@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot 0.2.10 → 0.2.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/dist/metricProviders/DependabotMetricProvider.cjs.js +2 -4
- package/dist/metricProviders/DependabotMetricProvider.cjs.js.map +1 -1
- package/dist/metricProviders/DependabotMetricProviderFactory.cjs.js +4 -4
- package/dist/metricProviders/DependabotMetricProviderFactory.cjs.js.map +1 -1
- package/package.json +3 -3
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,25 @@
|
|
|
1
1
|
# @red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot
|
|
2
2
|
|
|
3
|
+
## 0.2.12
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 6699550: Custom thresholds for filecheck, openssf, and dependabot are now
|
|
8
|
+
configurable. Custom threshold handling has been centralized in
|
|
9
|
+
`scorecard-backend`, you can define custom thresholds under
|
|
10
|
+
`scorecard.plugins.<providerId>.thresholds`. Provider IDs typically
|
|
11
|
+
follow the format `<datasource>.<metric>`.
|
|
12
|
+
- Updated dependencies [6699550]
|
|
13
|
+
- @red-hat-developer-hub/backstage-plugin-scorecard-node@2.7.8
|
|
14
|
+
- @red-hat-developer-hub/backstage-plugin-scorecard-common@2.7.8
|
|
15
|
+
|
|
16
|
+
## 0.2.11
|
|
17
|
+
|
|
18
|
+
### Patch Changes
|
|
19
|
+
|
|
20
|
+
- @red-hat-developer-hub/backstage-plugin-scorecard-common@2.7.7
|
|
21
|
+
- @red-hat-developer-hub/backstage-plugin-scorecard-node@2.7.7
|
|
22
|
+
|
|
3
23
|
## 0.2.10
|
|
4
24
|
|
|
5
25
|
### Patch Changes
|
|
@@ -8,12 +8,10 @@ var DependabotConfig = require('./DependabotConfig.cjs.js');
|
|
|
8
8
|
const GITHUB_PROJECT_ANNOTATION = "github.com/project-slug";
|
|
9
9
|
class DependabotMetricProvider {
|
|
10
10
|
dependabotClient;
|
|
11
|
-
thresholds;
|
|
12
11
|
severity;
|
|
13
|
-
constructor(config, logger, severity
|
|
12
|
+
constructor(config, logger, severity) {
|
|
14
13
|
this.severity = severity;
|
|
15
14
|
this.dependabotClient = new DependabotClient.DependabotClient(config, logger);
|
|
16
|
-
this.thresholds = thresholds ?? DependabotConfig.DEPENDABOT_THRESHOLDS;
|
|
17
15
|
}
|
|
18
16
|
getProviderDatasourceId() {
|
|
19
17
|
return "dependabot";
|
|
@@ -35,7 +33,7 @@ class DependabotMetricProvider {
|
|
|
35
33
|
};
|
|
36
34
|
}
|
|
37
35
|
getMetricThresholds() {
|
|
38
|
-
return
|
|
36
|
+
return DependabotConfig.DEPENDABOT_THRESHOLDS;
|
|
39
37
|
}
|
|
40
38
|
getCatalogFilter() {
|
|
41
39
|
return {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"DependabotMetricProvider.cjs.js","sources":["../../src/metricProviders/DependabotMetricProvider.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n Metric,\n ThresholdConfig,\n} from '@red-hat-developer-hub/backstage-plugin-scorecard-common';\nimport { MetricProvider } from '@red-hat-developer-hub/backstage-plugin-scorecard-node';\nimport type { LoggerService } from '@backstage/backend-plugin-api';\nimport type { Config } from '@backstage/config';\nimport {\n stringifyEntityRef,\n type Entity,\n getEntitySourceLocation,\n} from '@backstage/catalog-model';\nimport { CATALOG_FILTER_EXISTS } from '@backstage/catalog-client';\n\nimport { DependabotClient } from '../clients/DependabotClient';\nimport {\n type DependabotSeverity,\n DEPENDABOT_SEVERITY_METRIC,\n DEPENDABOT_THRESHOLDS,\n DependabotRepository,\n} from './DependabotConfig';\n\nconst GITHUB_PROJECT_ANNOTATION = 'github.com/project-slug';\n\n/**\n * Metric provider for Dependabot alerts of a single severity (critical, high, medium, low).\n * Use one instance per severity; the module registers four providers.\n */\nexport class DependabotMetricProvider implements MetricProvider<'number'> {\n private readonly dependabotClient: DependabotClient;\n private readonly
|
|
1
|
+
{"version":3,"file":"DependabotMetricProvider.cjs.js","sources":["../../src/metricProviders/DependabotMetricProvider.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n Metric,\n ThresholdConfig,\n} from '@red-hat-developer-hub/backstage-plugin-scorecard-common';\nimport { MetricProvider } from '@red-hat-developer-hub/backstage-plugin-scorecard-node';\nimport type { LoggerService } from '@backstage/backend-plugin-api';\nimport type { Config } from '@backstage/config';\nimport {\n stringifyEntityRef,\n type Entity,\n getEntitySourceLocation,\n} from '@backstage/catalog-model';\nimport { CATALOG_FILTER_EXISTS } from '@backstage/catalog-client';\n\nimport { DependabotClient } from '../clients/DependabotClient';\nimport {\n type DependabotSeverity,\n DEPENDABOT_SEVERITY_METRIC,\n DEPENDABOT_THRESHOLDS,\n DependabotRepository,\n} from './DependabotConfig';\n\nconst GITHUB_PROJECT_ANNOTATION = 'github.com/project-slug';\n\n/**\n * Metric provider for Dependabot alerts of a single severity (critical, high, medium, low).\n * Use one instance per severity; the module registers four providers.\n */\nexport class DependabotMetricProvider implements MetricProvider<'number'> {\n private readonly dependabotClient: DependabotClient;\n private readonly severity: DependabotSeverity;\n\n constructor(\n config: Config,\n logger: LoggerService,\n severity: DependabotSeverity,\n ) {\n this.severity = severity;\n this.dependabotClient = new DependabotClient(config, logger);\n }\n\n getProviderDatasourceId(): string {\n return 'dependabot';\n }\n\n getProviderId(): string {\n return DEPENDABOT_SEVERITY_METRIC[this.severity].id;\n }\n\n getMetricType(): 'number' {\n return 'number';\n }\n\n getMetric(): Metric<'number'> {\n const meta = DEPENDABOT_SEVERITY_METRIC[this.severity];\n return {\n id: meta.id,\n title: meta.title,\n description: meta.description,\n type: this.getMetricType(),\n history: true,\n };\n }\n\n getMetricThresholds(): ThresholdConfig {\n return DEPENDABOT_THRESHOLDS;\n }\n\n getCatalogFilter(): Record<string, string | symbol | (string | symbol)[]> {\n return {\n 'metadata.annotations.github.com/project-slug': CATALOG_FILTER_EXISTS,\n 'metadata.annotations.github.com/dependabot': 'true',\n };\n }\n\n getRepository(entity: Entity): DependabotRepository {\n const projectSlug =\n entity.metadata.annotations?.[GITHUB_PROJECT_ANNOTATION];\n if (!projectSlug) {\n throw new Error(\n `Missing annotation '${GITHUB_PROJECT_ANNOTATION}' for entity ${stringifyEntityRef(\n entity,\n )}`,\n );\n }\n\n const [owner, repo] = projectSlug.split('/');\n if (!owner || !repo) {\n throw new Error(\n `Invalid format of '${GITHUB_PROJECT_ANNOTATION}' ${projectSlug} for entity ${stringifyEntityRef(\n entity,\n )}`,\n );\n }\n\n return { owner, repo };\n }\n\n async calculateMetric(entity: Entity): Promise<number> {\n const repository = this.getRepository(entity);\n const { target } = getEntitySourceLocation(entity);\n const alerts = await this.dependabotClient.getAlerts(\n target,\n repository,\n this.severity,\n );\n return alerts.length;\n }\n}\n"],"names":["DependabotClient","DEPENDABOT_SEVERITY_METRIC","DEPENDABOT_THRESHOLDS","CATALOG_FILTER_EXISTS","stringifyEntityRef","getEntitySourceLocation"],"mappings":";;;;;;;AAsCA,MAAM,yBAA4B,GAAA,yBAAA;AAM3B,MAAM,wBAA6D,CAAA;AAAA,EACvD,gBAAA;AAAA,EACA,QAAA;AAAA,EAEjB,WAAA,CACE,MACA,EAAA,MAAA,EACA,QACA,EAAA;AACA,IAAA,IAAA,CAAK,QAAW,GAAA,QAAA;AAChB,IAAA,IAAA,CAAK,gBAAmB,GAAA,IAAIA,iCAAiB,CAAA,MAAA,EAAQ,MAAM,CAAA;AAAA;AAC7D,EAEA,uBAAkC,GAAA;AAChC,IAAO,OAAA,YAAA;AAAA;AACT,EAEA,aAAwB,GAAA;AACtB,IAAO,OAAAC,2CAAA,CAA2B,IAAK,CAAA,QAAQ,CAAE,CAAA,EAAA;AAAA;AACnD,EAEA,aAA0B,GAAA;AACxB,IAAO,OAAA,QAAA;AAAA;AACT,EAEA,SAA8B,GAAA;AAC5B,IAAM,MAAA,IAAA,GAAOA,2CAA2B,CAAA,IAAA,CAAK,QAAQ,CAAA;AACrD,IAAO,OAAA;AAAA,MACL,IAAI,IAAK,CAAA,EAAA;AAAA,MACT,OAAO,IAAK,CAAA,KAAA;AAAA,MACZ,aAAa,IAAK,CAAA,WAAA;AAAA,MAClB,IAAA,EAAM,KAAK,aAAc,EAAA;AAAA,MACzB,OAAS,EAAA;AAAA,KACX;AAAA;AACF,EAEA,mBAAuC,GAAA;AACrC,IAAO,OAAAC,sCAAA;AAAA;AACT,EAEA,gBAA0E,GAAA;AACxE,IAAO,OAAA;AAAA,MACL,8CAAgD,EAAAC,mCAAA;AAAA,MAChD,4CAA8C,EAAA;AAAA,KAChD;AAAA;AACF,EAEA,cAAc,MAAsC,EAAA;AAClD,IAAA,MAAM,WACJ,GAAA,MAAA,CAAO,QAAS,CAAA,WAAA,GAAc,yBAAyB,CAAA;AACzD,IAAA,IAAI,CAAC,WAAa,EAAA;AAChB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,oBAAA,EAAuB,yBAAyB,CAAgB,aAAA,EAAAC,+BAAA;AAAA,UAC9D;AAAA,SACD,CAAA;AAAA,OACH;AAAA;AAGF,IAAA,MAAM,CAAC,KAAO,EAAA,IAAI,CAAI,GAAA,WAAA,CAAY,MAAM,GAAG,CAAA;AAC3C,IAAI,IAAA,CAAC,KAAS,IAAA,CAAC,IAAM,EAAA;AACnB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAsB,mBAAA,EAAA,yBAAyB,CAAK,EAAA,EAAA,WAAW,CAAe,YAAA,EAAAA,+BAAA;AAAA,UAC5E;AAAA,SACD,CAAA;AAAA,OACH;AAAA;AAGF,IAAO,OAAA,EAAE,OAAO,IAAK,EAAA;AAAA;AACvB,EAEA,MAAM,gBAAgB,MAAiC,EAAA;AACrD,IAAM,MAAA,UAAA,GAAa,IAAK,CAAA,aAAA,CAAc,MAAM,CAAA;AAC5C,IAAA,MAAM,EAAE,MAAA,EAAW,GAAAC,oCAAA,CAAwB,MAAM,CAAA;AACjD,IAAM,MAAA,MAAA,GAAS,MAAM,IAAA,CAAK,gBAAiB,CAAA,SAAA;AAAA,MACzC,MAAA;AAAA,MACA,UAAA;AAAA,MACA,IAAK,CAAA;AAAA,KACP;AACA,IAAA,OAAO,MAAO,CAAA,MAAA;AAAA;AAElB;;;;"}
|
|
@@ -3,12 +3,12 @@
|
|
|
3
3
|
var DependabotMetricProvider = require('./DependabotMetricProvider.cjs.js');
|
|
4
4
|
var DependabotConfig = require('./DependabotConfig.cjs.js');
|
|
5
5
|
|
|
6
|
-
function createDependabotMetricProvider(config, logger, severity
|
|
7
|
-
return new DependabotMetricProvider.DependabotMetricProvider(config, logger, severity
|
|
6
|
+
function createDependabotMetricProvider(config, logger, severity) {
|
|
7
|
+
return new DependabotMetricProvider.DependabotMetricProvider(config, logger, severity);
|
|
8
8
|
}
|
|
9
|
-
function createDependabotMetricProviders(config, logger
|
|
9
|
+
function createDependabotMetricProviders(config, logger) {
|
|
10
10
|
return DependabotConfig.DEPENDABOT_SEVERITIES.map(
|
|
11
|
-
(severity) => createDependabotMetricProvider(config, logger, severity
|
|
11
|
+
(severity) => createDependabotMetricProvider(config, logger, severity)
|
|
12
12
|
);
|
|
13
13
|
}
|
|
14
14
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"DependabotMetricProviderFactory.cjs.js","sources":["../../src/metricProviders/DependabotMetricProviderFactory.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { DependabotMetricProvider } from './DependabotMetricProvider';\nimport { DependabotSeverity, DEPENDABOT_SEVERITIES } from './DependabotConfig';\nimport { Config } from '@backstage/config';\nimport { LoggerService } from '@backstage/backend-plugin-api';\nimport {
|
|
1
|
+
{"version":3,"file":"DependabotMetricProviderFactory.cjs.js","sources":["../../src/metricProviders/DependabotMetricProviderFactory.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n * http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { DependabotMetricProvider } from './DependabotMetricProvider';\nimport { DependabotSeverity, DEPENDABOT_SEVERITIES } from './DependabotConfig';\nimport { Config } from '@backstage/config';\nimport { LoggerService } from '@backstage/backend-plugin-api';\nimport { MetricProvider } from '@red-hat-developer-hub/backstage-plugin-scorecard-node';\n\n/**\n * Creates a single Dependabot metric provider for the given severity.\n */\nexport function createDependabotMetricProvider(\n config: Config,\n logger: LoggerService,\n severity: DependabotSeverity,\n): MetricProvider<'number'> {\n return new DependabotMetricProvider(config, logger, severity);\n}\n\n/**\n * Creates one metric provider per severity (critical, high, medium, low).\n */\nexport function createDependabotMetricProviders(\n config: Config,\n logger: LoggerService,\n): MetricProvider<'number'>[] {\n return DEPENDABOT_SEVERITIES.map(severity =>\n createDependabotMetricProvider(config, logger, severity),\n );\n}\n"],"names":["DependabotMetricProvider","DEPENDABOT_SEVERITIES"],"mappings":";;;;;AAwBgB,SAAA,8BAAA,CACd,MACA,EAAA,MAAA,EACA,QAC0B,EAAA;AAC1B,EAAA,OAAO,IAAIA,iDAAA,CAAyB,MAAQ,EAAA,MAAA,EAAQ,QAAQ,CAAA;AAC9D;AAKgB,SAAA,+BAAA,CACd,QACA,MAC4B,EAAA;AAC5B,EAAA,OAAOC,sCAAsB,CAAA,GAAA;AAAA,IAAI,CAC/B,QAAA,KAAA,8BAAA,CAA+B,MAAQ,EAAA,MAAA,EAAQ,QAAQ;AAAA,GACzD;AACF;;;;;"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.12",
|
|
4
4
|
"license": "Apache-2.0",
|
|
5
5
|
"description": "The dependabot backend module for the scorecard plugin.",
|
|
6
6
|
"main": "dist/index.cjs.js",
|
|
@@ -39,8 +39,8 @@
|
|
|
39
39
|
"@backstage/config": "^1.3.6",
|
|
40
40
|
"@backstage/integration": "^2.0.0",
|
|
41
41
|
"@octokit/rest": "^19.0.3",
|
|
42
|
-
"@red-hat-developer-hub/backstage-plugin-scorecard-common": "^2.7.
|
|
43
|
-
"@red-hat-developer-hub/backstage-plugin-scorecard-node": "^2.7.
|
|
42
|
+
"@red-hat-developer-hub/backstage-plugin-scorecard-common": "^2.7.8",
|
|
43
|
+
"@red-hat-developer-hub/backstage-plugin-scorecard-node": "^2.7.8"
|
|
44
44
|
},
|
|
45
45
|
"devDependencies": {
|
|
46
46
|
"@backstage/backend-test-utils": "^1.11.1",
|