Merge Confidence and OpenSSF

[adam-moss]

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us what version of Renovate you run.

latest official docker build

If you're self-hosting Renovate, select which platform you are using.

gitlab.com

Was this something which used to work for you, and then stopped?

I never saw this working

Wanted end result.

Merge confidence ratings combined with the OpenSSF scoring.

What you tried so far.

Earlier today I enabled the security:openssf-scorecard preset (we already had the mergeConfidence:all-badges preset enabled.

From looking at a few merge requests however it appears these may be mutually exclusive?

Is that the case or am I misunderstanding something (again 😬 )

Relevant debug logs

Logs

Copy/paste the relevant log(s) here, between the starting and ending backticks

[adam-moss]

@rarkins apologies for the direct ping, could you offer some advice here? Is it simply a case of defining my own preset that merges the two configs together or is there an alternative?

[adam-moss]

Hmm. I'm struggling to get this to work, and am confused for another reason too 😭

In my config.json I have

{
    ...
    globalExtends: [
        ...
        "mergeConfidence:all-badges",
        "security:openssf-scorecard",
    ],
    ...
}

And have found 1 MR where all the columns are present:

If I add

    prBodyColumns: [
        "Package",
        "Type",
        "Update",
        "Change",
        "Age",
        "Adoption",
        "Passing",
        "Confidence",
        "OpenSSF",
    ],

to my config.json it still generates the MR as if only security:openssf-scorecard were enabled which is what I'm seeing across the vast majority of MRs.

[rarkins]

Preset columns are resolved later than config.js as they are in packageRules

[adam-moss]

Ok, got a bit further with this.

Adding a custom preset:

{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "description": "Merge the output of mergeConfidence:all-badges and security:openssf-scorecard.  See https://github.com/renovatebot/renovate/discussions/25125 for rationale.",
    "packageRules": [
        {
            "matchPackagePatterns": [".*"],
            "prBodyColumns": [
                "Package",
                "Type",
                "Update",
                "Change",
                "Age",
                "Adoption",
                "Passing",
                "Confidence",
                "OpenSSF"
            ]
        }
    ]
}

Gives what I was hoping for in some circumstances. In others however it is updating the existing MR to remove dependency updates, notably pre-commit.

🤔

[adam-moss]

Right after a bit more debugging I'm pretty close:

config.js

    ...
    extends: [
        ...,
        "gitlab>redact/redact/renovate//shared-configs/default-body-columns#fix/merge-confidence-openssf",
    ],
    ...
    prBodyDefinitions: {
        OpenSSF: "",
    },
    ...

default-body-columns.json

{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "description": "Merge the output of mergeConfidence:all-badges and security:openssf-scorecard.  See https://github.com/renovatebot/renovate/discussions/25125 for rationale.",
    "packageRules": [
        {
            "matchPackagePatterns": [".*"],
            "prBodyColumns": [
                "Package",
                "Type",
                "Update",
                "Change",
                "Age",
                "Adoption",
                "Passing",
                "Confidence",
                "OpenSSF"
            ]
        }
    ]
}

Gives me merge requests like:

The "dummy" prBodyDefinition in config.js feels "dirty". Is there a better approach you'd recommend?

Of the two example MRs:

• In the first I wouldn't expect to see an OpenSSF Scorecard value but is there a reason the column itself isn't rendered?
• In the second is there a way to stop the merge confidence attributes for displaying those broken links?

Finally OpenSSF Scorecard supports GitLab too, is it possible to update the preset to add that? Currently it restricts itself to GitHub?

Thanks!

[HonkingGoose]

The "dummy" prBodyDefinition in config.js feels "dirty". Is there a better approach you'd recommend?

I can't find a config option in the docs to append new columns to the default prBody configuration. So looks like the dirty way is the only way, for now at least.

I'll let a maintainer respond to the rest of your questions. 😉

[xendren]

This would be helpful as a feature request. It seems a merging of the configs could work here? I'm just getting into using Renovate, so I am not sure if there is a reason that isn't possible. The extends and presets are extremely nice features, but this seems to be a gap. Is there a reason that merge-confidence wouldn't include openSSF column by default? It seems pertinent to be included in that setting to me. Devs would want to know all of that information to have confidence in merging.

[rarkins]

It should be possible to configure both Merge Confidence columns AND the OSSF column at the same time (beware of the width required though). If for some reason it's not practical to do so, let's have a reproduction repo and we can work out a way to make it possible. There's no need for the Merge Confidence preset itself to include OSSF.

[xendren]

Do you mean the workaround that is mentioned above? Create a new repo to manage custom presets, and add the dummy prBodyDefinition and the extends to the config?

[rarkins]

I mean we should try to make it easier and a workaround unnecessary