-
Notifications
You must be signed in to change notification settings - Fork 566
Description
Is your feature request related to a problem? Please describe.
The scorecard Action only reports the Scorecard results for the repository under analysis. The project will surface scorecard results for the dependencies for new pull requests.
Describe the solution you'd like
-
Add an API design that can fetch direct dependency changes (diffs) from a pull request using the GitHub Dependency Review API, surface Scorecard checks and scores for those dependencies and return the results.
-
Add a new Scorecard sub-command CLI,
scorecard dependency-diff
, which uses the above API and outputs the result dependencies as JSON. -
Add a new Scorecard Action running on a pull request, use the API to visualize the dependency-diff and their Scorecard checking results in the PR comments as markdown.
Additional context
Assignee: @aidenwang9867
Metadata
Metadata
Assignees
Labels
Type
Projects
Status