Skip to content

fix: only get scorecard levels if user wants to see the OpenSSF scorecard #1060

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahpook merged 2 commits into from
Feb 27, 2026
+5 −2
Merged

fix: only get scorecard levels if user wants to see the OpenSSF scorecard #1060

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7863651
fix: only get scorecard levels if user wants to see the OpenSSF score…
jantiebot Feb 26, 2026
24398f0
chore: revert dist changes
jantiebot Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions src/main.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,8 +186,11 @@ async function run(): Promise<void> {
)

// generate informational scorecard entries for all added changes in the PR
const scorecardChanges = getScorecardChanges(changes)
const scorecard = await getScorecardLevels(scorecardChanges)
let scorecard: Scorecard = {dependencies: []}
if (config.show_openssf_scorecard) {
const scorecardChanges = getScorecardChanges(changes)
scorecard = await getScorecardLevels(scorecardChanges)
}
Comment on lines +189 to +193
Copy link

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding test coverage for this conditional behavior. The change correctly optimizes scorecard API calls by only making them when show_openssf_scorecard is enabled, but there are no tests verifying that getScorecardLevels is not called when the flag is false. Given that this PR's primary goal is performance optimization (avoiding 5+ minute API calls), having test coverage would help ensure this behavior is maintained.

Copilot uses AI. Check for mistakes.
Copy link
Contributor

@ahpook ahpook Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot open a new pull request to apply changes based on this feedback


const minSummary = summary.addSummaryToSummary(
vulnerableChanges,
Expand Down