Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing package alternatives when Minder comments on a PR #4945

Open
eleftherias opened this issue Nov 12, 2024 · 2 comments
Open

Missing package alternatives when Minder comments on a PR #4945

eleftherias opened this issue Nov 12, 2024 · 2 comments
Labels
bug Something isn't working P1 Fix Soon: High priority items that should be considered in the next Sprint planning cycle

Comments

@eleftherias
Copy link
Contributor

Describe the issue

When I have a profile that includes the Trusty ruletype
And I create a PR that adds a dependency
Then the Minder comment on the PR does not include package alternatives, even though Trusty does have alternatives for the specific package

Example comment on PR: eleftherias/demo-repo-python#25 (review)
The screenshot below shows the comment does not include alternatives.
Screenshot 2024-11-12 at 11 36 24

Note: I checked the Minder codebase and confirmed that the template still includes alternatives

{{ if .Alternatives }}
<details>
<summary>Alternatives</summary>
| Package | Score | Description |
| ------------------- | ----: | ----------- |
{{ range .Alternatives -}}
| [{{ .PackageName }}]({{ .TrustyURL }}) | {{ .Score }} | {{ .Summary }} |
{{ end }}
</details>

To Reproduce

No response

What version are you using?

No response

@eleftherias eleftherias added bug Something isn't working P1 Fix Soon: High priority items that should be considered in the next Sprint planning cycle labels Nov 12, 2024
@blkt
Copy link
Contributor

blkt commented Nov 20, 2024

Here's the code related to this bug.

@blkt
Copy link
Contributor

blkt commented Nov 20, 2024

Adding an extra *altData.Score != 0 solves the issue, but we might want to (a) remove the score from display, and (b) add back description or remove that as well

diff --git i/internal/engine/eval/trusty/actions.go w/internal/engine/eval/trusty/actions.go
index 48969503a8ff..bfc8bcb9bccc 100644
--- i/internal/engine/eval/trusty/actions.go
+++ w/internal/engine/eval/trusty/actions.go
@@ -324,7 +324,7 @@ func (sph *summaryPrHandler) generateSummary() (string, error) {
            // (2) we don't suggest malicious packages, I
            // suggest getting rid of this check
            // altogether.
-           if altData.Score != nil && *altData.Score <= lowScorePackages[alternative.Dependency.Name].Score {
+           if altData.Score != nil && *altData.Score != 0 && *altData.Score <= lowScorePackages[alternative.Dependency.Name].Score {
                continue
            }

test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working P1 Fix Soon: High priority items that should be considered in the next Sprint planning cycle
Projects
None yet
Development

No branches or pull requests

2 participants