From e69288dbec0527e798d881835011acd89e3da18f Mon Sep 17 00:00:00 2001
From: Eli Reisman <elireisman@github.com>
Date: Fri, 7 Jun 2024 10:00:37 -0700
Subject: [PATCH] only filter out removed changes from the original PR diff
 when adding scorecard entries in DR Action report

---
 src/main.ts | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/main.ts b/src/main.ts
index f9419d3..0be8abb 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -125,7 +125,9 @@ async function run(): Promise<void> {
       config.deny_groups
     )
 
-    const scorecard = await getScorecardLevels(filteredChanges)
+    // generate informational scorecard entries for all added changes in the PR
+    const scorecardChanges = getScorecardChanges(changes)
+    const scorecard = await getScorecardLevels(scorecardChanges)
 
     const minSummary = summary.addSummaryToSummary(
       vulnerableChanges,
@@ -369,7 +371,7 @@ function printScannedDependencies(changes: Changes): void {
 }
 
 function printDeniedDependencies(
-  changes: Change[],
+  changes: Changes,
   config: ConfigurationOptions
 ): void {
   core.group('Denied', async () => {
@@ -384,6 +386,17 @@ function printDeniedDependencies(
   })
 }
 
+function getScorecardChanges(changes: Changes): Changes {
+  const out: Changes = []
+  for (const change of changes) {
+    if (change.change_type === 'added') {
+      out.push(change)
+    }
+  }
+
+  return out
+}
+
 async function createScorecardWarnings(
   scorecards: Scorecard,
   config: ConfigurationOptions