Skip to content

feat(output): report scan completeness - #936

Merged
sonukapoor merged 8 commits into
OWASP:mainfrom
luojiyin1987:feat/scan-completeness-output
Aug 8, 2026
Merged

feat(output): report scan completeness#936
sonukapoor merged 8 commits into
OWASP:mainfrom
luojiyin1987:feat/scan-completeness-output

Conversation

@luojiyin1987

Copy link
Copy Markdown
Collaborator

Summary

Report scan completeness data in terminal, JSON, and HTML output.

  • Add partial-scan diagnostics to terminal output.
  • Add completeness fields to JSON output.
  • Add completeness banners to single-folder and multi-folder HTML reports.
  • Aggregate multi-folder diagnostics by code.

This PR excludes ratchet and baseline behavior.

Part of #907.

Validation

  • npm run build
  • Targeted output, CLI, and multi-folder tests: 291 passed.
  • Full test run: 1,251 passed. 29 offline tests need the fixture database in this local environment.

@sonukapoor

Copy link
Copy Markdown
Collaborator

Hi @luojiyin1987, heads up - this one picked up a conflict with main after #927 (a small status-line fix) landed in printers.ts, which this PR also reworks heavily. Could you rebase on the latest main and resolve? Once it is clean I will review it properly alongside #937. Appreciate the work on the completeness series.

@luojiyin1987
luojiyin1987 force-pushed the feat/scan-completeness-output branch from 10f7e08 to 5fd97fe Compare August 6, 2026 12:36

@sonukapoor sonukapoor left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Really nice work @luojiyin1987 - this renders the completeness model cleanly across terminal, JSON, and HTML, and the detection-vs-remediation split is exactly right: a remediation-only gap keeps the headline intact and just notes fix guidance is incomplete, while a detection gap flips it to a partial-scan warning so a zero-findings result never reads as clean. Escaping and tests are solid. Two small things before it goes in.

  • src/scan/completeness.ts (the fetch message): small grammar bug that is now user-visible - pluralize(count, "fetch") prints "packument fetchs" for count > 1. Same fix we just landed for "vulnerability" in #927: pass the explicit plural, pluralize(count, "fetch", "fetches"). A quick test with count > 1 would keep it from regressing.
  • src/output/html-reporter.ts (renderCompletenessBanner): you extracted getCompletenessImpact() in this same PR, but the banner here still does the two inline .some() checks - could you route those through getCompletenessImpact(completeness) so there is one source of truth?
  • Non-blocking, for later: the .diag-item severity/impact CSS classes have no matching rules yet, and the JSON carries both status and complete. Leave as-is or tidy in a follow-up.
  • Coordination: I would like to merge this one first (it adds the shared helper), then have #937 rebase onto it.

@luojiyin1987
luojiyin1987 requested a review from sonukapoor August 7, 2026 01:13

@sonukapoor sonukapoor left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The plural fix and DRY reuse of getCompletenessImpact() look good - thanks for addressing both. Verified the fix commit directly against the diff, all checks pass.

@sonukapoor
sonukapoor merged commit d3b3f34 into OWASP:main Aug 8, 2026
6 checks passed
@sonukapoor

Copy link
Copy Markdown
Collaborator

Merged - thank you @luojiyin1987!

@luojiyin1987
luojiyin1987 deleted the feat/scan-completeness-output branch August 8, 2026 14:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants