I have already published the project ( and also made a version that supports the full data in the meantime), but I wanted to talk about the missing fields inside the JSON files. If you follow the CVE “sym-link” (CS joke), you will notice that it provides the missing data. Therefore, I have linked a Python program (for web scraping) that should fix your JSON files to include the missing fields. If you want to make them ZIPs or retrieve them from elsewhere, keep in mind that this tool will change the 3 files from the repository that are supposed to be at the same level as the tool. The tool also has a small setup tutorial in the form of a README.md. Hope it helps!
P.S. Do keep in mind that while the tool is slow, it needs to be run once. After that, you have the file with every addition.
@jayasanka
This doesn’t mean the other submissions were bad. Everyone had creative approaches and many of them were excellent. Please make sure to include a link to your PR in your GSoC proposal, as this will be considered during evaluation.
The next challenge is to display up-to-date data from GitHub Actions.
Note that we can also update the existing GitHub Actions or create new ones if needed.
Some of you suggested introducing a backend because of potential scaling. I appreciate the forward thinking and proactiveness which are great qualities in a software engineer. However, this dashboard is intentionally kept simple and is not expected to scale beyond this use case, so a backend is not necessary.
I have finished the assigned task and made the pull request. I have also suggested a multi sort implementation so that the user can filter the order in which they would like to see the tickets. The solution also lets one choose where they fetch data from ( local, actions , api/AuthKey) for more robust data parsing and future proofing. @jayasanka
It’s up to you. Make sure your PR is up to date with the changes in the main branch. It also depends whether your solution needs to change your existing files. I have a feeling this could be done by modifying github actions running on other repos.
Afaik, you need a token to download artifacts. Also, trying to download these frontend seems inefficient. I guess it would be practical if we try solving this with github actions. Two possible ways that comes to my head:
Update dependency check github actions to commit the json file to the report repo.
Write a new action on the report repo to fetch latest json files from module repos.
I’d prefer the first approach a bit as it always provides the latest results. Let me know your thoughts.
Alright, we discussed this in today’s O3 leads call (om.rs/cal), and agreed it’s better to go with option one: updating the module GitHub Actions to commit the JSON file to the repo.
The good news is the action is shared, so you only need to update this file:
Alas , I missed today’s meeting ;( ! .
Anyway, @jayasanka I went through your approach and it actually looks better.
Could you take a quick look and verify the flow I came up with (as this approach is new to me and I learned new things while going through it ).
step 1. update owasp-dependency-check.yml with this new step : clones the dashboard repo and copies the JSON file into its /data folder, named after the module (e.g. openmrs-core.json), and commits + pushes it
step 2 : now the dashboard repo always has up-to-date JSON files in /data — one per module — because they get pushed there automatically after each scan.
note :
there should be no branch protection , it should be auto merged
PAT token is required to push the report but there is a edge case as pat expires which can be solved by using github app token (should i use github app token or keep it simple using pat setting the max 1 year expiration and manually update later)
Good catch! I will fix this by cloning the actual module repos (billing, idgen, core) and running dependency-check on those instead of the dashboard repo itself. I will also update the workflow to use secrets.OMRS_BOT_GH_TOKEN for pushing reports back as suggested by @jayasanka. Will push the fix shortly.
).