class DependabotReport::DependabotReport

Understands how to roll a dependabot report

Public Instance Methods

csv(owner, *repos) click to toggle source
# File lib/dependabot_report.rb, line 16
def csv(owner, *repos)
  CSV.open("dependabot_alerts.csv", "w") do |csv|
    headings = ["Repo", "Vulnerability Name", "Description"]
    csv << headings
    add_each_repo(owner, repos, csv)
  end
end

Private Instance Methods

add_each_alert(alerts, csv, repo) click to toggle source
# File lib/dependabot_report.rb, line 38
def add_each_alert(alerts, csv, repo)
  alerts.each do |alert|
    csv << [repo, alert["securityVulnerability"]["package"]["name"],
            alert["securityVulnerability"]["advisory"]["description"]]
  end
end
add_each_repo(owner, repos, csv) click to toggle source
# File lib/dependabot_report.rb, line 26
def add_each_repo(owner, repos, csv)
  repos.each do |repo|
    api = GithubGraphApi.new(ENV["GITHUB_OAUTH_TOKEN"] || options.oauth_token)
    dependaboot_data = JSON.parse(api.fetch_vulnerabilities(owner: owner, project: repo))
    next unless dependaboot_data["data"]

    alerts = dependaboot_data["data"]["repository"]["vulnerabilityAlerts"]["nodes"]
    puts "Found #{alerts.count} vulnerabilities from #{repo}. Creating csv report in dependabot_alerts.csv"
    add_each_alert(alerts, csv, repo)
  end
end