@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/README.md +22 -0
- package/package.json +3 -3
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# @red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot
|
|
2
2
|
|
|
3
|
+
## 0.3.1
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 7ead71c: Correct default threshold documentation and add missing threshold documentation in scorecard backend module READMEs to match provider code defaults.
|
|
8
|
+
- @red-hat-developer-hub/backstage-plugin-scorecard-common@2.8.1
|
|
9
|
+
- @red-hat-developer-hub/backstage-plugin-scorecard-node@2.8.1
|
|
10
|
+
|
|
3
11
|
## 0.3.0
|
|
4
12
|
|
|
5
13
|
### Minor Changes
|
package/README.md
CHANGED
|
@@ -7,3 +7,25 @@ Adds Dependabot alerts as a scorecard metric (`dependabot.alerts`, 0–9 from se
|
|
|
7
7
|
**Setup:** Entities need `github.com/project-slug: owner/repo` and `github.com/dependabot: 'true'` (exact string) to opt in. GitHub token must have `security_events` (or Dependabot read) so the backend can call the Dependabot API.
|
|
8
8
|
|
|
9
9
|
**How it works:** **DependabotClient** fetches open alerts from the GitHub API (by severity, with pagination). **DependabotMetricProvider** (one per severity) uses the client to score entities. The **factory** (`createDependabotMetricProvider` / `createDependabotMetricProviders`) builds single or all-four providers; the module registers the four (critical, high, medium, low) with the scorecard backend.
|
|
10
|
+
|
|
11
|
+
## Default thresholds
|
|
12
|
+
|
|
13
|
+
All four severity metrics share the same default thresholds. Default thresholds for `dependabot.alerts_critical`:
|
|
14
|
+
|
|
15
|
+
```yaml
|
|
16
|
+
# app-config.yaml
|
|
17
|
+
scorecard:
|
|
18
|
+
plugins:
|
|
19
|
+
dependabot:
|
|
20
|
+
alerts_critical:
|
|
21
|
+
thresholds:
|
|
22
|
+
rules:
|
|
23
|
+
- key: success
|
|
24
|
+
expression: '<1'
|
|
25
|
+
- key: warning
|
|
26
|
+
expression: '1-7'
|
|
27
|
+
- key: error
|
|
28
|
+
expression: '>7'
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
Replace `alerts_critical` with `alerts_high`, `alerts_medium`, or `alerts_low` for the other severity metrics. See [threshold configuration](../scorecard-backend/docs/thresholds.md) for custom configuration.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.1",
|
|
4
4
|
"license": "Apache-2.0",
|
|
5
5
|
"description": "The dependabot backend module for the scorecard plugin.",
|
|
6
6
|
"main": "dist/index.cjs.js",
|
|
@@ -39,8 +39,8 @@
|
|
|
39
39
|
"@backstage/config": "^1.3.8",
|
|
40
40
|
"@backstage/integration": "^2.0.2",
|
|
41
41
|
"@octokit/rest": "^19.0.3",
|
|
42
|
-
"@red-hat-developer-hub/backstage-plugin-scorecard-common": "^2.8.
|
|
43
|
-
"@red-hat-developer-hub/backstage-plugin-scorecard-node": "^2.8.
|
|
42
|
+
"@red-hat-developer-hub/backstage-plugin-scorecard-common": "^2.8.1",
|
|
43
|
+
"@red-hat-developer-hub/backstage-plugin-scorecard-node": "^2.8.1"
|
|
44
44
|
},
|
|
45
45
|
"devDependencies": {
|
|
46
46
|
"@backstage/backend-test-utils": "^1.11.3",
|