Merge pull request #783 from actions/elireisman/all-changes-to-scorecard

Include all added dependencies in scorecard entries

dist/index.js

@@ -646,7 +646,9 @@ function run() {
             core.debug(`Filtered Changes: ${JSON.stringify(filteredChanges)}`);
             core.debug(`Config Deny Packages: ${JSON.stringify(config)}`);
             const deniedChanges = yield (0, deny_1.getDeniedChanges)(filteredChanges, config.deny_packages, config.deny_groups);
-            const scorecard = yield (0, scorecard_1.getScorecardLevels)(filteredChanges);
+            // generate informational scorecard entries for all added changes in the PR
+            const scorecardChanges = getScorecardChanges(changes);
+            const scorecard = yield (0, scorecard_1.getScorecardLevels)(scorecardChanges);
             const minSummary = summary.addSummaryToSummary(vulnerableChanges, invalidLicenseChanges, deniedChanges, scorecard, config);
             if (snapshot_warnings) {
                 summary.addSnapshotWarnings(config, snapshot_warnings);
@@ -831,6 +833,15 @@ function printDeniedDependencies(changes, config) {
         }
     }));
 }
+function getScorecardChanges(changes) {
+    const out = [];
+    for (const change of changes) {
+        if (change.change_type === 'added') {
+            out.push(change);
+        }
+    }
+    return out;
+}
 function createScorecardWarnings(scorecards, config) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;

src/main.ts

@@ -125,7 +125,9 @@ async function run(): Promise<void> {
       config.deny_groups
     )
 
-    const scorecard = await getScorecardLevels(filteredChanges)
+    // generate informational scorecard entries for all added changes in the PR
+    const scorecardChanges = getScorecardChanges(changes)
+    const scorecard = await getScorecardLevels(scorecardChanges)
 
     const minSummary = summary.addSummaryToSummary(
       vulnerableChanges,
@@ -369,7 +371,7 @@ function printScannedDependencies(changes: Changes): void {
 }
 
 function printDeniedDependencies(
-  changes: Change[],
+  changes: Changes,
   config: ConfigurationOptions
 ): void {
   core.group('Denied', async () => {
@@ -384,6 +386,17 @@ function printDeniedDependencies(
   })
 }
 
+function getScorecardChanges(changes: Changes): Changes {
+  const out: Changes = []
+  for (const change of changes) {
+    if (change.change_type === 'added') {
+      out.push(change)
+    }
+  }
+
+  return out
+}
+
 async function createScorecardWarnings(
   scorecards: Scorecard,
   config: ConfigurationOptions