Merge branch 'main' into feat/data-outputs

src/config.ts

@@ -48,6 +48,10 @@ function readInlineConfig(): ConfigurationOptionsPartial {
     'retry-on-snapshot-warnings-timeout'
   )
   const warn_only = getOptionalBoolean('warn-only')
+  const show_openssf_scorecard = getOptionalBoolean('show-openssf-scorecard')
+  const warn_on_openssf_scorecard_level = getOptionalNumber(
+    'warn-on-openssf-scorecard-level'
+  )
 
   validatePURL(allow_dependencies_licenses)
   validateLicenses('allow-licenses', allow_licenses)
@@ -69,7 +73,9 @@ function readInlineConfig(): ConfigurationOptionsPartial {
     comment_summary_in_pr,
     retry_on_snapshot_warnings,
     retry_on_snapshot_warnings_timeout,
-    warn_only
+    warn_only,
+    show_openssf_scorecard,
+    warn_on_openssf_scorecard_level
   }
 
   return Object.fromEntries(

src/main.ts

@@ -3,7 +3,13 @@ import * as dependencyGraph from './dependency-graph'
 import * as github from '@actions/github'
 import styles from 'ansi-styles'
 import {RequestError} from '@octokit/request-error'
-import {Change, Severity, Changes, ConfigurationOptions} from './schemas'
+import {
+  Change,
+  Severity,
+  Changes,
+  ConfigurationOptions,
+  Scorecard
+} from './schemas'
 import {readConfig} from '../src/config'
 import {
   filterChangesBySeverity,
@@ -11,6 +17,7 @@ import {
   filterAllowedAdvisories
 } from '../src/filter'
 import {getInvalidLicenseChanges} from './licenses'
+import {getScorecardLevels} from './scorecard'
 import * as summary from './summary'
 import {getRefs} from './git-refs'
 
@@ -118,10 +125,13 @@ async function run(): Promise<void> {
       config.deny_groups
     )
 
+    const scorecard = await getScorecardLevels(filteredChanges)
+
     summary.addSummaryToSummary(
       vulnerableChanges,
       invalidLicenseChanges,
       deniedChanges,
+      scorecard,
       config
     )
 
@@ -147,6 +157,11 @@ async function run(): Promise<void> {
       summary.addDeniedToSummary(deniedChanges)
       printDeniedDependencies(deniedChanges, config)
     }
+    if (config.show_openssf_scorecard) {
+      summary.addScorecardToSummary(scorecard, config)
+      printScorecardBlock(scorecard, config)
+      createScorecardWarnings(scorecard, config)
+    }
 
     core.setOutput('dependency-changes', JSON.stringify(changes))
     summary.addScannedDependencies(changes)
@@ -264,6 +279,29 @@ function printNullLicenses(changes: Changes): void {
   }
 }
 
+function printScorecardBlock(
+  scorecard: Scorecard,
+  config: ConfigurationOptions
+): void {
+  core.group('Scorecard', async () => {
+    if (scorecard) {
+      for (const dependency of scorecard.dependencies) {
+        if (
+          dependency.scorecard?.score &&
+          dependency.scorecard?.score < config.warn_on_openssf_scorecard_level
+        ) {
+          core.info(
+            `${styles.color.red.open}${dependency.change.ecosystem}/${dependency.change.name}: OpenSSF Scorecard Score: ${dependency?.scorecard?.score}${styles.red.close}`
+          )
+        }
+        core.info(
+          `${dependency.change.ecosystem}/${dependency.change.name}: OpenSSF Scorecard Score: ${dependency?.scorecard?.score}`
+        )
+      }
+    }
+  })
+}
+
 function renderSeverity(
   severity: 'critical' | 'high' | 'moderate' | 'low'
 ): string {
@@ -332,4 +370,24 @@ function printDeniedDependencies(
   })
 }
 
+async function createScorecardWarnings(
+  scorecards: Scorecard,
+  config: ConfigurationOptions
+): Promise<void> {
+  // Iterate through the list of scorecards, and if the score is less than the threshold, send a warning
+  for (const dependency of scorecards.dependencies) {
+    if (
+      dependency.scorecard?.score &&
+      dependency.scorecard?.score < config.warn_on_openssf_scorecard_level
+    ) {
+      core.warning(
+        `${dependency.change.ecosystem}/${dependency.change.name} has an OpenSSF Scorecard of ${dependency.scorecard?.score}, which is less than this repository's threshold of ${config.warn_on_openssf_scorecard_level}.`,
+        {
+          title: 'OpenSSF Scorecard Warning'
+        }
+      )
+    }
+  }
+}
+
 run()

src/schemas.ts

@@ -51,6 +51,8 @@ export const ConfigurationOptionsSchema = z
     head_ref: z.string().optional(),
     retry_on_snapshot_warnings: z.boolean().default(false),
     retry_on_snapshot_warnings_timeout: z.number().default(120),
+    show_openssf_scorecard: z.boolean().optional().default(true),
+    warn_on_openssf_scorecard_level: z.number().default(3),
     comment_summary_in_pr: z
       .union([
         z.preprocess(
@@ -100,9 +102,51 @@ export const ComparisonResponseSchema = z.object({
   snapshot_warnings: z.string()
 })
 
+export const ScorecardApiSchema = z.object({
+  date: z.string(),
+  repo: z
+    .object({
+      name: z.string(),
+      commit: z.string()
+    })
+    .nullish(),
+  scorecard: z
+    .object({
+      version: z.string(),
+      commit: z.string()
+    })
+    .nullish(),
+  checks: z
+    .array(
+      z.object({
+        name: z.string(),
+        documentation: z.object({
+          shortDescription: z.string(),
+          url: z.string()
+        }),
+        score: z.string(),
+        reason: z.string(),
+        details: z.array(z.string())
+      })
+    )
+    .nullish(),
+  score: z.number().nullish()
+})
+
+export const ScorecardSchema = z.object({
+  dependencies: z.array(
+    z.object({
+      change: ChangeSchema,
+      scorecard: ScorecardApiSchema.nullish()
+    })
+  )
+})
+
 export type Change = z.infer<typeof ChangeSchema>
 export type Changes = z.infer<typeof ChangesSchema>
 export type ComparisonResponse = z.infer<typeof ComparisonResponseSchema>
 export type ConfigurationOptions = z.infer<typeof ConfigurationOptionsSchema>
 export type Severity = z.infer<typeof SeveritySchema>
 export type Scope = (typeof SCOPES)[number]
+export type Scorecard = z.infer<typeof ScorecardSchema>
+export type ScorecardApi = z.infer<typeof ScorecardApiSchema>

src/scorecard.ts

@@ -0,0 +1,73 @@
+import {Change, Scorecard, ScorecardApi} from './schemas'
+import * as core from '@actions/core'
+
+export async function getScorecardLevels(
+  changes: Change[]
+): Promise<Scorecard> {
+  const data: Scorecard = {dependencies: []} as Scorecard
+  for (const change of changes) {
+    const ecosystem = change.ecosystem
+    const packageName = change.name
+    const version = change.version
+
+    //Get the project repository
+    let repositoryUrl = change.source_repository_url
+    //If the repository_url includes the protocol, remove it
+    if (repositoryUrl?.startsWith('https://')) {
+      repositoryUrl = repositoryUrl.replace('https://', '')
+    }
+
+    // If GitHub API doesn't have the repository URL, query deps.dev for it.
+    if (repositoryUrl) {
+      // Call the deps.dev API to get the repository URL from there
+      repositoryUrl = await getProjectUrl(ecosystem, packageName, version)
+    }
+
+    // Get the scorecard API response from the scorecards API
+    let scorecardApi: ScorecardApi | null = null
+    if (repositoryUrl) {
+      try {
+        scorecardApi = await getScorecard(repositoryUrl)
+      } catch (error: unknown) {
+        core.debug(`Error querying for scorecard: ${(error as Error).message}`)
+      }
+    }
+    data.dependencies.push({
+      change,
+      scorecard: scorecardApi
+    })
+  }
+  return data
+}
+
+async function getScorecard(repositoryUrl: string): Promise<ScorecardApi> {
+  const apiRoot = 'https://api.securityscorecards.dev/'
+  let scorecardResponse: ScorecardApi = {} as ScorecardApi
+
+  const url = `${apiRoot}/projects/${repositoryUrl}`
+  const response = await fetch(url)
+  if (response.ok) {
+    scorecardResponse = await response.json()
+  } else {
+    core.debug(`Couldn't get scorecard data for ${repositoryUrl}`)
+  }
+  return scorecardResponse
+}
+
+export async function getProjectUrl(
+  ecosystem: string,
+  packageName: string,
+  version: string
+): Promise<string> {
+  core.debug(`Getting deps.dev data for ${packageName} ${version}`)
+  const depsDevAPIRoot = 'https://api.deps.dev'
+  const url = `${depsDevAPIRoot}/v3alpha/systems/${ecosystem}/packages/${packageName}/versions/${version}`
+  const response = await fetch(url)
+  if (response.ok) {
+    const data = await response.json()
+    if (data.relatedProjects.length > 0) {
+      return data.relatedProjects[0].projectKey.id
+    }
+  }
+  return ''
+}

src/summary.ts

@@ -1,5 +1,5 @@
 import * as core from '@actions/core'
-import {ConfigurationOptions, Changes, Change} from './schemas'
+import {ConfigurationOptions, Changes, Change, Scorecard} from './schemas'
 import {SummaryTableRow} from '@actions/core/lib/summary'
 import {InvalidLicenseChanges, InvalidLicenseChangeTypes} from './licenses'
 import {groupDependenciesByManifest, getManifestsSet, renderUrl} from './utils'
@@ -14,22 +14,30 @@ export function addSummaryToSummary(
   vulnerableChanges: Changes,
   invalidLicenseChanges: InvalidLicenseChanges,
   deniedChanges: Changes,
+  scorecard: Scorecard,
   config: ConfigurationOptions
 ): void {
+  const scorecardWarnings = countScorecardWarnings(scorecard, config)
+  const licenseIssues = countLicenseIssues(invalidLicenseChanges)
+
   core.summary.addHeading('Dependency Review', 1)
 
   if (
     vulnerableChanges.length === 0 &&
-    countLicenseIssues(invalidLicenseChanges) === 0 &&
-    deniedChanges.length === 0
+    licenseIssues === 0 &&
+    deniedChanges.length === 0 &&
+    scorecardWarnings === 0
   ) {
-    if (!config.license_check) {
-      core.summary.addRaw(`${icons.check} No vulnerabilities found.`)
-    } else if (!config.vulnerability_check) {
-      core.summary.addRaw(`${icons.check} No license issues found.`)
+    const issueTypes = [
+      config.vulnerability_check ? 'vulnerabilities' : '',
+      config.license_check ? 'license issues' : '',
+      config.show_openssf_scorecard ? 'OpenSSF Scorecard issues' : ''
+    ]
+    if (issueTypes.filter(Boolean).length === 0) {
+      core.summary.addRaw(`${icons.check} No issues found.`)
     } else {
       core.summary.addRaw(
-        `${icons.check} No vulnerabilities or license issues found.`
+        `${icons.check} No ${issueTypes.filter(Boolean).join(' or ')} found.`
       )
     }
 
@@ -65,11 +73,31 @@ export function addSummaryToSummary(
               deniedChanges.length
             } package(s) denied.`
           ]
+        : []),
+      ...(config.show_openssf_scorecard && scorecardWarnings > 0
+        ? [
+            `${checkOrWarnIcon(scorecardWarnings)} ${scorecardWarnings ? scorecardWarnings : 'No'} packages with OpenSSF Scorecard issues.`
+          ]
         : [])
     ])
     .addRaw('See the Details below.')
 }
 
+function countScorecardWarnings(
+  scorecard: Scorecard,
+  config: ConfigurationOptions
+): number {
+  return scorecard.dependencies.reduce(
+    (total, dependency) =>
+      total +
+      (dependency.scorecard?.score &&
+      dependency.scorecard?.score < config.warn_on_openssf_scorecard_level
+        ? 1
+        : 0),
+    0
+  )
+}
+
 export function addChangeVulnerabilitiesToSummary(
   vulnerableChanges: Changes,
   severity: string
@@ -249,6 +277,65 @@ function snapshotWarningRecommendation(
   return 'Re-running this action after a short time may resolve the issue.'
 }
 
+export function addScorecardToSummary(
+  scorecard: Scorecard,
+  config: ConfigurationOptions
+): void {
+  core.summary.addHeading('OpenSSF Scorecard', 2)
+  if (scorecard.dependencies.length > 10) {
+    core.summary.addRaw(`<details><summary>Scorecard details</summary>`, true)
+  }
+  core.summary.addRaw(
+    `<table><tr><th>Package</th><th>Version</th><th>Score</th><th>Details</th></tr>`,
+    true
+  )
+  for (const dependency of scorecard.dependencies) {
+    core.debug('Adding scorecard to summary')
+    core.debug(`Overall score ${dependency.scorecard?.score}`)
+
+    // Set the icon based on the overall score value
+    let overallIcon = ''
+    if (dependency.scorecard?.score) {
+      overallIcon =
+        dependency.scorecard?.score < config.warn_on_openssf_scorecard_level
+          ? ':warning:'
+          : ':green_circle:'
+    }
+
+    //Add a row for the dependency
+    core.summary.addRaw(
+      `<tr><td>${dependency.change.source_repository_url ? `<a href="https://${dependency.change.source_repository_url}">` : ''} ${dependency.change.ecosystem}/${dependency.change.name} ${dependency.change.source_repository_url ? `</a>` : ''}</td><td>${dependency.change.version}</td>
+      <td>${overallIcon} ${dependency.scorecard?.score === undefined || dependency.scorecard?.score === null ? 'Unknown' : dependency.scorecard?.score}</td>`,
+      false
+    )
+
+    //Add details table in the last column
+    if (dependency.scorecard?.checks !== undefined) {
+      let detailsTable =
+        '<table><tr><th>Check</th><th>Score</th><th>Reason</th></tr>'
+      for (const check of dependency.scorecard?.checks || []) {
+        const icon =
+          parseFloat(check.score) < config.warn_on_openssf_scorecard_level
+            ? ':warning:'
+            : ':green_circle:'
+
+        detailsTable += `<tr><td>${check.name}</td><td>${icon} ${check.score}</td><td>${check.reason}</td></tr>`
+      }
+      detailsTable += `</table>`
+      core.summary.addRaw(
+        `<td><details><summary>Details</summary>${detailsTable}</details></td></tr>`,
+        true
+      )
+    } else {
+      core.summary.addRaw('<td>Unknown</td></tr>', true)
+    }
+  }
+  core.summary.addRaw(`</table>`)
+  if (scorecard.dependencies.length > 10) {
+    core.summary.addRaw(`</details>`)
+  }
+}
+
 export function addSnapshotWarnings(
   config: ConfigurationOptions,
   warnings: string