Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ metadata:
description: A collection of all the scorecards
spec:
targets:
- ./components/code-coverage-scorecard-only.yaml
- ./components/dependabot-scorecard-only.yaml
- ./components/github-scorecard-only.yaml
- ./components/jira-scorecard-only.yaml
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
---
# Component with Code Coverage Scorecard only
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
name: code-coverage-scorecard-only
annotations:
backstage.io/code-coverage: enabled
spec:
type: service
owner: group:development/guests
lifecycle: experimental
1 change: 1 addition & 0 deletions workspaces/scorecard/packages/backend/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@
"@backstage/plugin-search-backend-node": "^1.4.2",
"@backstage/plugin-techdocs-backend": "^2.1.6",
"@red-hat-developer-hub/backstage-plugin-scorecard-backend": "workspace:^",
"@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-code-coverage": "workspace:^",
"@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-dependabot": "workspace:^",
"@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-filecheck": "workspace:^",
"@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-github": "workspace:^",
Expand Down
5 changes: 5 additions & 0 deletions workspaces/scorecard/packages/backend/src/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -92,5 +92,10 @@ backend.add(
'@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-sonarqube'
),
);
backend.add(
import(
'@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-code-coverage'
),
);
backend.add(import('@backstage/plugin-mcp-actions-backend'));
backend.start();
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
module.exports = require('@backstage/cli/config/eslint-factory')(__dirname);
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
# scorecard-backend-module-code-coverage

The code-coverage backend module for the scorecard plugin.

This module integrates with the [Backstage Community code-coverage plugin](https://github.com/backstage/community-plugins/tree/main/workspaces/code-coverage) to provide code coverage metrics in the scorecard.

## Metrics

This module provides the following metrics:

| Metric ID | Title | Source |
| --------------------------------- | ------------------------------------- | ----------------------------- |
| `code-coverage.line_percentage` | Code coverage (Lines) | `aggregate.line.percentage` |
| `code-coverage.line_available` | Code coverage - Tracked lines of code | `aggregate.line.available` |
| `code-coverage.line_covered` | Code coverage - Covered lines of code | `aggregate.line.covered` |
| `code-coverage.line_missed` | Code coverage - Missed lines of code | `aggregate.line.missed` |
| `code-coverage.branch_percentage` | Code coverage (Branches) | `aggregate.branch.percentage` |
| `code-coverage.branch_available` | Code coverage - Tracked branches | `aggregate.branch.available` |
| `code-coverage.branch_covered` | Code coverage - Covered branches | `aggregate.branch.covered` |
| `code-coverage.branch_missed` | Code coverage - Missed branches | `aggregate.branch.missed` |

## Prerequisites

This module requires the [code-coverage-backend](https://github.com/backstage/community-plugins/tree/main/workspaces/code-coverage/plugins/code-coverage-backend) plugin to be installed and configured in your Backstage instance.

## Entity annotation

Entities must have the `backstage.io/code-coverage` annotation to be tracked by this module:

```yaml
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
name: my-service
annotations:
backstage.io/code-coverage: enabled
spec:
type: service
owner: my-team
lifecycle: production
```

## Installation

Add the module to your backend:

```ts
backend.add(
import(
'@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-code-coverage'
),
);
```
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
{
"name": "@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-code-coverage",
"version": "0.1.0",
"license": "Apache-2.0",
"description": "The code-coverage backend module for the scorecard plugin.",
"main": "src/index.ts",
"types": "src/index.ts",
"publishConfig": {
"access": "public",
"main": "dist/index.cjs.js",
"types": "dist/index.d.ts"
},
"repository": {
"type": "git",
"url": "https://github.com/redhat-developer/rhdh-plugins",
"directory": "workspaces/scorecard/plugins/scorecard-backend-module-code-coverage"
},
"backstage": {
"role": "backend-plugin-module",
"pluginId": "scorecard",
"pluginPackage": "@red-hat-developer-hub/backstage-plugin-scorecard-backend"
},
"scripts": {
"start": "backstage-cli package start",
"build": "backstage-cli package build",
"lint": "backstage-cli package lint",
"test": "backstage-cli package test",
"clean": "backstage-cli package clean",
"prepack": "backstage-cli package prepack",
"postpack": "backstage-cli package postpack"
},
"dependencies": {
"@backstage/backend-plugin-api": "^1.8.0",
"@backstage/catalog-client": "^1.14.0",
"@backstage/catalog-model": "^1.7.7",
"@red-hat-developer-hub/backstage-plugin-scorecard-common": "workspace:^",
"@red-hat-developer-hub/backstage-plugin-scorecard-node": "workspace:^"
},
"devDependencies": {
"@backstage/backend-test-utils": "^1.11.1",
"@backstage/cli": "^0.36.0"
},
"files": [
"dist"
]
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
/*
* Copyright Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

import { mockServices } from '@backstage/backend-test-utils';
import { CodeCoverageClient } from './CodeCoverageClient';
import type { CodeCoverageReport } from './types';

const mockDiscovery = mockServices.discovery.mock({
getBaseUrl: async (pluginId: string) =>
`http://localhost:7007/api/${pluginId}`,
});
const mockLogger = mockServices.logger.mock();

const sampleReport: CodeCoverageReport = {
aggregate: {
line: { available: 5, covered: 4, missed: 1, percentage: 80 },
branch: { available: 0, covered: 0, missed: 0, percentage: 0 },
},
entity: { kind: 'Component', name: 'entity-name', namespace: 'default' },
files: [],
};

describe('CodeCoverageClient', () => {
let client: CodeCoverageClient;

beforeEach(() => {
jest.clearAllMocks();
client = new CodeCoverageClient(mockDiscovery, mockLogger);
});

it('should call the correct URL and return the report', async () => {
jest.spyOn(global, 'fetch').mockResolvedValueOnce({
ok: true,
json: async () => sampleReport,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] test-inadequate

The error-case test does not verify the URL is included in the error message due to substring matching.

} as Response);

const report = await client.getReport('component:default/entity-name');

expect(report).toEqual(sampleReport);
expect(global.fetch).toHaveBeenCalledWith(
'http://localhost:7007/api/code-coverage/report?entity=component%3Adefault%2Fentity-name',
);
});

it('should throw on non-ok response', async () => {
jest.spyOn(global, 'fetch').mockResolvedValueOnce({
ok: false,
status: 404,
statusText: 'Not Found',
} as Response);

await expect(client.getReport('component:default/missing')).rejects.toThrow(
'Code coverage API error: 404 Not Found',
);
});
});
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
/*
* Copyright Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

import type {
DiscoveryService,
LoggerService,
} from '@backstage/backend-plugin-api';
import type { CodeCoverageReport } from './types';

export class CodeCoverageClient {
private readonly discovery: DiscoveryService;
private readonly logger: LoggerService;

constructor(discovery: DiscoveryService, logger: LoggerService) {
this.discovery = discovery;
this.logger = logger.child({ component: 'CodeCoverageClient' });
}

async getReport(entityRef: string): Promise<CodeCoverageReport> {
const baseUrl = await this.discovery.getBaseUrl('code-coverage');
const url = `${baseUrl}/report?entity=${encodeURIComponent(entityRef)}`;

this.logger.debug(`Fetching code coverage report for entity ${entityRef}`);

const response = await fetch(url);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] Missing backend-to-backend authentication

The fetch call to the code-coverage backend plugin does not include a Backstage service-to-service authentication token. In the Backstage new backend system, backend plugins enforce authentication by default. The Jira scorecard module correctly uses coreServices.auth to obtain a getPluginRequestToken and sends it as a Bearer token. This module omits authentication entirely and will fail at runtime in any deployment with default auth settings.

Suggested fix: Add coreServices.auth to the module's deps in module.ts. Pass the AuthService into CodeCoverageClient. In getReport(), call auth.getOwnServiceCredentials() then auth.getPluginRequestToken({ onBehalfOf: ownCredentials, targetPluginId: 'code-coverage' }) and include the resulting token as Authorization: Bearer *** in the fetch headers.

if (!response.ok) {
throw new Error(
`Code coverage API error: ${response.status} ${response.statusText} for ${url}`,
);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] Missing service-to-service authentication

The client uses bare fetch() without Backstage service-to-service authentication tokens. The code-coverage API is an internal Backstage plugin discovered via DiscoveryService.

Suggested fix: Inject AuthService (from coreServices.auth) into the client. Before each fetch, call auth.getPluginRequestToken() and pass the token as a Bearer header.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[info] data-exposure

Error message includes the full internal URL. Consistent with existing patterns.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[info] unvalidated-response

The JSON response is cast to CodeCoverageReport without runtime validation. Consistent with other modules in the workspace.

}
return response.json() as Promise<CodeCoverageReport>;
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[info] No response body validation

JSON response cast directly to CodeCoverageReport without runtime validation. Consistent with other modules.

}
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
/*
* Copyright Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

/**
* Represents a single coverage aggregate section (line or branch).
*/
export interface CoverageAggregate {
available: number;
covered: number;
missed: number;
percentage: number;
}

/**
* The response from the code-coverage-backend report API.
*/
export interface CodeCoverageReport {
aggregate: {
line: CoverageAggregate;
branch: CoverageAggregate;
};
entity: {
kind: string;
name: string;
namespace: string;
};
files: Array<{
branchHits: Record<string, number>;
filename: string;
lineHits: Record<string, number>;
}>;
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
/*
* Copyright Red Hat, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

/**
* The code-coverage backend module for the scorecard plugin.
*
* @packageDocumentation
*/

export { scorecardModuleCodeCoverage as default } from './module';
Loading
Loading