This will include some summary results on vulnerabilities and fixes found. However, I think it is important to include a point of comparison between the current results and previous ones.
This also brings about two questions:
Should this compare with the HEAD of the PR?
Should this compare with the previous evaluation results?
The summary data of the previous scan will be stored as an HTML comment in the body of the current top review -- functioning as metadata that can be parsed.
Example report below
Minder Vulnerability Report β οΈ
Minder found vulnerable dependencies in this PR. Either push an updated version or accept the proposed changes. Note that accepting the changes will include Minder as a co-author of this PR.
Please describe the enhancement
Currently there is a WIP (https://github.com/stacklok/minder/issues/1862) addition to minder reviews to include a summary comment that will always be edited atop the PR.
This will include some summary results on vulnerabilities and fixes found. However, I think it is important to include a point of comparison between the current results and previous ones.
This also brings about two questions:
The summary data of the previous scan will be stored as an HTML comment in the body of the current top review -- functioning as metadata that can be parsed.
Example report below
Minder Vulnerability Report β οΈ
Minder found vulnerable dependencies in this PR. Either push an updated version or accept the proposed changes. Note that accepting the changes will include Minder as a co-author of this PR.
βοΈ Comparison with
abcdefgh
**Vulnerability comparison here**
Solution Proposal
Some options if we decide that a comparison is a good idea:
Compare using
diff
Current has fewer vulns than target
Current has more vulns than target
Keep using codeblock
Describe alternatives you've considered
No response
Additional context
No response
Acceptance Criteria
No response