Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ metadata:
description: A collection of all the scorecards
spec:
targets:
- ./components/code-coverage-scorecard-only.yaml
- ./components/dependabot-scorecard-only.yaml
- ./components/github-scorecard-only.yaml
- ./components/jira-scorecard-only.yaml
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
---
# Component with Code Coverage Scorecard only
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
name: code-coverage-scorecard-only
annotations:
backstage.io/code-coverage: enabled
spec:
type: service
owner: group:development/guests
lifecycle: experimental
1 change: 1 addition & 0 deletions workspaces/scorecard/packages/backend/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@
"@backstage/plugin-search-backend-node": "^1.4.2",
"@backstage/plugin-techdocs-backend": "^2.1.6",
"@red-hat-developer-hub/backstage-plugin-scorecard-backend": "workspace:^",
"@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-code-coverage": "workspace:^",
"@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot": "workspace:^",
"@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-filecheck": "workspace:^",
"@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-github": "workspace:^",
Expand Down
5 changes: 5 additions & 0 deletions workspaces/scorecard/packages/backend/src/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -92,4 +92,9 @@ backend.add(
'@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-sonarqube'
),
);
backend.add(
import(
'@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-code-coverage'
),
);
backend.start();
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
module.exports = require('@backstage/cli/config/eslint-factory')(__dirname);
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
# scorecard-backend-module-code-coverage

The code-coverage backend module for the scorecard plugin.

This module integrates with the [Backstage Community code-coverage plugin](https://github.com/backstage/community-plugins/tree/main/workspaces/code-coverage) to provide code coverage metrics in the scorecard.

## Metrics

This module provides the following metrics:

| Metric ID | Title | Source |
| --------------------------------- | ------------------------------------- | ----------------------------- |
| `code-coverage.line_percentage` | Code coverage (Lines) | `aggregate.line.percentage` |
| `code-coverage.line_available` | Code coverage - Tracked lines of code | `aggregate.line.available` |
| `code-coverage.line_covered` | Code coverage - Covered lines of code | `aggregate.line.covered` |
| `code-coverage.line_missed` | Code coverage - Missed lines of code | `aggregate.line.missed` |
| `code-coverage.branch_percentage` | Code coverage (Branches) | `aggregate.branch.percentage` |
| `code-coverage.branch_available` | Code coverage - Tracked branches | `aggregate.branch.available` |
| `code-coverage.branch_covered` | Code coverage - Covered branches | `aggregate.branch.covered` |
| `code-coverage.branch_missed` | Code coverage - Missed branches | `aggregate.branch.missed` |

## Prerequisites

This module requires the [code-coverage-backend](https://github.com/backstage/community-plugins/tree/main/workspaces/code-coverage/plugins/code-coverage-backend) plugin to be installed and configured in your Backstage instance.

## Entity annotation

Entities must have the `backstage.io/code-coverage` annotation to be tracked by this module:

```yaml
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
name: my-service
annotations:
backstage.io/code-coverage: enabled
spec:
type: service
owner: my-team
lifecycle: production
```

## Installation

Add the module to your backend:

```ts
backend.add(
import(
'@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-code-coverage'
),
);
```
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
{
"name": "@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-code-coverage",
"version": "0.1.0",
"license": "Apache-2.0",
"description": "The code-coverage backend module for the scorecard plugin.",
"main": "src/index.ts",
"types": "src/index.ts",
"publishConfig": {
"access": "public",
"main": "dist/index.cjs.js",
"types": "dist/index.d.ts"
},
"repository": {
"type": "git",
"url": "https://github.com/redhat-developer/rhdh-plugins",
"directory": "workspaces/scorecard/plugins/scorecard-backend-module-code-coverage"
},
"backstage": {
"role": "backend-plugin-module",
"pluginId": "scorecard",
"pluginPackage": "@red-hat-developer-hub/backstage-plugin-scorecard-backend"
},
"scripts": {
"start": "backstage-cli package start",
"build": "backstage-cli package build",
"lint": "backstage-cli package lint",
"test": "backstage-cli package test",
"clean": "backstage-cli package clean",
"prepack": "backstage-cli package prepack",
"postpack": "backstage-cli package postpack"
},
"dependencies": {
"@backstage/backend-plugin-api": "^1.8.0",
"@backstage/catalog-client": "^1.14.0",
"@backstage/catalog-model": "^1.7.7",
"@red-hat-developer-hub/backstage-plugin-scorecard-common": "workspace:^",
"@red-hat-developer-hub/backstage-plugin-scorecard-node": "workspace:^"
},
"devDependencies": {
"@backstage/backend-test-utils": "^1.11.1",
"@backstage/cli": "^0.36.0"
},
"files": [
"dist"
]
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
/*
* Copyright Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

import { mockServices } from '@backstage/backend-test-utils';
import { CodeCoverageClient } from './CodeCoverageClient';
import type { CodeCoverageReport } from './types';

const mockDiscovery = mockServices.discovery.mock({
getBaseUrl: async (pluginId: string) =>
`http://localhost:7007/api/${pluginId}`,
});
const mockLogger = mockServices.logger.mock();

const sampleReport: CodeCoverageReport = {
aggregate: {
line: { available: 5, covered: 4, missed: 1, percentage: 80 },
branch: { available: 0, covered: 0, missed: 0, percentage: 0 },
},
entity: { kind: 'Component', name: 'entity-name', namespace: 'default' },
files: [],
};

describe('CodeCoverageClient', () => {
let client: CodeCoverageClient;

beforeEach(() => {
jest.clearAllMocks();
client = new CodeCoverageClient(mockDiscovery, mockLogger);
});

it('should call the correct URL and return the report', async () => {
jest.spyOn(global, 'fetch').mockResolvedValueOnce({

Check warning on line 45 in workspaces/scorecard/plugins/scorecard-backend-module-code-coverage/src/clients/CodeCoverageClient.test.ts

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Prefer `globalThis` over `global`.

See more on https://sonarcloud.io/project/issues?id=redhat-developer_rhdh-plugins&issues=AZ7gEbPi1hOobTXsKgyt&open=AZ7gEbPi1hOobTXsKgyt&pullRequest=3476
ok: true,
json: async () => sampleReport,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] test-inadequate

The error-case test does not verify the URL is included in the error message due to substring matching.

} as Response);

Check warning on line 48 in workspaces/scorecard/plugins/scorecard-backend-module-code-coverage/src/clients/CodeCoverageClient.test.ts

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This assertion is unnecessary since the receiver accepts the original type of the expression.

See more on https://sonarcloud.io/project/issues?id=redhat-developer_rhdh-plugins&issues=AZ7gEbPi1hOobTXsKgyu&open=AZ7gEbPi1hOobTXsKgyu&pullRequest=3476

const report = await client.getReport('component:default/entity-name');

expect(report).toEqual(sampleReport);
expect(global.fetch).toHaveBeenCalledWith(

Check warning on line 53 in workspaces/scorecard/plugins/scorecard-backend-module-code-coverage/src/clients/CodeCoverageClient.test.ts

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Prefer `globalThis` over `global`.

See more on https://sonarcloud.io/project/issues?id=redhat-developer_rhdh-plugins&issues=AZ7gEbPi1hOobTXsKgyv&open=AZ7gEbPi1hOobTXsKgyv&pullRequest=3476
'http://localhost:7007/api/code-coverage/report?entity=component%3Adefault%2Fentity-name',
);
});

it('should throw on non-ok response', async () => {
jest.spyOn(global, 'fetch').mockResolvedValueOnce({

Check warning on line 59 in workspaces/scorecard/plugins/scorecard-backend-module-code-coverage/src/clients/CodeCoverageClient.test.ts

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Prefer `globalThis` over `global`.

See more on https://sonarcloud.io/project/issues?id=redhat-developer_rhdh-plugins&issues=AZ7gEbPi1hOobTXsKgyw&open=AZ7gEbPi1hOobTXsKgyw&pullRequest=3476
ok: false,
status: 404,
statusText: 'Not Found',
} as Response);

Check warning on line 63 in workspaces/scorecard/plugins/scorecard-backend-module-code-coverage/src/clients/CodeCoverageClient.test.ts

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

This assertion is unnecessary since the receiver accepts the original type of the expression.

See more on https://sonarcloud.io/project/issues?id=redhat-developer_rhdh-plugins&issues=AZ7gEbPi1hOobTXsKgyx&open=AZ7gEbPi1hOobTXsKgyx&pullRequest=3476

await expect(client.getReport('component:default/missing')).rejects.toThrow(
'Code coverage API error: 404 Not Found',
);
});
});
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
/*
* Copyright Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

import type {
DiscoveryService,
LoggerService,
} from '@backstage/backend-plugin-api';
import type { CodeCoverageReport } from './types';

export class CodeCoverageClient {
private readonly discovery: DiscoveryService;
private readonly logger: LoggerService;

constructor(discovery: DiscoveryService, logger: LoggerService) {
this.discovery = discovery;
this.logger = logger.child({ component: 'CodeCoverageClient' });
}

async getReport(entityRef: string): Promise<CodeCoverageReport> {
const baseUrl = await this.discovery.getBaseUrl('code-coverage');
const url = `${baseUrl}/report?entity=${encodeURIComponent(entityRef)}`;

this.logger.debug(`Fetching code coverage report for entity ${entityRef}`);

const response = await fetch(url);
if (!response.ok) {
throw new Error(
`Code coverage API error: ${response.status} ${response.statusText} for ${url}`,
);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] Missing service-to-service authentication

The client uses bare fetch() without Backstage service-to-service authentication tokens. The code-coverage API is an internal Backstage plugin discovered via DiscoveryService.

Suggested fix: Inject AuthService (from coreServices.auth) into the client. Before each fetch, call auth.getPluginRequestToken() and pass the token as a Bearer header.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[info] data-exposure

Error message includes the full internal URL. Consistent with existing patterns.

}
return response.json() as Promise<CodeCoverageReport>;
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[info] No response body validation

JSON response cast directly to CodeCoverageReport without runtime validation. Consistent with other modules.

}
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
/*
* Copyright Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

/**
* Represents a single coverage aggregate section (line or branch).
*/
export interface CoverageAggregate {
available: number;
covered: number;
missed: number;
percentage: number;
}

/**
* The response from the code-coverage-backend report API.
*/
export interface CodeCoverageReport {
aggregate: {
line: CoverageAggregate;
branch: CoverageAggregate;
};
entity: {
kind: string;
name: string;
namespace: string;
};
files: Array<{
branchHits: Record<string, number>;
filename: string;
lineHits: Record<string, number>;
}>;
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
/*
* Copyright Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

/**
* The code-coverage backend module for the scorecard plugin.
*
* @packageDocumentation
*/

export { scorecardModuleCodeCoverage as default } from './module';
Loading
Loading