dennisdoomen / packageguard / 33877152327

81%

Build Type

push

github

Committed by web-flow

Commit Message

Add risk-report evidence detail and remove Security/Operational double-scoring (#251) (#252)

* Add richer risk-report evidence and remove Security/Operational double-scoring (#251)

- Add detail-list properties to PackageInfo (stale/abandoned/deprecated/
  unmaintained-critical/vulnerable transitive dependency names, versions,
  OSV IDs and release dates), populated by DependencyHealthCountEnricher
  and TransitiveVulnerabilityCountEnricher and rendered inline in risk
  rationale strings (capped at 8 items, 'and N more' beyond that).
- Reword the 'median vulnerability fix time' and 'verified publisher
  signal' rationale lines to explain what they measure.
- Remove genuine double-scoring of StaleTransitiveDependencyCount,
  AbandonedTransitiveDependencyCount and
  UnmaintainedCriticalTransitiveDependencyCount across the Security and
  Operational dimensions: each transitive-health signal is now scored in
  exactly one dimension (stale/deprecated -> Operational, vulnerability-
  driven abandoned/unmaintained-critical -> Security).
- Replace DependencyHealthCounts with DependencyHealthDetails to carry
  both counts and evidence lists.
- Update README.md risk-metrics section to reflect the dimension change
  and document the new evidence detail lines.
- Add/adjust unit tests covering dimension isolation, evidence rendering
  and truncation; validated against a real solution (fluentassertions/
  fluentassertions).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Move dependency detail lists to the Evidence section, not the rationale

The Security/Operational dimension cards (color cards) should only show
scoring rationale with counts; the specific package/vulnerability detail
lists belong in the separate Evidence section instead.

- Revert rationale strings in SecurityRiskEvaluator and
  PackageAdoptionRiskFactor back to plain counts.
- Append the detail-list suffixes to the corresponding Evidence entries in
  RiskHtmlReportWr... (continued)

Coverage Stats

1975 of 2710 branches covered (72.88%)

Branch coverage included in aggregate %.

118 of 123 new or added lines in 8 files covered. (95.93%)

1 existing line in 1 file now uncovered.

6302 of 7480 relevant lines covered (84.25%)

1707.14 hits per line