Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Summarize package reports #20

Open
yrobla opened this issue May 7, 2024 · 1 comment · May be fixed by #30
Open

Summarize package reports #20

yrobla opened this issue May 7, 2024 · 1 comment · May be fixed by #30
Assignees
@yrobla

Comments

@yrobla
Copy link
Contributor

yrobla commented May 7, 2024

Currently the report is expanded all the time. It can be difficult to read if there are hundreds of dependencies. We can have an initial summary table with the failure/success, then expanded on demand.
@yrobla yrobla self-assigned this May 8, 2024
@yrobla
Copy link
Contributor Author

yrobla commented May 8, 2024 •
edited

testing:

🐻 Trusty Dependency Analysis Action Report

🔴 Failed Dependencies Summary

Name Trusty Score Malicious Archived Deprecated
bugsnagmw 0.00 ❌ ✅ ✅
scriptoni 4.40 ✅ ❌ ❌
notifyjs 5.70 ✅ ❌ ✅

🟢 Successful Dependencies Summary

Name Trusty Score
next 9.30
react 8.00

Detailed Information for Failed Dependencies

bugsnagmw

 0.00
⚠ Malicious (This package is marked as Malicious. Proceed with extreme caution!) ❌
Trusty Score: 0.00 ❌
Category Score Passed
Repo activity 0.00 ❌
Author activity 0.00 ❌
Provenance 5.00 ✅
Typosquatting 10.00 ✅
Proof of origin (Provenance)  
| | | | --- | --- | | Number of versions | 0 | | Number of Git Tags/Releases | 0 | | Number of versions matched to Git Tags/Releases | 0 |

Learn more about source of origin provenance

Alternative Packages 💡
Package Score Trusty Link
rollbar 5.70 rollbar

scriptoni

 4.40
⚠ Deprecated (This package is marked as Deprecated. Proceed with caution!) ❌
⚠ Archived (This package is marked as Archived. Proceed with caution!) ❌
Trusty Score: 4.40 ❌
Category Score Passed
Repo activity 2.70 ❌
Author activity 6.20 ✅
Provenance 8.00 ✅
Typosquatting 10.00 ✅
Proof of origin (Provenance)  
| | | | --- | --- | | Number of versions | 100 | | Number of Git Tags/Releases | 96 | | Number of versions matched to Git Tags/Releases | 90 |

Learn more about source of origin provenance

Alternative Packages 💡
Package Score Trusty Link
create-react-app 8.00 create-react-app
react-app-rewired 7.20 react-app-rewired
react-scripts 5.00 react-scripts
craco 3.50 craco

notifyjs

 5.70
⚠ Archived (This package is marked as Archived. Proceed with caution!) ❌
Trusty Score: 5.70 ✅
Category Score Passed
Repo activity 5.00 ✅
Author activity 6.50 ✅
Provenance 8.00 ✅
Typosquatting 10.00 ✅
Proof of origin (Provenance)  
| | | | --- | --- | | Number of versions | 16 | | Number of Git Tags/Releases | 16 | | Number of versions matched to Git Tags/Releases | 13 |

Learn more about source of origin provenance

Alternative Packages 💡
Package Score Trusty Link
node-notifier 7.10 node-notifier

Detailed Information for Successful Dependencies

next

 9.30 Sigstore
Trusty Score: 9.30 ✅
Category Score Passed
Repo activity 10.00 ✅
Author activity 8.60 ✅
Provenance 10.00 ✅
Typosquatting 10.00 ✅
Proof of origin (Provenance)
Built and signed with sigstore using GitHub Actions.
Source repo https://github.com/vercel/next.js
Github Action Workflow .github/workflows/build_and_deploy.yml
Issuer CN=sigstore-intermediate,O=sigstore.dev
Rekor Public Ledger https://search.sigstore.dev/?logIndex=88381843

Learn more about source of origin provenance

Alternative Packages 💡
Package Score Trusty Link
http-proxy 8.00 http-proxy
react-router 8.00 react-router
vue-router 5.00 vue-router
react-router-dom 5.00 react-router-dom

react

 8.00
Trusty Score: 8.00 ✅
Category Score Passed
Repo activity 10.00 ✅
Author activity 8.20 ✅
Provenance 8.00 ✅
Typosquatting 10.00 ✅
Proof of origin (Provenance)  
| | | | --- | --- | | Number of versions | 1756 | | Number of Git Tags/Releases | 136 | | Number of versions matched to Git Tags/Releases | 69 |

Learn more about source of origin provenance

Alternative Packages 💡
Package Score Trusty Link
styled-components 8.00 styled-components
vue 8.00 vue
svelte 8.00 svelte
preact 7.80 preact
inferno 7.50 inferno

🌟 If you like this action, why not try out Minder, the secure supply chain platform. It has vastly more protections and is also free (as in 🍺) to opensource projects.

yrobla added a commit that referenced this issue May 8, 2024
@yrobla
feat: improve formatting with a summary of dependencies
2ca932d 
Closes: #20
@yrobla yrobla linked a pull request May 8, 2024 that will close this issue
Open
yrobla added a commit that referenced this issue May 8, 2024
@yrobla
feat: improve formatting with a summary of dependencies
0f47489 
Closes: #20
yrobla added a commit that referenced this issue May 9, 2024
@yrobla
feat: improve formatting with a summary of dependencies
5aa3744 
Closes: #20
yrobla added a commit that referenced this issue May 9, 2024
@yrobla
feat: improve formatting with a summary of dependencies
34c1995 
Closes: #20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@yrobla yrobla

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: improve formatting with a summary of dependencies stacklok/trusty-action
1 participant
@yrobla