Refactor types, add printing

src/main.ts

@@ -3,7 +3,14 @@ import * as dependencyGraph from './dependency-graph'
 import * as github from '@actions/github'
 import styles from 'ansi-styles'
 import {RequestError} from '@octokit/request-error'
-import {Change, Severity, Changes, ConfigurationOptions} from './schemas'
+import {
+  Change,
+  Severity,
+  Changes,
+  ConfigurationOptions,
+  Scorecard,
+  DepsDevProject
+} from './schemas'
 import {readConfig} from '../src/config'
 import {
   filterChangesBySeverity,
@@ -145,6 +152,8 @@ async function run(): Promise<void> {
       summary.addDeniedToSummary(deniedChanges)
       printDeniedDependencies(deniedChanges, config)
     }
+    //summary.addScorecardToSummary(scorecard, config)
+    printScorecardBlock(scorecard, config)
 
     summary.addScannedDependencies(changes)
     printScannedDependencies(changes)
@@ -261,6 +270,21 @@ function printNullLicenses(changes: Changes): void {
   }
 }
 
+function printScorecardBlock(
+  scorecard: Scorecard,
+  config: ConfigurationOptions
+): void {
+  core.group('Scorecard', async () => {
+    if (scorecard) {
+      for (const dependency of scorecard.dependencies) {
+        core.info(
+          `${dependency.ecosystem}/${dependency.packageName}: OpenSSF Scorecard Score: ${dependency.depsDevData.scorecard.overallScore}`
+        )
+      }
+    }
+  })
+}
+
 function renderSeverity(
   severity: 'critical' | 'high' | 'moderate' | 'low'
 ): string {

src/schemas.ts

@@ -102,46 +102,57 @@ export const ComparisonResponseSchema = z.object({
 
 export const DepsDevProjectSchema = z.object({
   projectKey: z.object({
-    id: z.string({}),
-    openIssuesCount: z.string(),
-    starsCount: z.string(),
-    forksCount: z.string(),
-    license: z.string(),
-    description: z.string(),
-    homepage: z.string(),
-    scorecard: z.object({
-      date: z.string(),
-      repository: z.object({
-        name: z.string(),
-        commit: z.string()
-      }),
-      scorecard: z.object({
-        version: z.string(),
-        commit: z.string()
-      }),
-      checks: z.array(
-        z.object({
-          name: z.string(),
-          documentation: z.object({
-            shortDescription: z.string(),
-            url: z.string()
-          }),
-          score: z.string(),
-          reason: z.string(),
-          details: z.array(z.string())
-        })
-      ),
-      overallScore: z.number()
+    id: z.string({})
+  }),
+  openIssuesCount: z.string(),
+  starsCount: z.string(),
+  forksCount: z.string(),
+  license: z.string(),
+  description: z.string(),
+  homepage: z.string(),
+  scorecard: z.object({
+    date: z.string(),
+    repository: z.object({
+      name: z.string(),
+      commit: z.string()
     }),
-    ossFuzz: z.object({
-      lineCount: z.string(),
-      lineCoverCount: z.string(),
-      date: z.string(),
-      configUrl: z.string()
-    })
+    scorecard: z.object({
+      version: z.string(),
+      commit: z.string()
+    }),
+    checks: z.array(
+      z.object({
+        name: z.string(),
+        documentation: z.object({
+          shortDescription: z.string(),
+          url: z.string()
+        }),
+        score: z.string(),
+        reason: z.string(),
+        details: z.array(z.string())
+      })
+    ),
+    overallScore: z.number()
+  }),
+  ossFuzz: z.object({
+    lineCount: z.string(),
+    lineCoverCount: z.string(),
+    date: z.string(),
+    configUrl: z.string()
   })
 })
 
+export const ScorecardSchema = z.object({
+  dependencies: z.array(
+    z.object({
+      ecosystem: z.string(),
+      packageName: z.string(),
+      version: z.string().nullish(),
+      depsDevData: DepsDevProjectSchema
+    })
+  )
+})
+
 export type Change = z.infer<typeof ChangeSchema>
 export type Changes = z.infer<typeof ChangesSchema>
 export type ComparisonResponse = z.infer<typeof ComparisonResponseSchema>
@@ -149,3 +160,4 @@ export type ConfigurationOptions = z.infer<typeof ConfigurationOptionsSchema>
 export type Severity = z.infer<typeof SeveritySchema>
 export type Scope = (typeof SCOPES)[number]
 export type DepsDevProject = z.infer<typeof DepsDevProjectSchema>
+export type Scorecard = z.infer<typeof ScorecardSchema>

src/scorecard.ts

@@ -1,23 +1,36 @@
-import {Change, Changes, DepsDevProject, DepsDevProjectSchema} from './schemas'
+import {
+  Change,
+  Changes,
+  DepsDevProject,
+  DepsDevProjectSchema,
+  Scorecard,
+  ScorecardSchema
+} from './schemas'
 import {isSPDXValid, octokitClient} from './utils'
 import {PackageURL} from 'packageurl-js'
 import * as core from '@actions/core'
 
-export async function getScorecardLevels(changes: Change[]): Promise<object> {
-  const data: any = {dependencies: []}
+export async function getScorecardLevels(
+  changes: Change[]
+): Promise<Scorecard> {
+  const data: Scorecard = {} as Scorecard
   for (const change of changes) {
     try {
       const purl = PackageURL.fromString(change.package_url)
       const ecosystem = purl.type
       const packageName = purl.name
       const version = purl.version
+      const depsDevResponse: DepsDevProject = await getDepsDevData(
+        ecosystem,
+        packageName,
+        version
+      )
 
       data.dependencies.push({
-        purl: purl,
-        ecosystem: ecosystem,
-        packageName: packageName,
-        version: version,
-        depsDevData: await getDepsDevData(ecosystem, packageName, version)
+        ecosystem,
+        packageName,
+        version,
+        depsDevData: depsDevResponse
       })
     } catch (error: any) {
       core.debug(`Error parsing package url: ${error.message}`)
@@ -32,7 +45,7 @@ async function getDepsDevData(
   ecosystem: String,
   packageName: String,
   version: any
-): Promise<object> {
+): Promise<DepsDevProject> {
   try {
     core.debug(`Getting deps.dev data for ${packageName} ${version}`)
     const url = `${depsDevAPIRoot}//v3alpha/systems/${ecosystem}/packages/${packageName}/versions/${version}`
@@ -51,10 +64,12 @@ async function getDepsDevData(
   } catch (error: any) {
     core.debug(`Error fetching data: ${error.message}`)
   }
-  return {}
+  return DepsDevProjectSchema.parse({})
 }
 
-async function getDepsDevProjectData(projectKeyId: string): Promise<object> {
+async function getDepsDevProjectData(
+  projectKeyId: string
+): Promise<DepsDevProject> {
   try {
     core.debug(`Getting deps.dev project data for ${projectKeyId}`)
     const url = `${depsDevAPIRoot}/v3alpha/projects/${encodeURIComponent(projectKeyId)}`
@@ -70,5 +85,5 @@ async function getDepsDevProjectData(projectKeyId: string): Promise<object> {
   } catch (error: any) {
     core.debug(`Error fetching project data: ${error.message}`)
   }
-  return {}
+  return DepsDevProjectSchema.parse({})
 }