Skip to content

!feat: default to project settings for risk domain thresholds#52

Merged
maxrake merged 1 commit into
mainfrom
thresholds
May 26, 2022
Merged

!feat: default to project settings for risk domain thresholds#52
maxrake merged 1 commit into
mainfrom
thresholds

Conversation

@maxrake
Copy link
Copy Markdown
Contributor

@maxrake maxrake commented May 26, 2022

Changes in this PR allow thresholds for the five risk domains to be set individually in several ways. They can be set at the Phylum project level from either the Phylum CLI or the web UI. They can also be set by phylum-ci options (e.g., --vul-threshold, --mal-threshold, etc.). The default is to use the project level setting unless overridden by a value specified by a phylum-ci option. A default secure value (100) will be used when neither of these sources are used to set the value.

Additional changes made:

  • The command line arguments were split into logical groups to make their usage scenarios more obvious and provide better help output
  • A "Requirement Source" column was added to the "failed" Package detail table output in order to better identify whether the risk domain threshold requirement came from the project settings, a command line option, or neither
  • Ensure the "identified score" and "requirement" values are displayed as whole integers between 0 and 100, inclusive
  • The default requests timeout value was increased to 10.0 seconds
  • Refactoring and formatting throughout

BREAKING CHANGE: Individual risk domain threshold values can be set with command line options, which now accept values between 0 and 100, inclusive. Previously, the accepted values were between 0 and 99, inclusive.

Closes #46

Checklist

  • Does this PR have an associated issue (i.e., closes #<issueNum> in description above)?
  • Have you ensured that you have met the expected acceptance criteria?
  • Have you created sufficient tests?
    • still no automated tests, but local testing and testing with a private GitLab repo was performed
  • Have you updated all affected documentation?
    • The documentation was minimally changed b/c the real effect of this PR is to make the risk domain threshold values track those set up at the Phylum project level, unless overridden by corresponding phylum-ci command line arguments (e.g., --vul-threshold)
    • CC: @furi0us333 and @peterjmorgan for confirmation on meeting the original intent...or if more explicit documentation is still desired

Example Output

Each of these examples was taken against a lockfile named requirementst-dev.txt, containing:

requests==2.6.1   # is not a new dep (exists in `main`)
pillow==5.3.0     # is not a new dep (exists in `main`)
pyyaml==5.3.1     # has a known vulnerability
docutils==0.18.1  # has a known license risk

This first output is with a script command of: phylum-ci --lockfile requirements-dev.txt --new-deps-only -lt 65
and a disabled "Vulnerability Risk" threshold in the project settings:


image

This second output is with a script command of: phylum-ci --lockfile requirements-dev.txt --new-deps-only -vt 60
and a disabled "License Risk" threshold in the project settings:


image

This third output is with a script command of: phylum-ci --lockfile requirements-dev.txt --new-deps-only -vt 60, an enabled "License Risk" threshold in the project settings of 75, and an enabled "Vulnerability Risk" threshold in the project settings of 50:


image

BREAKING CHANGE: Individual risk domain threshold values can be set with command line options, which now accept values between 0 and 100, inclusive. Previously, the accepted values were between 0 and 99, inclusive. Closes #46
@maxrake maxrake requested a review from a team as a code owner May 26, 2022 12:03
@maxrake maxrake requested a review from kylewillmon May 26, 2022 12:03
@maxrake maxrake self-assigned this May 26, 2022
@maxrake maxrake merged commit 9f10442 into main May 26, 2022
@maxrake maxrake deleted the thresholds branch May 26, 2022 16:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Default to project settings for risk domain thresholds

2 participants