Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wip: add scorecard check #566

Closed
wants to merge 8 commits into from
Closed

wip: add scorecard check #566

wants to merge 8 commits into from

Conversation

avelino
Copy link
Member

@avelino avelino commented Jul 3, 2021

fixed: #565

Signed-off-by: Avelino <avelinorun@gmail.com>
@github-actions
Copy link

github-actions bot commented Jul 3, 2021

Integration tests failure for bf74ff558523287576ab6bb2f6f772f2a5f64146

Signed-off-by: Avelino <avelinorun@gmail.com>
@github-actions
Copy link

github-actions bot commented Jul 3, 2021

Integration tests failure for edfa2d18052e712a6320d79dd59d7df992944702

Signed-off-by: Avelino <avelinorun@gmail.com>
Signed-off-by: Avelino <avelinorun@gmail.com>
Signed-off-by: Avelino <avelinorun@gmail.com>
@github-actions
Copy link

github-actions bot commented Jul 3, 2021

Integration tests failure for a8143d7f832dfad63d226fb7878343304a6e0c8f

Signed-off-by: Avelino <avelinorun@gmail.com>
@github-actions
Copy link

github-actions bot commented Jul 3, 2021

Integration tests failure for e596820e37e28057e31febc212c7317dac7ff133

Signed-off-by: Avelino <avelinorun@gmail.com>
@github-actions
Copy link

github-actions bot commented Jul 3, 2021

Integration tests failure for 248d682200c04fc566d71d1211ae067edac3dd5d

Signed-off-by: Avelino <avelinorun@gmail.com>
@pull-request-quantifier-deprecated

This PR has 116 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!


Quantification details

Label      : Medium
Size       : +116 -0
Percentile : 43.2%

Total files changed: 1

Change summary by file extension:
.yml : +116 -0

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

  • Fast and predictable releases to production:
    • Optimal size changes are more likely to be reviewed faster with fewer
      iterations.
    • Similarity in low PR complexity drives similar review times.
  • Review quality is likely higher as complexity is lower:
    • Bugs are more likely to be detected.
    • Code inconsistencies are more likely to be detetcted.
  • Knowledge sharing is improved within the participants:
    • Small portions can be assimilated better.
  • Better engineering practices are exercised:
    • Solving big problems by dividing them in well contained, smaller problems.
    • Exercising separation of concerns within the code changes.

What can I do to optimize my changes

  • Use the PullRequestQuantifier to quantify your PR accurately
    • Create a context profile for your repo using the context generator
    • Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
    • Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
    • Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
  • Change your engineering behaviors
    • For PRs that fall outside of the desired spectrum, review the details and check if:
      • Your PR could be split in smaller, self-contained PRs instead
      • Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

  • One line was added: +1 -0
  • One line was deleted: +0 -1
  • One line was modified: +1 -1 (git diff doesn't know about modified, it will
    interpret that line like one addition plus one deletion)
  • Change percentiles: Change characteristics (addition, deletion, modification)
    of this PR in relation to all other PRs within the repository.


Was this comment helpful? 👍  :ok_hand:  :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

@github-actions
Copy link

github-actions bot commented Jul 4, 2021

Integration tests success for 2defbc79b83f36d3ba1f408c0fce346b788cb3c5

USE_BLOB_CACHE: true
BLOB_URL: ${{secrets.BUCKET_URL}}
run: |
scorecard --repo=$REPO --show-details --metadata=openssf --format json > ./$OUTPUT_PATH/results.json

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am one of the maintainers of scorecard. This will output the results.json and the code would have to validate the results of the json.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you help us with this check so it makes sense to keep the scorecard in the pipeline (github action)

@avelino
Copy link
Member Author

avelino commented Jul 6, 2021

looking at the scorecard-trusted process history it takes an average of ⚠️ 180m, it doesn't make sense to have an action running on every pull request.

I'm going to close this PR and put the yaml content in the issue to help who will do it in the future

this pr (in wip) worked for me to understand how the scorecard works

@avelino avelino closed this Jul 6, 2021
@avelino avelino deleted the avelino/issue-565 branch July 6, 2021 09:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Measuring Security Risks - Scorecard
2 participants