From 7dc5f537be787e9d0671ebca3950794721b7c42c Mon Sep 17 00:00:00 2001
From: Justin Hutchings <jhutchings1@users.noreply.github.com>
Date: Tue, 12 Mar 2024 20:47:25 +0000
Subject: [PATCH] Add scorecard to summary and count scorecard warnings

---
 src/main.ts    |  4 +++-
 src/summary.ts | 47 ++++++++++++++++++++++++++++++++++++-----------
 2 files changed, 39 insertions(+), 12 deletions(-)

diff --git a/src/main.ts b/src/main.ts
index 3ad9d8f..68d2c6a 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -126,10 +126,13 @@ async function run(): Promise<void> {
       config.deny_groups
     )
 
+    const scorecard = await getScorecardLevels(filteredChanges)
+
     summary.addSummaryToSummary(
       vulnerableChanges,
       invalidLicenseChanges,
       deniedChanges,
+      scorecard,
       config
     )
 
@@ -150,7 +153,6 @@ async function run(): Promise<void> {
       printDeniedDependencies(deniedChanges, config)
     }
     if (config.show_openssf_scorecard) {
-      const scorecard = await getScorecardLevels(filteredChanges)
       summary.addScorecardToSummary(scorecard, config)
       printScorecardBlock(scorecard, config)
       createScorecardWarnings(scorecard, config)
diff --git a/src/summary.ts b/src/summary.ts
index a882192..f73e36c 100644
--- a/src/summary.ts
+++ b/src/summary.ts
@@ -14,22 +14,30 @@ export function addSummaryToSummary(
   vulnerableChanges: Changes,
   invalidLicenseChanges: InvalidLicenseChanges,
   deniedChanges: Changes,
+  scorecard: Scorecard,
   config: ConfigurationOptions
 ): void {
+  const scorecardWarnings = countScorecardWarnings(scorecard, config)
+  const licenseIssues = countLicenseIssues(invalidLicenseChanges)
+
   core.summary.addHeading('Dependency Review', 1)
 
   if (
     vulnerableChanges.length === 0 &&
-    countLicenseIssues(invalidLicenseChanges) === 0 &&
-    deniedChanges.length === 0
+    licenseIssues === 0 &&
+    deniedChanges.length === 0 &&
+    scorecardWarnings === 0
   ) {
-    if (!config.license_check) {
-      core.summary.addRaw(`${icons.check} No vulnerabilities found.`)
-    } else if (!config.vulnerability_check) {
-      core.summary.addRaw(`${icons.check} No license issues found.`)
+    const issueTypes = [
+      config.vulnerability_check ? 'vulnerabilities' : '',
+      config.license_check ? 'license issues' : '',
+      config.show_openssf_scorecard ? 'OpenSSF Scorecard issues' : ''
+    ]
+    if (issueTypes.filter(Boolean).length === 0) {
+      core.summary.addRaw(`${icons.check} No issues found.`)
     } else {
       core.summary.addRaw(
-        `${icons.check} No vulnerabilities or license issues found.`
+        `No ${issueTypes.filter(Boolean).join(' or ')} found.`
       )
     }
 
@@ -65,11 +73,31 @@ export function addSummaryToSummary(
               deniedChanges.length
             } package(s) denied.`
           ]
+        : []),
+      ...(config.show_openssf_scorecard && scorecardWarnings > 0
+        ? [
+            `${checkOrWarnIcon(scorecardWarnings)} ${scorecardWarnings ? scorecardWarnings : 'No'} packages with OpenSSF Scorecard issues.`
+          ]
         : [])
     ])
     .addRaw('See the Details below.')
 }
 
+function countScorecardWarnings(
+  scorecard: Scorecard,
+  config: ConfigurationOptions
+): number {
+  return scorecard.dependencies.reduce(
+    (total, dependency) =>
+      total +
+      (dependency.scorecard?.score &&
+      dependency.scorecard?.score < config.warn_on_openssf_scorecard_level
+        ? 1
+        : 0),
+    0
+  )
+}
+
 export function addChangeVulnerabilitiesToSummary(
   vulnerableChanges: Changes,
   severity: string
@@ -267,10 +295,7 @@ export function addScorecardToSummary(
 
     // Set the icon based on the overall score value
     let overallIcon = ''
-    if (
-      dependency.scorecard?.score !== undefined &&
-      dependency.scorecard?.score !== null
-    ) {
+    if (dependency.scorecard?.score) {
       overallIcon =
         dependency.scorecard?.score < config.warn_on_openssf_scorecard_level
           ? ':warning:'