CM-68446: Read package health from the nested ossf detection detail

Author: AradTraub

cycode/cli/printers/rich_printer.py

@@ -16,6 +16,7 @@
 )
 from cycode.cli.printers.utils.detection_ordering.common_ordering import sort_and_group_detections_from_scan_result
 from cycode.cli.printers.utils.rich_helpers import get_columns_in_1_to_3_ratio, get_markdown_panel, get_panel
+from cycode.cli.printers.utils.sca_ossf import get_ossf_report_url, get_ossf_score
 
 if TYPE_CHECKING:
     from cycode.cli.models import CliError, Detection, Document, LocalScanResult
@@ -98,13 +99,9 @@ def __add_sca_scan_related_rows(details_table: Table, detection: 'Detection') ->
         details_table.add_row('Dependency path', dependency_path or 'N/A')
 
         if detection.detection_type_id == consts.UNMAINTAINED_PACKAGE_POLICY_ID:
-            ossf_scorecard_score = detection_details.get('ossf_scorecard_score')
-            details_table.add_row(
-                'OSSF Scorecard score', 'N/A' if ossf_scorecard_score is None else str(ossf_scorecard_score)
-            )
-            details_table.add_row(
-                'Source code repository', detection_details.get('source_code_repository_url') or 'N/A'
-            )
+            ossf_score = get_ossf_score(detection_details)
+            details_table.add_row('OSSF Scorecard score', 'N/A' if ossf_score is None else str(ossf_score))
+            details_table.add_row('Scorecard report', get_ossf_report_url(detection_details) or 'N/A')
         elif not detection.has_alert:
             details_table.add_row('License', detection_details.get('license'))
 

cycode/cli/printers/tables/sca_table_printer.py

@@ -13,6 +13,7 @@
 from cycode.cli.printers.tables.table_printer_base import TablePrinterBase
 from cycode.cli.printers.utils import is_git_diff_based_scan
 from cycode.cli.printers.utils.detection_ordering.sca_ordering import sort_and_group_detections
+from cycode.cli.printers.utils.sca_ossf import get_ossf_score
 from cycode.cli.utils.string_utils import shortcut_dependency_paths
 
 if TYPE_CHECKING:
@@ -129,8 +130,8 @@ def _enrich_table_with_values(table: Table, detection: Detection) -> None:
         table.add_cell(CVE_COLUMNS, detection_details.get('vulnerability_id'))
         table.add_cell(LICENSE_COLUMN, detection_details.get('license'))
 
-        ossf_scorecard_score = detection_details.get('ossf_scorecard_score')
-        table.add_cell(OSSF_SCORE_COLUMN, 'N/A' if ossf_scorecard_score is None else str(ossf_scorecard_score))
+        ossf_score = get_ossf_score(detection_details)
+        table.add_cell(OSSF_SCORE_COLUMN, 'N/A' if ossf_score is None else str(ossf_score))
 
     def _print_summary_issues(self, detections_count: int, title: str) -> None:
         self.console.print(f'[bold]Cycode found {detections_count} violations of type: [cyan]{title}[/]')

cycode/cli/printers/utils/sca_ossf.py

@@ -0,0 +1,14 @@
+from typing import Any, Optional
+
+
+def _get_ossf_details(detection_details: dict) -> dict:
+    """Package health lives in a nested "ossf" object, absent when no scorecard was resolved."""
+    return detection_details.get('ossf') or {}
+
+
+def get_ossf_score(detection_details: dict) -> Optional[Any]:
+    return _get_ossf_details(detection_details).get('score')
+
+
+def get_ossf_report_url(detection_details: dict) -> Optional[str]:
+    return _get_ossf_details(detection_details).get('scorecard_report_url')

tests/cli/printers/test_sca_table_printer.py

@@ -87,8 +87,7 @@ def test_enrich_table_with_values_populates_the_score(printer: ScaTablePrinter)
         ecosystem='npm',
         package_name='left-pad',
         package_version='1.0.0',
-        ossf_scorecard_score=1.5,
-        source_code_repository_url='https://github.com/example/left-pad',
+        ossf={'score': 1.5, 'scorecard_report_url': 'https://scorecard.dev/viewer/?uri=github.com/example/left-pad'},
     )
 
     ScaTablePrinter._enrich_table_with_values(table, detection)