feat: add "vertical" output format #889
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
G-Rath
force-pushed
the
add-vertical-reporter
branch
3 times, most recently
from
505d532
to
bae0efe
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #889 +/- ##
==========================================
+ Coverage 64.47% 64.88% +0.40%
==========================================
Files 148 150 +2
Lines 12088 12259 +171
==========================================
+ Hits 7794 7954 +160
- Misses 3843 3853 +10
- Partials 451 452 +1 ☔ View full report in Codecov by Sentry. |
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
b32bc50
to
9d20ff7
Compare
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
1e47759
to
181148d
Compare
This comment was marked as resolved.
This comment was marked as resolved.
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
181148d
to
e2e8479
Compare
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
e2e8479
to
b8ac63e
Compare
another-rex
pushed a commit
that referenced
this pull request
May 24, 2024
This introduces a set of crafted scanner results that each supported `output` format is run through to showcase how they look across all the different results possible from a scanner run - it originally started life as the tests for #889 but I realised they could base used more generally for testing and reviewing all the outputters, so here we are. ~It looks like this has also revealed the SARIF output is unstable in its ordering, which I'll aim to address in a dedicated PR~
G-Rath
force-pushed
the
add-vertical-reporter
branch
2 times, most recently
from
d5c8f4d
to
b266097
Compare
This comment was marked as resolved.
This comment was marked as resolved.
G-Rath
force-pushed
the
add-vertical-reporter
branch
2 times, most recently
from
ab449a3
to
1ecd8e0
Compare
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
1ecd8e0
to
14e97cd
Compare
|
LGTM - however I am not sure if we want the output in this color schema. @another-rex is there any discussion/agreement on this? |
josieang
pushed a commit
to josieang/osv-scanner
that referenced
this pull request
Jun 6, 2024
This introduces a set of crafted scanner results that each supported `output` format is run through to showcase how they look across all the different results possible from a scanner run - it originally started life as the tests for google#889 but I realised they could base used more generally for testing and reviewing all the outputters, so here we are. ~It looks like this has also revealed the SARIF output is unstable in its ordering, which I'll aim to address in a dedicated PR~
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds a new "vertical" output format that is designed for humans and based on the output of
osv-detector, which effectively aims to group the output relating to each entity being scanned in vertical slices:Unfortunately I think it suffers significantly due to the assumptions made by the rest of the codebase for outputting that made sense when the final output was a table i.e. we dump a lot of information as we go about scanning, config files, vulnerability filtering, and so on that really should be grouped but currently cannot because they're all outputted at different stages - I think a way to address that could be using some sort of event-emitter type pattern so that the reporters could be responsible for deciding what they actually do (e.g.
r.Emit("filtered-vulnerability", ...)and then most reporters could choose to just print immediately, and ones like "vertical" could choose to add it to an internal struct), but I think that'll involve a lot more work; for now I'm just going to ignore the pre-results output.Resolves #85