Further fix unsound and notice reporting (#10) (#11)

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.1] - 2023-04-04
+
+### Fixed
+
+- Corrected reporting on `unsound` and `notice` informationals
+
+## [1.4.0] - 2023-04-04
+
+### Fixed
+
+- Reflect change to enable warning on `unsound` and `notice` informationals
+
 ## [1.3.2] - 2023-03-13
 
 ### Changed

README.md

@@ -1,7 +1,6 @@
 # Rust `audit-check` Action
 
 ![MIT licensed](https://img.shields.io/badge/license-MIT-blue.svg)
-[![Gitter](https://badges.gitter.im/actions-rs/community.svg)](https://gitter.im/actions-rs/community)
 
 > Security vulnerabilities audit
 
@@ -44,6 +43,27 @@ Note that informational advisories are not affecting the check status.
 
 ![Check screenshot](.github/check_screenshot.png)
 
+#### Granular Permissions
+
+These are the typically used permissions:
+
+```yaml
+name: 'rust-audit-check'
+github-token:
+  action-input:
+    input: token
+    is-default: false
+  permissions:
+    issues: write
+    issues-reason: to create issues
+    checks: write
+    checks-reason: to create check
+```
+
+The action does not raise issues when it is not triggered from a "cron" scheduled workflow.
+
+When running the action as scheduled it will crate issues but e.g. in PR / push fails the action.
+
 #### Limitations
 
 Due to [token permissions](https://help.github.com/en/articles/virtual-environments-for-github-actions#token-permissions),

package.json

@@ -1,6 +1,6 @@
 {
     "name": "rust-audit-check",
-    "version": "1.3.2",
+    "version": "1.4.1",
     "private": false,
     "description": "Security audit for security vulnerabilities",
     "main": "lib/main.js",

src/reporter.ts

@@ -15,6 +15,7 @@ interface Stats {
     critical: number;
     notices: number;
     unmaintained: number;
+    unsound: number;
     other: number;
 }
 
@@ -37,6 +38,20 @@ function makeReport(
                 });
                 break;
 
+            case 'unsound':
+                preparedWarnings.push({
+                    advisory: warning.advisory,
+                    package: warning.package,
+                });
+                break;
+
+            case 'notice':
+                preparedWarnings.push({
+                    advisory: warning.advisory,
+                    package: warning.package,
+                });
+                break;
+
             case 'informational':
                 preparedWarnings.push({
                     advisory: warning.advisory,
@@ -75,6 +90,7 @@ function getStats(
     let critical = 0;
     let notices = 0;
     let unmaintained = 0;
+    let unsound = 0;
     let other = 0;
     for (const vulnerability of vulnerabilities) {
         switch (vulnerability.advisory.informational) {
@@ -84,6 +100,9 @@ function getStats(
             case 'unmaintained':
                 unmaintained += 1;
                 break;
+            case 'unsound':
+                unsound += 1;
+                break;
             case null:
                 critical += 1;
                 break;
@@ -99,6 +118,10 @@ function getStats(
                 unmaintained += 1;
                 break;
 
+            case 'unsound':
+                unsound += 1;
+                break;
+
             default:
                 // Both yanked and informational types of kind
                 other += 1;
@@ -110,6 +133,7 @@ function getStats(
         critical: critical,
         notices: notices,
         unmaintained: unmaintained,
+        unsound: unsound,
         other: other,
     };
 }
@@ -118,8 +142,7 @@ function getSummary(stats: Stats): string {
     const blocks: string[] = [];
 
     if (stats.critical > 0) {
-        // TODO: Plural
-        blocks.push(`${stats.critical} advisory(ies)`);
+        blocks.push(`${stats.critical} advisories`);
     }
     if (stats.notices > 0) {
         blocks.push(`${stats.notices} notice${plural(stats.notices)}`);
@@ -127,6 +150,9 @@ function getSummary(stats: Stats): string {
     if (stats.unmaintained > 0) {
         blocks.push(`${stats.unmaintained} unmaintained`);
     }
+    if (stats.unsound > 0) {
+        blocks.push(`${stats.unsound} unsound`);
+    }
     if (stats.other > 0) {
         blocks.push(`${stats.other} other`);
     }
@@ -261,6 +287,8 @@ export async function reportIssues(
     for (const warning of warnings) {
         let advisory: interfaces.Advisory;
         switch (warning.kind) {
+            case 'unsound':
+            case 'notice':
             case 'unmaintained':
             case 'informational':
                 advisory = warning.advisory;