CM-71730: Report the OSSF Maintained check score, not the aggregate

The unmaintained policy decides on the scorecard's Maintained check, so showing
the aggregate as the only number was misleading: a package flagged as
unmaintained could display a healthy-looking 4.1. The Maintained score now leads
and the aggregate stays as context.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: AradTraub

README.md

@@ -872,7 +872,7 @@ In the previous example, if you wanted to only scan a branch named `dev`, you co
 > [!NOTE]
 > This option is only available to SCA scans.
 
-To scan only for unmaintained packages (packages whose [OpenSSF Scorecard](https://scorecard.dev) score is low), add the argument `--sca-scan unmaintained-packages` following the `-t sca` or `--scan-type sca` option.
+To scan only for unmaintained packages (packages whose [OpenSSF Scorecard](https://scorecard.dev) `Maintained` check is low, meaning little or no recent commit and issue activity), add the argument `--sca-scan unmaintained-packages` following the `-t sca` or `--scan-type sca` option.
 
 > [!NOTE]
 > Whether unmaintained packages are reported at all is controlled by your organization's policy. This option narrows what a scan reports; it cannot enable a policy that is turned off for your tenant.

cycode/cli/printers/rich_printer.py

@@ -16,7 +16,7 @@
 )
 from cycode.cli.printers.utils.detection_ordering.common_ordering import sort_and_group_detections_from_scan_result
 from cycode.cli.printers.utils.rich_helpers import get_columns_in_1_to_3_ratio, get_markdown_panel, get_panel
-from cycode.cli.printers.utils.sca_ossf import get_ossf_report_url, get_ossf_score
+from cycode.cli.printers.utils.sca_ossf import get_maintained_score, get_ossf_report_url, get_ossf_score
 
 if TYPE_CHECKING:
     from cycode.cli.models import CliError, Detection, Document, LocalScanResult
@@ -99,7 +99,9 @@ def __add_sca_scan_related_rows(details_table: Table, detection: 'Detection') ->
         details_table.add_row('Dependency path', dependency_path or 'N/A')
 
         if detection.detection_type_id == consts.UNMAINTAINED_PACKAGE_POLICY_ID:
+            maintained_score = get_maintained_score(detection_details)
             ossf_score = get_ossf_score(detection_details)
+            details_table.add_row('Maintained score', 'N/A' if maintained_score is None else str(maintained_score))
             details_table.add_row('OSSF Scorecard score', 'N/A' if ossf_score is None else str(ossf_score))
             details_table.add_row('Scorecard report', get_ossf_report_url(detection_details) or 'N/A')
         elif not detection.has_alert:

cycode/cli/printers/tables/sca_table_printer.py

@@ -13,7 +13,7 @@
 from cycode.cli.printers.tables.table_printer_base import TablePrinterBase
 from cycode.cli.printers.utils import is_git_diff_based_scan
 from cycode.cli.printers.utils.detection_ordering.sca_ordering import sort_and_group_detections
-from cycode.cli.printers.utils.sca_ossf import get_ossf_score
+from cycode.cli.printers.utils.sca_ossf import get_maintained_score
 from cycode.cli.utils.string_utils import shortcut_dependency_paths
 
 if TYPE_CHECKING:
@@ -28,7 +28,7 @@
 ECOSYSTEM_COLUMN = column_builder.build(name='Ecosystem', highlight=False)
 PACKAGE_COLUMN = column_builder.build(name='Package', highlight=False)
 CVE_COLUMNS = column_builder.build(name='CVE', highlight=False)
-OSSF_SCORE_COLUMN = column_builder.build(name='OSSF Score', highlight=False)
+MAINTAINED_SCORE_COLUMN = column_builder.build(name='Maintained Score', highlight=False)
 DEPENDENCY_PATHS_COLUMN = column_builder.build(name='Dependency Paths')
 UPGRADE_COLUMN = column_builder.build(name='Upgrade')
 LICENSE_COLUMN = column_builder.build(name='License', highlight=False)
@@ -71,7 +71,7 @@ def _get_table(self, policy_id: str) -> Table:
         elif policy_id == LICENSE_COMPLIANCE_POLICY_ID:
             table.add_column(LICENSE_COLUMN)
         elif policy_id == UNMAINTAINED_PACKAGE_POLICY_ID:
-            table.add_column(OSSF_SCORE_COLUMN)
+            table.add_column(MAINTAINED_SCORE_COLUMN)
 
         if is_git_diff_based_scan(self.command_scan_type):
             table.add_column(REPOSITORY_COLUMN)
@@ -130,8 +130,8 @@ def _enrich_table_with_values(table: Table, detection: Detection) -> None:
         table.add_cell(CVE_COLUMNS, detection_details.get('vulnerability_id'))
         table.add_cell(LICENSE_COLUMN, detection_details.get('license'))
 
-        ossf_score = get_ossf_score(detection_details)
-        table.add_cell(OSSF_SCORE_COLUMN, 'N/A' if ossf_score is None else str(ossf_score))
+        maintained_score = get_maintained_score(detection_details)
+        table.add_cell(MAINTAINED_SCORE_COLUMN, 'N/A' if maintained_score is None else str(maintained_score))
 
     def _print_summary_issues(self, detections_count: int, title: str) -> None:
         self.console.print(f'[bold]Cycode found {detections_count} violations of type: [cyan]{title}[/]')

cycode/cli/printers/text_printer.py

@@ -7,7 +7,7 @@
 from cycode.cli.printers.utils.code_snippet_syntax import get_code_snippet_syntax, get_detection_line
 from cycode.cli.printers.utils.detection_data import get_detection_title
 from cycode.cli.printers.utils.detection_ordering.common_ordering import sort_and_group_detections_from_scan_result
-from cycode.cli.printers.utils.sca_ossf import get_ossf_report_url, get_ossf_score
+from cycode.cli.printers.utils.sca_ossf import get_maintained_score, get_ossf_report_url, get_ossf_score
 
 if TYPE_CHECKING:
     from cycode.cli.models import Detection, LocalScanResult
@@ -86,10 +86,13 @@ def __get_sca_related_summary_lines(detection: 'Detection') -> list[str]:
         summary_lines = []
 
         if detection.detection_type_id == consts.UNMAINTAINED_PACKAGE_POLICY_ID:
+            maintained_score = get_maintained_score(detection.detection_details)
             ossf_score = get_ossf_score(detection.detection_details)
+            maintained = 'N/A' if maintained_score is None else maintained_score
             score = 'N/A' if ossf_score is None else ossf_score
             report_url = get_ossf_report_url(detection.detection_details) or 'N/A'
 
+            summary_lines.append(f'Maintained score: [cyan]{maintained}[/]\n')
             summary_lines.append(f'OSSF Scorecard score: [cyan]{score}[/]\n')
             summary_lines.append(f'Scorecard report: [cyan]{report_url}[/]\n')
         elif detection.has_alert:

cycode/cli/printers/utils/sca_ossf.py

@@ -1,5 +1,7 @@
 from typing import Any, Optional
 
+_MAINTAINED_CHECK_NAME = 'maintained'
+
 
 def _get_ossf_details(detection_details: dict) -> dict:
     return detection_details.get('ossf') or {}
@@ -11,3 +13,15 @@ def get_ossf_score(detection_details: dict) -> Optional[Any]:
 
 def get_ossf_report_url(detection_details: dict) -> Optional[str]:
     return _get_ossf_details(detection_details).get('scorecard_report_url')
+
+
+def get_maintained_score(detection_details: dict) -> Optional[Any]:
+    """Score of the scorecard's Maintained check, which is what the unmaintained policy decides on.
+
+    The aggregate score blends unrelated checks, so it is not the number the violation was raised for.
+    """
+    for check in _get_ossf_details(detection_details).get('checks') or []:
+        if str(check.get('name', '')).lower() == _MAINTAINED_CHECK_NAME:
+            return check.get('score')
+
+    return None

tests/cli/printers/test_sca_table_printer.py

@@ -11,7 +11,7 @@
 from cycode.cli.printers.tables.sca_table_printer import (
     CVE_COLUMNS,
     LICENSE_COLUMN,
-    OSSF_SCORE_COLUMN,
+    MAINTAINED_SCORE_COLUMN,
     UPGRADE_COLUMN,
     ScaTablePrinter,
 )
@@ -53,7 +53,7 @@ def test_get_title_unknown_policy() -> None:
 def test_get_table_unmaintained_packages_columns(printer: ScaTablePrinter) -> None:
     columns = printer._get_table(UNMAINTAINED_PACKAGE_POLICY_ID).get_columns_info()
 
-    assert OSSF_SCORE_COLUMN in columns
+    assert MAINTAINED_SCORE_COLUMN in columns
     assert CVE_COLUMNS not in columns
     assert UPGRADE_COLUMN not in columns
     assert LICENSE_COLUMN not in columns
@@ -67,16 +67,16 @@ def test_get_table_unmaintained_packages_column_order(printer: ScaTablePrinter)
         'Code Project',
         'Ecosystem',
         'Package',
-        'OSSF Score',
+        'Maintained Score',
         'Dependency Paths',
         'Direct Dependency',
         'Development Dependency',
     ]
 
 
 def test_get_table_other_policies_do_not_get_the_score_column(printer: ScaTablePrinter) -> None:
-    assert OSSF_SCORE_COLUMN not in printer._get_table(PACKAGE_VULNERABILITY_POLICY_ID).get_columns_info()
-    assert OSSF_SCORE_COLUMN not in printer._get_table(LICENSE_COMPLIANCE_POLICY_ID).get_columns_info()
+    assert MAINTAINED_SCORE_COLUMN not in printer._get_table(PACKAGE_VULNERABILITY_POLICY_ID).get_columns_info()
+    assert MAINTAINED_SCORE_COLUMN not in printer._get_table(LICENSE_COMPLIANCE_POLICY_ID).get_columns_info()
 
 
 def test_enrich_table_with_values_populates_the_score(printer: ScaTablePrinter) -> None:
@@ -87,13 +87,17 @@ def test_enrich_table_with_values_populates_the_score(printer: ScaTablePrinter)
         ecosystem='npm',
         package_name='left-pad',
         package_version='1.0.0',
-        ossf={'score': 1.5, 'scorecard_report_url': 'https://scorecard.dev/viewer/?uri=github.com/example/left-pad'},
+        ossf={
+            'score': 4.1,
+            'scorecard_report_url': 'https://scorecard.dev/viewer/?uri=github.com/example/left-pad',
+            'checks': [{'name': 'Maintained', 'score': 1.5, 'reason': 'no recent activity'}],
+        },
     )
 
     ScaTablePrinter._enrich_table_with_values(table, detection)
 
     row = table.get_rows()[0]
-    score_index = table.get_columns_info().index(OSSF_SCORE_COLUMN)
+    score_index = table.get_columns_info().index(MAINTAINED_SCORE_COLUMN)
     assert row[score_index] == '1.5'
 
 
@@ -104,5 +108,5 @@ def test_enrich_table_with_values_missing_score(printer: ScaTablePrinter) -> Non
     ScaTablePrinter._enrich_table_with_values(table, detection)
 
     row = table.get_rows()[0]
-    score_index = table.get_columns_info().index(OSSF_SCORE_COLUMN)
+    score_index = table.get_columns_info().index(MAINTAINED_SCORE_COLUMN)
     assert row[score_index] == 'N/A'

tests/cli/printers/test_text_printer.py

@@ -58,12 +58,18 @@ def _render(printer: TextPrinter, output: io.StringIO, detection: Detection) ->
 def test_unmaintained_package_prints_the_score_and_report(printer: TextPrinter, output: io.StringIO) -> None:
     detection = _make_detection(
         UNMAINTAINED_PACKAGE_POLICY_ID,
-        ossf={'score': 2.1, 'scorecard_report_url': 'https://scorecard.dev/viewer/?uri=github.com/a/b'},
+        ossf={
+            'score': 4.1,
+            'scorecard_report_url': 'https://scorecard.dev/viewer/?uri=github.com/a/b',
+            'checks': [{'name': 'Maintained', 'score': 0, 'reason': '0 commit(s) in the last 90 days'}],
+        },
     )
 
     result = _render(printer, output, detection)
 
-    assert 'OSSF Scorecard score: 2.1' in result
+    # The Maintained check is what the policy fired on; the aggregate stays as context.
+    assert 'Maintained score: 0' in result
+    assert 'OSSF Scorecard score: 4.1' in result
     assert 'Scorecard report: https://scorecard.dev/viewer/?uri=github.com/a/b' in result
     assert 'License' not in result
 
@@ -73,19 +79,36 @@ def test_unmaintained_package_without_ossf_details(printer: TextPrinter, output:
 
     result = _render(printer, output, detection)
 
+    assert 'Maintained score: N/A' in result
     assert 'OSSF Scorecard score: N/A' in result
     assert 'Scorecard report: N/A' in result
 
 
 def test_unmaintained_package_with_zero_score(printer: TextPrinter, output: io.StringIO) -> None:
-    detection = _make_detection(UNMAINTAINED_PACKAGE_POLICY_ID, ossf={'score': 0, 'scorecard_report_url': ''})
+    detection = _make_detection(
+        UNMAINTAINED_PACKAGE_POLICY_ID,
+        ossf={'score': 0, 'scorecard_report_url': '', 'checks': [{'name': 'Maintained', 'score': 0}]},
+    )
 
     result = _render(printer, output, detection)
 
+    assert 'Maintained score: 0' in result
     assert 'OSSF Scorecard score: 0' in result
     assert 'Scorecard report: N/A' in result
 
 
+def test_unmaintained_package_without_maintained_check(printer: TextPrinter, output: io.StringIO) -> None:
+    detection = _make_detection(
+        UNMAINTAINED_PACKAGE_POLICY_ID,
+        ossf={'score': 1.5, 'checks': [{'name': 'License', 'score': 10}]},
+    )
+
+    result = _render(printer, output, detection)
+
+    assert 'Maintained score: N/A' in result
+    assert 'OSSF Scorecard score: 1.5' in result
+
+
 def test_license_compliance_still_prints_the_license(printer: TextPrinter, output: io.StringIO) -> None:
     detection = _make_detection(LICENSE_COMPLIANCE_POLICY_ID, license='GPL-3.0')