Skip to content

fix(package): include namespace in shallow score purl output #1431

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
John-David Dalton (jdalton) wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(package): include namespace in shallow score purl output #1431

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/cli/src/commands/package/output-purls-shallow-score.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ export function formatReportCard(
debug(`miss: artifact ecosystem ${JSON.stringify(artifact)}`)
}
/* c8 ignore stop */
const purl = `pkg:${artifact.ecosystem}/${artifact.name}${artifact.version ? `@${artifact.version}` : ''}`
const purl = `pkg:${artifact.ecosystem}/${artifact.namespace ? `${artifact.namespace}/` : ''}${artifact.name}${artifact.version ? `@${artifact.version}` : ''}`

// Calculate proper padding based on longest label.
const maxLabelLength = Math.max(
Expand Down
50 changes: 46 additions & 4 deletions packages/cli/test/unit/commands/package/output-purls-shallow-score.test.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,54 @@ import npmShallow from '../../../../src/commands/package/fixtures/npm_shallow.js
import nugetShallow from '../../../../src/commands/package/fixtures/nuget_shallow.json' with { type: 'json' }
import rubyShallow from '../../../../src/commands/package/fixtures/ruby_shallow.json' with { type: 'json' }
import {
formatReportCard,
generateMarkdownReport,
generateTextReport,
preProcess,
} from '../../../../src/commands/package/output-purls-shallow-score.mts'

import type { DedupedArtifact } from '../../../../src/commands/package/output-purls-shallow-score.mts'

describe('package score output', async () => {
describe('namespaced packages in shallow report purl', () => {
function makeArtifact(
overrides: Partial<DedupedArtifact>,
): DedupedArtifact {
return {
ecosystem: 'npm',
namespace: '',
name: 'react',
version: '4.11.0',
score: {
supplyChain: 99,
maintenance: 95,
quality: 100,
vulnerability: 100,
license: 70,
},
alerts: new Map(),
...overrides,
}
}

it('should include the npm namespace in the reported purl', () => {
const card = formatReportCard(makeArtifact({ namespace: '@axe-core' }), {
colorize: false,
})
// Regression: the namespace was dropped, so the card reported
// `pkg:npm/react@4.11.0` instead of `pkg:npm/@axe-core/react@4.11.0`.
expect(card).toContain('Package: pkg:npm/@axe-core/react@4.11.0')
expect(card).not.toContain('Package: pkg:npm/react@4.11.0')
})

it('should omit the namespace segment when there is none', () => {
const card = formatReportCard(makeArtifact({ name: 'express' }), {
colorize: false,
})
expect(card).toContain('Package: pkg:npm/express@4.11.0')
})
})

describe('npm', () => {
it('should report shallow as text', () => {
const { missing, rows } = preProcess(npmShallow.data, [])
Expand Down Expand Up @@ -101,7 +143,7 @@ describe('package score output', async () => {
reflect the scores of any dependencies, transitive or otherwise.


Package: pkg:golang/tlsproxy@v0.0.0-20250304082521-29051ed19c60
Package: pkg:golang/github.com/steelpoor/tlsproxy@v0.0.0-20250304082521-29051ed19c60

- Supply Chain Risk:  39
- Maintenance: 100
Expand All @@ -126,7 +168,7 @@ describe('package score output', async () => {



## Package: pkg:golang/tlsproxy@v0.0.0-20250304082521-29051ed19c60
## Package: pkg:golang/github.com/steelpoor/tlsproxy@v0.0.0-20250304082521-29051ed19c60

- Supply Chain Risk: 39
- Maintenance: 100
Expand Down Expand Up @@ -248,7 +290,7 @@ describe('package score output', async () => {
reflect the scores of any dependencies, transitive or otherwise.


Package: pkg:maven/beam-runners-flink-1.15-job-server@2.58.0
Package: pkg:maven/org.apache.beam/beam-runners-flink-1.15-job-server@2.58.0

- Supply Chain Risk:  67
- Maintenance: 100
Expand All @@ -273,7 +315,7 @@ describe('package score output', async () => {



## Package: pkg:maven/beam-runners-flink-1.15-job-server@2.58.0
## Package: pkg:maven/org.apache.beam/beam-runners-flink-1.15-job-server@2.58.0

- Supply Chain Risk: 67
- Maintenance: 100
Expand Down
Loading