feat: add "vertical" output format #889
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
G-Rath
force-pushed
the
add-vertical-reporter
branch
3 times, most recently
from
505d532
to
bae0efe
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #889 +/- ##
==========================================
+ Coverage 63.67% 64.10% +0.42%
==========================================
Files 146 148 +2
Lines 11960 12131 +171
==========================================
+ Hits 7616 7776 +160
- Misses 3878 3888 +10
- Partials 466 467 +1 ☔ View full report in Codecov by Sentry. |
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
b32bc50
to
9d20ff7
Compare
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
1e47759
to
181148d
Compare
|
I realised that the tests I've added here actually serve for all the |
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
181148d
to
e2e8479
Compare
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
e2e8479
to
b8ac63e
Compare
another-rex
pushed a commit
that referenced
this pull request
May 24, 2024
This introduces a set of crafted scanner results that each supported `output` format is run through to showcase how they look across all the different results possible from a scanner run - it originally started life as the tests for #889 but I realised they could base used more generally for testing and reviewing all the outputters, so here we are. ~It looks like this has also revealed the SARIF output is unstable in its ordering, which I'll aim to address in a dedicated PR~
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
b8ac63e
to
d5c8f4d
Compare
G-Rath
force-pushed
the
add-vertical-reporter
branch
from
d5c8f4d
to
b266097
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds a new "vertical" output format that is designed for humans and based on the output of
osv-detector, which effectively aims to group the output relating to each entity being scanned in vertical slices:Unfortunately I think it suffers significantly due to the assumptions made by the rest of the codebase for outputting that made sense when the final output was a table i.e. we dump a lot of information as we go about scanning, config files, vulnerability filtering, and so on that really should be grouped but currently cannot because they're all outputted at different stages - I think a way to address that could be using some sort of event-emitter type pattern so that the reporters could be responsible for deciding what they actually do (e.g.
r.Emit("filtered-vulnerability", ...)and then most reporters could choose to just print immediately, and ones like "vertical" could choose to add it to an internal struct), but I think that'll involve a lot more work; for now I'm just going to ignore the pre-results output.Resolves #85