Add formatting around warning for low scorecard levels

src/config.ts

@@ -49,6 +49,7 @@ function readInlineConfig(): ConfigurationOptionsPartial {
   )
   const warn_only = getOptionalBoolean('warn-only')
   const show_openssf_scorecard = getOptionalBoolean('show-openssf-scorecard')
+  const warn_on_openssf_scorecard_level = getOptionalNumber('warn-on-openssf-scorecard-level')
 
   validatePURL(allow_dependencies_licenses)
   validateLicenses('allow-licenses', allow_licenses)
@@ -71,7 +72,8 @@ function readInlineConfig(): ConfigurationOptionsPartial {
     retry_on_snapshot_warnings,
     retry_on_snapshot_warnings_timeout,
     warn_only,
-    show_openssf_scorecard
+    show_openssf_scorecard,
+    warn_on_openssf_scorecard_level
   }
 
   return Object.fromEntries(

src/main.ts

@@ -8,8 +8,7 @@ import {
   Severity,
   Changes,
   ConfigurationOptions,
-  Scorecard,
-  DepsDevProject
+  Scorecard
 } from './schemas'
 import {readConfig} from '../src/config'
 import {

src/schemas.ts

@@ -52,6 +52,7 @@ export const ConfigurationOptionsSchema = z
     retry_on_snapshot_warnings: z.boolean().default(false),
     retry_on_snapshot_warnings_timeout: z.number().default(120),
     show_openssf_scorecard: z.boolean().optional(),
+    warn_on_openssf_scorecard_level: z.number(),
     comment_summary_in_pr: z
       .union([
         z.preprocess(
@@ -134,7 +135,7 @@ export const DepsDevProjectSchema = z
               shortDescription: z.string(),
               url: z.string()
             }),
-            score: z.string(),
+            score: z.number(),
             reason: z.string(),
             details: z.array(z.string())
           })

src/scorecard.ts

@@ -1,10 +1,8 @@
 import {
   Change,
-  Changes,
   DepsDevProject,
   DepsDevProjectSchema,
-  Scorecard,
-  ScorecardSchema
+  Scorecard
 } from './schemas'
 import {isSPDXValid, octokitClient} from './utils'
 import {PackageURL} from 'packageurl-js'

src/summary.ts

@@ -260,19 +260,26 @@ export function addScorecardToSummary(
   )
   for (const dependency of scorecard.dependencies) {
     core.summary.addRaw(
-      `<tr><td>${dependency.ecosystem}/${dependency.packageName}</td><td>${dependency.version}</td><td>${dependency.depsDevData?.scorecard.overallScore}</td>`,
+      `<tr><td>${dependency.ecosystem}/${dependency.packageName}</td><td>${dependency.version}</td>
+      <td>${dependency.depsDevData?.scorecard.overallScore == undefined ? 'Unknown' : dependency.depsDevData?.scorecard.overallScore}</td>`,
       false
     )
-    let detailsTable =
-      '<table><tr><th>Check</th><th>Score</th><th>Reason</th></tr>'
-    for (const check of dependency.depsDevData?.scorecard.checks || []) {
-      detailsTable += `<tr><td>${check.name}</td><td>${check.score}</td><td>${check.reason}</td></tr>`
+    if (dependency.depsDevData?.scorecard.checks !== undefined) {
+      let detailsTable =
+        '<table><tr><th>Check</th><th>Score</th><th>Reason</th></tr>'
+      for (const check of dependency.depsDevData?.scorecard.checks || []) {
+        let icon = (check.score < config.warn_on_openssf_scorecard_level) ? ":warning:" : ":green_circle:"
+
+        detailsTable += `<tr><td>${check.name}</td><td>${check.score}</td><td>${icon} ${check.reason}</td></tr>`
+      }
+      detailsTable += `</table>`
+      core.summary.addRaw(
+        `<td><details><summary>Details</summary>${detailsTable}</details></td></tr>`,
+        true
+      )
+    } else {
+      core.summary.addRaw('<td>Unknown</td></tr>', true)
     }
-    detailsTable += `</table>`
-    core.summary.addRaw(
-      `<td><details><summary>Details</summary>${detailsTable}</details></td></tr>`,
-      true
-    )
   }
   core.summary.addRaw(`</table>`)
 }