-
Notifications
You must be signed in to change notification settings - Fork 565
Description
Is your feature request related to a problem? Please describe.
I'm frustrated when I have multiple Pinned-Dependencies warnings, I fix multiple warnings and my score does not change for that check.
After some code analysis I got to the following conclusions:
Main problem:
The pinning results are not proportional to the number of dependency warnings of each type.
E.g.: If I get 1 or 100 containerImage
warnings, the containerImage
will be notPinned
in pinning results, the dockerFromScore
will be 0, cause it's 10 or 0, and this will affect 1/4 of my final score.
Side problems:
- The dependencies of types
goCommand
,chocoCommand
,npmCommand
andpipCommand
scores do not affect the final score. - The dependencies of types
goCommand
,chocoCommand
,npmCommand
andpipCommand
generate warnings on JSON and on the Security Dashboard. The Security Dashboard should not be populated with warnings that do not affect the score. - The dependencies of type
downloadThenRun
affect bothdockerDownloadScore
andscriptScore
in a way that the score is penalized twice for eachdownloadThenRun
warning.
Describe the solution you'd like
I would like the pinning results to be proportional to the number os dependency warnings of each type, and the final score to be composed by all dependency types and not grouped into actionScore
and etc.
Describe alternatives you've considered
None.
Additional context
None.