],"names":["ScmIntegrations","DefaultGithubCredentialsProvider","Octokit"],"mappings":";;;;;AAsCA,MAAM,QAAW,GAAA,GAAA;AACV,MAAM,gBAAiB,CAAA;AAAA,EACX,YAAA;AAAA,EACA,MAAA;AAAA,EAEjB,WAAA,CAAY,QAAgB,MAAuB,EAAA;AACjD,IAAK,IAAA,CAAA,YAAA,GAAeA,2BAAgB,CAAA,UAAA,CAAW,MAAM,CAAA;AACrD,IAAA,IAAA,CAAK,SAAS,MAAO,CAAA,KAAA,CAAM,EAAE,SAAA,EAAW,oBAAoB,CAAA;AAAA;AAC9D,EAEA,MAAc,WAAW,GAA+B,EAAA;AACtD,IAAA,MAAM,iBAAoB,GAAA,IAAA,CAAK,YAAa,CAAA,MAAA,CAAO,MAAM,GAAG,CAAA;AAC5D,IAAA,IAAI,CAAC,iBAAmB,EAAA;AACtB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAmC,gCAAA,EAAA,GAAG,CAAG,CAAA,CAAA,CAAA;AAAA;AAG3D,IAAM,MAAA,OAAA,GAAU,kBAAkB,MAAO,CAAA,UAAA;AACzC,IAAA,IAAI,CAAC,OAAS,EAAA;AACZ,MAAA,MAAM,IAAI,KAAA,CAAM,CAAoC,iCAAA,EAAA,GAAG,CAAG,CAAA,CAAA,CAAA;AAAA;AAG5D,IAAA,MAAM,mBACJ,GAAAC,4CAAA,CAAiC,gBAAiB,CAAA,IAAA,CAAK,YAAY,CAAA;AAErE,IAAA,MAAM,EAAE,KAAA,EAAU,GAAA,MAAM,oBAAoB,cAAe,CAAA;AAAA,MACzD;AAAA,KACD,CAAA;AAED,IAAA,IAAI,CAAC,KAAO,EAAA;AACV,MAAA,MAAM,IAAI,KAAA,CAAM,CAA6B,0BAAA,EAAA,GAAG,CAAG,CAAA,CAAA,CAAA;AAAA;AAGrD,IAAA,OAAO,IAAIC,YAAQ,CAAA;AAAA,MACjB,IAAM,EAAA,KAAA;AAAA,MACN,OAAS,EAAA,OAAA,CAAQ,OAAQ,CAAA,KAAA,EAAO,EAAE;AAAA,KACnC,CAAA;AAAA;AACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SAAA,CACJ,GACA,EAAA,UAAA,EACA,QACkC,EAAA;AAClC,IAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,MACV,uBAAuB,QAAQ,CAAA,YAAA,EAAe,WAAW,KAAK,CAAA,CAAA,EAAI,WAAW,IAAI,CAAA;AAAA,KACnF;AACA,IAAI,IAAA;AACF,MAAA,MAAM,OAAU,GAAA,MAAM,IAAK,CAAA,UAAA,CAAW,GAAG,CAAA;AAEzC,MAAM,MAAA,SAAA,GAAa,MAAM,OAAQ,CAAA,QAAA;AAAA,QAC/B,6CAAA;AAAA,QACA;AAAA,UACE,OAAO,UAAW,CAAA,KAAA;AAAA,UAClB,MAAM,UAAW,CAAA,IAAA;AAAA,UACjB,KAAO,EAAA,MAAA;AAAA,UACP,QAAA;AAAA,UACA,QAAU,EAAA;AAAA;AACZ,OACF;AAEA,MAAA,IAAA,CAAK,MAAO,CAAA,KAAA;AAAA,QACV,CAAA,QAAA,EAAW,SAAU,CAAA,MAAM,CAAe,YAAA,EAAA,QAAQ,iBAAiB,UAAW,CAAA,KAAK,CAAI,CAAA,EAAA,UAAA,CAAW,IAAI,CAAA;AAAA,OACxG;AACA,MAAO,OAAA,SAAA;AAAA,aACA,KAAO,EAAA;AACd,MAAA,MAAM,UAAU,KAAiB,YAAA,KAAA,GAAQ,KAAM,CAAA,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,MAAA,IAAA,CAAK,MAAO,CAAA,IAAA;AAAA,QACV,CAAA,2BAAA,EAA8B,QAAQ,CAAe,YAAA,EAAA,UAAA,CAAW,KAAK,CAAI,CAAA,EAAA,UAAA,CAAW,IAAI,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA;AAAA,QACpG;AAAA,OACF;AACA,MAAM,MAAA,KAAA;AAAA;AACR;AAEJ;;;;"}

package/dist/index.cjs.js

@@ -0,0 +1,10 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var module$1 = require('./module.cjs.js');
+
+
+
+exports.default = module$1.scorecardModuleDependabot;
+//# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
+
+declare const scorecardModuleDependabot: _backstage_backend_plugin_api.BackendFeature;
+
+export { scorecardModuleDependabot as default };

package/dist/metricProviders/DependabotConfig.cjs.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const DEPENDABOT_SEVERITIES = [
+  "critical",
+  "high",
+  "medium",
+  "low"
+];
+const DEPENDABOT_THRESHOLDS = {
+  rules: [
+    { key: "success", expression: "<1" },
+    { key: "warning", expression: "1-7" },
+    { key: "error", expression: ">7" }
+  ]
+};
+const DEPENDABOT_SEVERITY_METRIC = {
+  critical: {
+    id: "dependabot.alerts_critical",
+    title: "Dependabot Critical Alerts",
+    description: "Current count of open critical Dependabot alerts for a given repository."
+  },
+  high: {
+    id: "dependabot.alerts_high",
+    title: "Dependabot High Alerts",
+    description: "Current count of open high-severity Dependabot alerts for a given repository."
+  },
+  medium: {
+    id: "dependabot.alerts_medium",
+    title: "Dependabot Medium Alerts",
+    description: "Current count of open medium-severity Dependabot alerts for a given repository."
+  },
+  low: {
+    id: "dependabot.alerts_low",
+    title: "Dependabot Low Alerts",
+    description: "Current count of open low-severity Dependabot alerts for a given repository."
+  }
+};
+
+exports.DEPENDABOT_SEVERITIES = DEPENDABOT_SEVERITIES;
+exports.DEPENDABOT_SEVERITY_METRIC = DEPENDABOT_SEVERITY_METRIC;
+exports.DEPENDABOT_THRESHOLDS = DEPENDABOT_THRESHOLDS;
+//# sourceMappingURL=DependabotConfig.cjs.js.map

package/dist/metricProviders/DependabotConfig.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DependabotConfig.cjs.js","sources":["../../src/metricProviders/DependabotConfig.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { ThresholdConfig } from '@red-hat-developer-hub/backstage-plugin-scorecard-common';\n\nexport const DEPENDABOT_SEVERITIES = [\n  'critical',\n  'high',\n  'medium',\n  'low',\n] as const;\n\nexport type DependabotSeverity = (typeof DEPENDABOT_SEVERITIES)[number];\n\nexport type DependabotRepository = {\n  owner: string;\n  repo: string;\n};\n\nexport interface DependabotMetricConfig {\n  name: string;\n  displayTitle: string;\n  description: string;\n}\n\nexport const DEPENDABOT_THRESHOLDS: ThresholdConfig = {\n  rules: [\n    { key: 'success', expression: '<1' },\n    { key: 'warning', expression: '1-7' },\n    { key: 'error', expression: '>7' },\n  ],\n};\n\nexport const DEPENDABOT_SEVERITY_METRIC: Record<\n  DependabotSeverity,\n  { id: string; title: string; description: string }\n> = {\n  critical: {\n    id: 'dependabot.alerts_critical',\n    title: 'Dependabot Critical Alerts',\n    description:\n      'Current count of open critical Dependabot alerts for a given repository.',\n  },\n  high: {\n    id: 'dependabot.alerts_high',\n    title: 'Dependabot High Alerts',\n    description:\n      'Current count of open high-severity Dependabot alerts for a given repository.',\n  },\n  medium: {\n    id: 'dependabot.alerts_medium',\n    title: 'Dependabot Medium Alerts',\n    description:\n      'Current count of open medium-severity Dependabot alerts for a given repository.',\n  },\n  low: {\n    id: 'dependabot.alerts_low',\n    title: 'Dependabot Low Alerts',\n    description:\n      'Current count of open low-severity Dependabot alerts for a given repository.',\n  },\n};\n"],"names":[],"mappings":";;AAkBO,MAAM,qBAAwB,GAAA;AAAA,EACnC,UAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAeO,MAAM,qBAAyC,GAAA;AAAA,EACpD,KAAO,EAAA;AAAA,IACL,EAAE,GAAA,EAAK,SAAW,EAAA,UAAA,EAAY,IAAK,EAAA;AAAA,IACnC,EAAE,GAAA,EAAK,SAAW,EAAA,UAAA,EAAY,KAAM,EAAA;AAAA,IACpC,EAAE,GAAA,EAAK,OAAS,EAAA,UAAA,EAAY,IAAK;AAAA;AAErC;AAEO,MAAM,0BAGT,GAAA;AAAA,EACF,QAAU,EAAA;AAAA,IACR,EAAI,EAAA,4BAAA;AAAA,IACJ,KAAO,EAAA,4BAAA;AAAA,IACP,WACE,EAAA;AAAA,GACJ;AAAA,EACA,IAAM,EAAA;AAAA,IACJ,EAAI,EAAA,wBAAA;AAAA,IACJ,KAAO,EAAA,wBAAA;AAAA,IACP,WACE,EAAA;AAAA,GACJ;AAAA,EACA,MAAQ,EAAA;AAAA,IACN,EAAI,EAAA,0BAAA;AAAA,IACJ,KAAO,EAAA,0BAAA;AAAA,IACP,WACE,EAAA;AAAA,GACJ;AAAA,EACA,GAAK,EAAA;AAAA,IACH,EAAI,EAAA,uBAAA;AAAA,IACJ,KAAO,EAAA,uBAAA;AAAA,IACP,WACE,EAAA;AAAA;AAEN;;;;;;"}

package/dist/metricProviders/DependabotMetricProvider.cjs.js

@@ -0,0 +1,78 @@
+'use strict';
+
+var catalogModel = require('@backstage/catalog-model');
+var catalogClient = require('@backstage/catalog-client');
+var DependabotClient = require('../clients/DependabotClient.cjs.js');
+var DependabotConfig = require('./DependabotConfig.cjs.js');
+
+const GITHUB_PROJECT_ANNOTATION = "github.com/project-slug";
+class DependabotMetricProvider {
+  dependabotClient;
+  thresholds;
+  severity;
+  constructor(config, logger, severity, thresholds) {
+    this.severity = severity;
+    this.dependabotClient = new DependabotClient.DependabotClient(config, logger);
+    this.thresholds = thresholds ?? DependabotConfig.DEPENDABOT_THRESHOLDS;
+  }
+  getProviderDatasourceId() {
+    return "dependabot";
+  }
+  getProviderId() {
+    return DependabotConfig.DEPENDABOT_SEVERITY_METRIC[this.severity].id;
+  }
+  getMetricType() {
+    return "number";
+  }
+  getMetric() {
+    const meta = DependabotConfig.DEPENDABOT_SEVERITY_METRIC[this.severity];
+    return {
+      id: meta.id,
+      title: meta.title,
+      description: meta.description,
+      type: this.getMetricType(),
+      history: true
+    };
+  }
+  getMetricThresholds() {
+    return this.thresholds;
+  }
+  getCatalogFilter() {
+    return {
+      "metadata.annotations.github.com/project-slug": catalogClient.CATALOG_FILTER_EXISTS,
+      "metadata.annotations.github.com/dependabot": "true"
+    };
+  }
+  getRepository(entity) {
+    const projectSlug = entity.metadata.annotations?.[GITHUB_PROJECT_ANNOTATION];
+    if (!projectSlug) {
+      throw new Error(
+        `Missing annotation '${GITHUB_PROJECT_ANNOTATION}' for entity ${catalogModel.stringifyEntityRef(
+          entity
+        )}`
+      );
+    }
+    const [owner, repo] = projectSlug.split("/");
+    if (!owner || !repo) {
+      throw new Error(
+        `Invalid format of '${GITHUB_PROJECT_ANNOTATION}' ${projectSlug} for entity ${catalogModel.stringifyEntityRef(
+          entity
+        )}`
+      );
+    }
+    return { owner, repo };
+  }
+  async calculateMetric(entity) {
+    const repository = this.getRepository(entity);
+    const { target } = catalogModel.getEntitySourceLocation(entity);
+    const alerts = await this.dependabotClient.getAlerts(
+      target,
+      repository,
+      this.severity
+    );
+    return alerts.length;
+  }
+}
+
+exports.DependabotMetricProvider = DependabotMetricProvider;
+//# sourceMappingURL=DependabotMetricProvider.cjs.js.map

package/dist/metricProviders/DependabotMetricProvider.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DependabotMetricProvider.cjs.js","sources":["../../src/metricProviders/DependabotMetricProvider.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  Metric,\n  ThresholdConfig,\n} from '@red-hat-developer-hub/backstage-plugin-scorecard-common';\nimport { MetricProvider } from '@red-hat-developer-hub/backstage-plugin-scorecard-node';\nimport type { LoggerService } from '@backstage/backend-plugin-api';\nimport type { Config } from '@backstage/config';\nimport {\n  stringifyEntityRef,\n  type Entity,\n  getEntitySourceLocation,\n} from '@backstage/catalog-model';\nimport { CATALOG_FILTER_EXISTS } from '@backstage/catalog-client';\n\nimport { DependabotClient } from '../clients/DependabotClient';\nimport {\n  type DependabotSeverity,\n  DEPENDABOT_SEVERITY_METRIC,\n  DEPENDABOT_THRESHOLDS,\n  DependabotRepository,\n} from './DependabotConfig';\n\nconst GITHUB_PROJECT_ANNOTATION = 'github.com/project-slug';\n\n/**\n * Metric provider for Dependabot alerts of a single severity (critical, high, medium, low).\n * Use one instance per severity; the module registers four providers.\n */\nexport class DependabotMetricProvider implements MetricProvider<'number'> {\n  private readonly dependabotClient: DependabotClient;\n  private readonly thresholds: ThresholdConfig;\n  private readonly severity: DependabotSeverity;\n\n  constructor(\n    config: Config,\n    logger: LoggerService,\n    severity: DependabotSeverity,\n    thresholds?: ThresholdConfig,\n  ) {\n    this.severity = severity;\n    this.dependabotClient = new DependabotClient(config, logger);\n    this.thresholds = thresholds ?? DEPENDABOT_THRESHOLDS;\n  }\n\n  getProviderDatasourceId(): string {\n    return 'dependabot';\n  }\n\n  getProviderId(): string {\n    return DEPENDABOT_SEVERITY_METRIC[this.severity].id;\n  }\n\n  getMetricType(): 'number' {\n    return 'number';\n  }\n\n  getMetric(): Metric<'number'> {\n    const meta = DEPENDABOT_SEVERITY_METRIC[this.severity];\n    return {\n      id: meta.id,\n      title: meta.title,\n      description: meta.description,\n      type: this.getMetricType(),\n      history: true,\n    };\n  }\n\n  getMetricThresholds(): ThresholdConfig {\n    return this.thresholds;\n  }\n\n  getCatalogFilter(): Record<string, string | symbol | (string | symbol)[]> {\n    return {\n      'metadata.annotations.github.com/project-slug': CATALOG_FILTER_EXISTS,\n      'metadata.annotations.github.com/dependabot': 'true',\n    };\n  }\n\n  getRepository(entity: Entity): DependabotRepository {\n    const projectSlug =\n      entity.metadata.annotations?.[GITHUB_PROJECT_ANNOTATION];\n    if (!projectSlug) {\n      throw new Error(\n        `Missing annotation '${GITHUB_PROJECT_ANNOTATION}' for entity ${stringifyEntityRef(\n          entity,\n        )}`,\n      );\n    }\n\n    const [owner, repo] = projectSlug.split('/');\n    if (!owner || !repo) {\n      throw new Error(\n        `Invalid format of '${GITHUB_PROJECT_ANNOTATION}' ${projectSlug} for entity ${stringifyEntityRef(\n          entity,\n        )}`,\n      );\n    }\n\n    return { owner, repo };\n  }\n\n  async calculateMetric(entity: Entity): Promise<number> {\n    const repository = this.getRepository(entity);\n    const { target } = getEntitySourceLocation(entity);\n    const alerts = await this.dependabotClient.getAlerts(\n      target,\n      repository,\n      this.severity,\n    );\n    return alerts.length;\n  }\n}\n"],"names":["DependabotClient","DEPENDABOT_THRESHOLDS","DEPENDABOT_SEVERITY_METRIC","CATALOG_FILTER_EXISTS","stringifyEntityRef","getEntitySourceLocation"],"mappings":";;;;;;;AAsCA,MAAM,yBAA4B,GAAA,yBAAA;AAM3B,MAAM,wBAA6D,CAAA;AAAA,EACvD,gBAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EAEjB,WACE,CAAA,MAAA,EACA,MACA,EAAA,QAAA,EACA,UACA,EAAA;AACA,IAAA,IAAA,CAAK,QAAW,GAAA,QAAA;AAChB,IAAA,IAAA,CAAK,gBAAmB,GAAA,IAAIA,iCAAiB,CAAA,MAAA,EAAQ,MAAM,CAAA;AAC3D,IAAA,IAAA,CAAK,aAAa,UAAc,IAAAC,sCAAA;AAAA;AAClC,EAEA,uBAAkC,GAAA;AAChC,IAAO,OAAA,YAAA;AAAA;AACT,EAEA,aAAwB,GAAA;AACtB,IAAO,OAAAC,2CAAA,CAA2B,IAAK,CAAA,QAAQ,CAAE,CAAA,EAAA;AAAA;AACnD,EAEA,aAA0B,GAAA;AACxB,IAAO,OAAA,QAAA;AAAA;AACT,EAEA,SAA8B,GAAA;AAC5B,IAAM,MAAA,IAAA,GAAOA,2CAA2B,CAAA,IAAA,CAAK,QAAQ,CAAA;AACrD,IAAO,OAAA;AAAA,MACL,IAAI,IAAK,CAAA,EAAA;AAAA,MACT,OAAO,IAAK,CAAA,KAAA;AAAA,MACZ,aAAa,IAAK,CAAA,WAAA;AAAA,MAClB,IAAA,EAAM,KAAK,aAAc,EAAA;AAAA,MACzB,OAAS,EAAA;AAAA,KACX;AAAA;AACF,EAEA,mBAAuC,GAAA;AACrC,IAAA,OAAO,IAAK,CAAA,UAAA;AAAA;AACd,EAEA,gBAA0E,GAAA;AACxE,IAAO,OAAA;AAAA,MACL,8CAAgD,EAAAC,mCAAA;AAAA,MAChD,4CAA8C,EAAA;AAAA,KAChD;AAAA;AACF,EAEA,cAAc,MAAsC,EAAA;AAClD,IAAA,MAAM,WACJ,GAAA,MAAA,CAAO,QAAS,CAAA,WAAA,GAAc,yBAAyB,CAAA;AACzD,IAAA,IAAI,CAAC,WAAa,EAAA;AAChB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,oBAAA,EAAuB,yBAAyB,CAAgB,aAAA,EAAAC,+BAAA;AAAA,UAC9D;AAAA,SACD,CAAA;AAAA,OACH;AAAA;AAGF,IAAA,MAAM,CAAC,KAAO,EAAA,IAAI,CAAI,GAAA,WAAA,CAAY,MAAM,GAAG,CAAA;AAC3C,IAAI,IAAA,CAAC,KAAS,IAAA,CAAC,IAAM,EAAA;AACnB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAsB,mBAAA,EAAA,yBAAyB,CAAK,EAAA,EAAA,WAAW,CAAe,YAAA,EAAAA,+BAAA;AAAA,UAC5E;AAAA,SACD,CAAA;AAAA,OACH;AAAA;AAGF,IAAO,OAAA,EAAE,OAAO,IAAK,EAAA;AAAA;AACvB,EAEA,MAAM,gBAAgB,MAAiC,EAAA;AACrD,IAAM,MAAA,UAAA,GAAa,IAAK,CAAA,aAAA,CAAc,MAAM,CAAA;AAC5C,IAAA,MAAM,EAAE,MAAA,EAAW,GAAAC,oCAAA,CAAwB,MAAM,CAAA;AACjD,IAAM,MAAA,MAAA,GAAS,MAAM,IAAA,CAAK,gBAAiB,CAAA,SAAA;AAAA,MACzC,MAAA;AAAA,MACA,UAAA;AAAA,MACA,IAAK,CAAA;AAAA,KACP;AACA,IAAA,OAAO,MAAO,CAAA,MAAA;AAAA;AAElB;;;;"}

package/dist/metricProviders/DependabotMetricProviderFactory.cjs.js

@@ -0,0 +1,17 @@
+'use strict';
+
+var DependabotMetricProvider = require('./DependabotMetricProvider.cjs.js');
+var DependabotConfig = require('./DependabotConfig.cjs.js');
+
+function createDependabotMetricProvider(config, logger, severity, thresholds) {
+  return new DependabotMetricProvider.DependabotMetricProvider(config, logger, severity, thresholds);
+}
+function createDependabotMetricProviders(config, logger, thresholds) {
+  return DependabotConfig.DEPENDABOT_SEVERITIES.map(
+    (severity) => createDependabotMetricProvider(config, logger, severity, thresholds)
+  );
+}
+
+exports.createDependabotMetricProvider = createDependabotMetricProvider;
+exports.createDependabotMetricProviders = createDependabotMetricProviders;
+//# sourceMappingURL=DependabotMetricProviderFactory.cjs.js.map

package/dist/metricProviders/DependabotMetricProviderFactory.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DependabotMetricProviderFactory.cjs.js","sources":["../../src/metricProviders/DependabotMetricProviderFactory.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { DependabotMetricProvider } from './DependabotMetricProvider';\nimport { DependabotSeverity, DEPENDABOT_SEVERITIES } from './DependabotConfig';\nimport { Config } from '@backstage/config';\nimport { LoggerService } from '@backstage/backend-plugin-api';\nimport { ThresholdConfig } from '@red-hat-developer-hub/backstage-plugin-scorecard-common';\nimport { MetricProvider } from '@red-hat-developer-hub/backstage-plugin-scorecard-node';\n\n/**\n * Creates a single Dependabot metric provider for the given severity.\n */\nexport function createDependabotMetricProvider(\n  config: Config,\n  logger: LoggerService,\n  severity: DependabotSeverity,\n  thresholds?: ThresholdConfig,\n): MetricProvider<'number'> {\n  return new DependabotMetricProvider(config, logger, severity, thresholds);\n}\n\n/**\n * Creates one metric provider per severity (critical, high, medium, low).\n */\nexport function createDependabotMetricProviders(\n  config: Config,\n  logger: LoggerService,\n  thresholds?: ThresholdConfig,\n): MetricProvider<'number'>[] {\n  return DEPENDABOT_SEVERITIES.map(severity =>\n    createDependabotMetricProvider(config, logger, severity, thresholds),\n  );\n}\n"],"names":["DependabotMetricProvider","DEPENDABOT_SEVERITIES"],"mappings":";;;;;AAyBO,SAAS,8BACd,CAAA,MAAA,EACA,MACA,EAAA,QAAA,EACA,UAC0B,EAAA;AAC1B,EAAA,OAAO,IAAIA,iDAAA,CAAyB,MAAQ,EAAA,MAAA,EAAQ,UAAU,UAAU,CAAA;AAC1E;AAKgB,SAAA,+BAAA,CACd,MACA,EAAA,MAAA,EACA,UAC4B,EAAA;AAC5B,EAAA,OAAOC,sCAAsB,CAAA,GAAA;AAAA,IAAI,CAC/B,QAAA,KAAA,8BAAA,CAA+B,MAAQ,EAAA,MAAA,EAAQ,UAAU,UAAU;AAAA,GACrE;AACF;;;;;"}

package/dist/module.cjs.js

@@ -0,0 +1,28 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+var backstagePluginScorecardNode = require('@red-hat-developer-hub/backstage-plugin-scorecard-node');
+var DependabotMetricProviderFactory = require('./metricProviders/DependabotMetricProviderFactory.cjs.js');
+
+const scorecardModuleDependabot = backendPluginApi.createBackendModule({
+  pluginId: "scorecard",
+  moduleId: "dependabot",
+  register(reg) {
+    reg.registerInit({
+      deps: {
+        metrics: backstagePluginScorecardNode.scorecardMetricsExtensionPoint,
+        config: backendPluginApi.coreServices.rootConfig,
+        logger: backendPluginApi.coreServices.logger
+      },
+      async init({ metrics, config, logger }) {
+        const providers = DependabotMetricProviderFactory.createDependabotMetricProviders(config, logger);
+        for (const provider of providers) {
+          metrics.addMetricProvider(provider);
+        }
+      }
+    });
+  }
+});
+
+exports.scorecardModuleDependabot = scorecardModuleDependabot;
+//# sourceMappingURL=module.cjs.js.map

package/dist/module.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.cjs.js","sources":["../src/module.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport {\n  coreServices,\n  createBackendModule,\n} from '@backstage/backend-plugin-api';\nimport { scorecardMetricsExtensionPoint } from '@red-hat-developer-hub/backstage-plugin-scorecard-node';\nimport { createDependabotMetricProviders } from './metricProviders/DependabotMetricProviderFactory';\n\nexport const scorecardModuleDependabot = createBackendModule({\n  pluginId: 'scorecard',\n  moduleId: 'dependabot',\n  register(reg) {\n    reg.registerInit({\n      deps: {\n        metrics: scorecardMetricsExtensionPoint,\n        config: coreServices.rootConfig,\n        logger: coreServices.logger,\n      },\n\n      async init({ metrics, config, logger }) {\n        const providers = createDependabotMetricProviders(config, logger);\n        for (const provider of providers) {\n          metrics.addMetricProvider(provider);\n        }\n      },\n    });\n  },\n});\n"],"names":["createBackendModule","scorecardMetricsExtensionPoint","coreServices","createDependabotMetricProviders"],"mappings":";;;;;;AAsBO,MAAM,4BAA4BA,oCAAoB,CAAA;AAAA,EAC3D,QAAU,EAAA,WAAA;AAAA,EACV,QAAU,EAAA,YAAA;AAAA,EACV,SAAS,GAAK,EAAA;AACZ,IAAA,GAAA,CAAI,YAAa,CAAA;AAAA,MACf,IAAM,EAAA;AAAA,QACJ,OAAS,EAAAC,2DAAA;AAAA,QACT,QAAQC,6BAAa,CAAA,UAAA;AAAA,QACrB,QAAQA,6BAAa,CAAA;AAAA,OACvB;AAAA,MAEA,MAAM,IAAK,CAAA,EAAE,OAAS,EAAA,MAAA,EAAQ,QAAU,EAAA;AACtC,QAAM,MAAA,SAAA,GAAYC,+DAAgC,CAAA,MAAA,EAAQ,MAAM,CAAA;AAChE,QAAA,KAAA,MAAW,YAAY,SAAW,EAAA;AAChC,UAAA,OAAA,CAAQ,kBAAkB,QAAQ,CAAA;AAAA;AACpC;AACF,KACD,CAAA;AAAA;AAEL,CAAC;;;;"}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot",
+  "version": "0.2.0",
+  "license": "Apache-2.0",
+  "description": "The dependabot backend module for the scorecard plugin.",
+  "main": "dist/index.cjs.js",
+  "types": "dist/index.d.ts",
+  "publishConfig": {
+    "access": "public",
+    "main": "dist/index.cjs.js",
+    "types": "dist/index.d.ts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/redhat-developer/rhdh-plugins",
+    "directory": "workspaces/scorecard/plugins/scorecard-backend-module-dependabot"
+  },
+  "backstage": {
+    "role": "backend-plugin-module",
+    "pluginId": "scorecard",
+    "pluginPackage": "@red-hat-developer-hub/backstage-plugin-scorecard-backend",
+    "features": {
+      ".": "@backstage/BackendFeature"
+    }
+  },
+  "scripts": {
+    "start": "backstage-cli package start",
+    "build": "backstage-cli package build",
+    "lint": "backstage-cli package lint",
+    "test": "backstage-cli package test",
+    "clean": "backstage-cli package clean",
+    "prepack": "backstage-cli package prepack",
+    "postpack": "backstage-cli package postpack"
+  },
+  "dependencies": {
+    "@backstage/backend-plugin-api": "^1.8.0",
+    "@backstage/catalog-client": "^1.14.0",
+    "@backstage/catalog-model": "^1.7.7",
+    "@backstage/config": "^1.3.6",
+    "@backstage/integration": "^2.0.0",
+    "@octokit/rest": "^19.0.3",
+    "@red-hat-developer-hub/backstage-plugin-scorecard-common": "^2.5.0",
+    "@red-hat-developer-hub/backstage-plugin-scorecard-node": "^2.5.0"
+  },
+  "devDependencies": {
+    "@backstage/backend-test-utils": "^1.11.1",
+    "@backstage/cli": "^0.36.0"
+  },
+  "files": [
+    "dist"
+  ],
+  "typesVersions": {
+    "*": {
+      "package.json": [
+        "package.json"
+      ]
+    }
+  }
+}