-
Notifications
You must be signed in to change notification settings - Fork 109
feat(#3474): add code-coverage module for scorecard #3476
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| --- | ||
| # Component with Code Coverage Scorecard only | ||
| apiVersion: backstage.io/v1alpha1 | ||
| kind: Component | ||
| metadata: | ||
| name: code-coverage-scorecard-only | ||
| annotations: | ||
| backstage.io/code-coverage: enabled | ||
| spec: | ||
| type: service | ||
| owner: group:development/guests | ||
| lifecycle: experimental |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| module.exports = require('@backstage/cli/config/eslint-factory')(__dirname); |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| # scorecard-backend-module-code-coverage | ||
|
|
||
| The code-coverage backend module for the scorecard plugin. | ||
|
|
||
| This module integrates with the [Backstage Community code-coverage plugin](https://github.com/backstage/community-plugins/tree/main/workspaces/code-coverage) to provide code coverage metrics in the scorecard. | ||
|
|
||
| ## Metrics | ||
|
|
||
| This module provides the following metrics: | ||
|
|
||
| | Metric ID | Title | Source | | ||
| | --------------------------------- | ------------------------------------- | ----------------------------- | | ||
| | `code-coverage.line_percentage` | Code coverage (Lines) | `aggregate.line.percentage` | | ||
| | `code-coverage.line_available` | Code coverage - Tracked lines of code | `aggregate.line.available` | | ||
| | `code-coverage.line_covered` | Code coverage - Covered lines of code | `aggregate.line.covered` | | ||
| | `code-coverage.line_missed` | Code coverage - Missed lines of code | `aggregate.line.missed` | | ||
| | `code-coverage.branch_percentage` | Code coverage (Branches) | `aggregate.branch.percentage` | | ||
| | `code-coverage.branch_available` | Code coverage - Tracked branches | `aggregate.branch.available` | | ||
| | `code-coverage.branch_covered` | Code coverage - Covered branches | `aggregate.branch.covered` | | ||
| | `code-coverage.branch_missed` | Code coverage - Missed branches | `aggregate.branch.missed` | | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| This module requires the [code-coverage-backend](https://github.com/backstage/community-plugins/tree/main/workspaces/code-coverage/plugins/code-coverage-backend) plugin to be installed and configured in your Backstage instance. | ||
|
|
||
| ## Entity annotation | ||
|
|
||
| Entities must have the `backstage.io/code-coverage` annotation to be tracked by this module: | ||
|
|
||
| ```yaml | ||
| apiVersion: backstage.io/v1alpha1 | ||
| kind: Component | ||
| metadata: | ||
| name: my-service | ||
| annotations: | ||
| backstage.io/code-coverage: enabled | ||
| spec: | ||
| type: service | ||
| owner: my-team | ||
| lifecycle: production | ||
| ``` | ||
|
|
||
| ## Installation | ||
|
|
||
| Add the module to your backend: | ||
|
|
||
| ```ts | ||
| backend.add( | ||
| import( | ||
| '@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-code-coverage' | ||
| ), | ||
| ); | ||
| ``` |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| { | ||
| "name": "@red-hat-developer-hub/backstage-plugin-scorecard-backend-module-code-coverage", | ||
| "version": "0.1.0", | ||
| "license": "Apache-2.0", | ||
| "description": "The code-coverage backend module for the scorecard plugin.", | ||
| "main": "src/index.ts", | ||
| "types": "src/index.ts", | ||
| "publishConfig": { | ||
| "access": "public", | ||
| "main": "dist/index.cjs.js", | ||
| "types": "dist/index.d.ts" | ||
| }, | ||
| "repository": { | ||
| "type": "git", | ||
| "url": "https://github.com/redhat-developer/rhdh-plugins", | ||
| "directory": "workspaces/scorecard/plugins/scorecard-backend-module-code-coverage" | ||
| }, | ||
| "backstage": { | ||
| "role": "backend-plugin-module", | ||
| "pluginId": "scorecard", | ||
| "pluginPackage": "@red-hat-developer-hub/backstage-plugin-scorecard-backend" | ||
| }, | ||
| "scripts": { | ||
| "start": "backstage-cli package start", | ||
| "build": "backstage-cli package build", | ||
| "lint": "backstage-cli package lint", | ||
| "test": "backstage-cli package test", | ||
| "clean": "backstage-cli package clean", | ||
| "prepack": "backstage-cli package prepack", | ||
| "postpack": "backstage-cli package postpack" | ||
| }, | ||
| "dependencies": { | ||
| "@backstage/backend-plugin-api": "^1.8.0", | ||
| "@backstage/catalog-client": "^1.14.0", | ||
| "@backstage/catalog-model": "^1.7.7", | ||
| "@red-hat-developer-hub/backstage-plugin-scorecard-common": "workspace:^", | ||
| "@red-hat-developer-hub/backstage-plugin-scorecard-node": "workspace:^" | ||
| }, | ||
| "devDependencies": { | ||
| "@backstage/backend-test-utils": "^1.11.1", | ||
| "@backstage/cli": "^0.36.0" | ||
| }, | ||
| "files": [ | ||
| "dist" | ||
| ] | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| /* | ||
| * Copyright Red Hat, Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| import { mockServices } from '@backstage/backend-test-utils'; | ||
| import { CodeCoverageClient } from './CodeCoverageClient'; | ||
| import type { CodeCoverageReport } from './types'; | ||
|
|
||
| const mockDiscovery = mockServices.discovery.mock({ | ||
| getBaseUrl: async (pluginId: string) => | ||
| `http://localhost:7007/api/${pluginId}`, | ||
| }); | ||
| const mockLogger = mockServices.logger.mock(); | ||
|
|
||
| const sampleReport: CodeCoverageReport = { | ||
| aggregate: { | ||
| line: { available: 5, covered: 4, missed: 1, percentage: 80 }, | ||
| branch: { available: 0, covered: 0, missed: 0, percentage: 0 }, | ||
| }, | ||
| entity: { kind: 'Component', name: 'entity-name', namespace: 'default' }, | ||
| files: [], | ||
| }; | ||
|
|
||
| describe('CodeCoverageClient', () => { | ||
| let client: CodeCoverageClient; | ||
|
|
||
| beforeEach(() => { | ||
| jest.clearAllMocks(); | ||
| client = new CodeCoverageClient(mockDiscovery, mockLogger); | ||
| }); | ||
|
|
||
| it('should call the correct URL and return the report', async () => { | ||
| jest.spyOn(global, 'fetch').mockResolvedValueOnce({ | ||
| ok: true, | ||
| json: async () => sampleReport, | ||
| } as Response); | ||
|
|
||
| const report = await client.getReport('component:default/entity-name'); | ||
|
|
||
| expect(report).toEqual(sampleReport); | ||
| expect(global.fetch).toHaveBeenCalledWith( | ||
| 'http://localhost:7007/api/code-coverage/report?entity=component%3Adefault%2Fentity-name', | ||
| ); | ||
| }); | ||
|
|
||
| it('should throw on non-ok response', async () => { | ||
| jest.spyOn(global, 'fetch').mockResolvedValueOnce({ | ||
| ok: false, | ||
| status: 404, | ||
| statusText: 'Not Found', | ||
| } as Response); | ||
|
|
||
| await expect(client.getReport('component:default/missing')).rejects.toThrow( | ||
| 'Code coverage API error: 404 Not Found', | ||
| ); | ||
| }); | ||
| }); | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| /* | ||
| * Copyright Red Hat, Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| import type { | ||
| DiscoveryService, | ||
| LoggerService, | ||
| } from '@backstage/backend-plugin-api'; | ||
| import type { CodeCoverageReport } from './types'; | ||
|
|
||
| export class CodeCoverageClient { | ||
| private readonly discovery: DiscoveryService; | ||
| private readonly logger: LoggerService; | ||
|
|
||
| constructor(discovery: DiscoveryService, logger: LoggerService) { | ||
| this.discovery = discovery; | ||
| this.logger = logger.child({ component: 'CodeCoverageClient' }); | ||
| } | ||
|
|
||
| async getReport(entityRef: string): Promise<CodeCoverageReport> { | ||
| const baseUrl = await this.discovery.getBaseUrl('code-coverage'); | ||
| const url = `${baseUrl}/report?entity=${encodeURIComponent(entityRef)}`; | ||
|
|
||
| this.logger.debug(`Fetching code coverage report for entity ${entityRef}`); | ||
|
|
||
| const response = await fetch(url); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [high] Missing backend-to-backend authentication The fetch call to the code-coverage backend plugin does not include a Backstage service-to-service authentication token. In the Backstage new backend system, backend plugins enforce authentication by default. The Jira scorecard module correctly uses coreServices.auth to obtain a getPluginRequestToken and sends it as a Bearer token. This module omits authentication entirely and will fail at runtime in any deployment with default auth settings. Suggested fix: Add coreServices.auth to the module's deps in module.ts. Pass the AuthService into CodeCoverageClient. In getReport(), call auth.getOwnServiceCredentials() then auth.getPluginRequestToken({ onBehalfOf: ownCredentials, targetPluginId: 'code-coverage' }) and include the resulting token as Authorization: Bearer *** in the fetch headers. |
||
| if (!response.ok) { | ||
| throw new Error( | ||
| `Code coverage API error: ${response.status} ${response.statusText} for ${url}`, | ||
| ); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [medium] Missing service-to-service authentication The client uses bare fetch() without Backstage service-to-service authentication tokens. The code-coverage API is an internal Backstage plugin discovered via DiscoveryService. Suggested fix: Inject AuthService (from coreServices.auth) into the client. Before each fetch, call auth.getPluginRequestToken() and pass the token as a Bearer header. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [info] data-exposure Error message includes the full internal URL. Consistent with existing patterns. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [info] unvalidated-response The JSON response is cast to CodeCoverageReport without runtime validation. Consistent with other modules in the workspace. |
||
| } | ||
| return response.json() as Promise<CodeCoverageReport>; | ||
| } | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [info] No response body validation JSON response cast directly to CodeCoverageReport without runtime validation. Consistent with other modules. |
||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| /* | ||
| * Copyright Red Hat, Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| /** | ||
| * Represents a single coverage aggregate section (line or branch). | ||
| */ | ||
| export interface CoverageAggregate { | ||
| available: number; | ||
| covered: number; | ||
| missed: number; | ||
| percentage: number; | ||
| } | ||
|
|
||
| /** | ||
| * The response from the code-coverage-backend report API. | ||
| */ | ||
| export interface CodeCoverageReport { | ||
| aggregate: { | ||
| line: CoverageAggregate; | ||
| branch: CoverageAggregate; | ||
| }; | ||
| entity: { | ||
| kind: string; | ||
| name: string; | ||
| namespace: string; | ||
| }; | ||
| files: Array<{ | ||
| branchHits: Record<string, number>; | ||
| filename: string; | ||
| lineHits: Record<string, number>; | ||
| }>; | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| /* | ||
| * Copyright Red Hat, Inc. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| /** | ||
| * The code-coverage backend module for the scorecard plugin. | ||
| * | ||
| * @packageDocumentation | ||
| */ | ||
|
|
||
| export { scorecardModuleCodeCoverage as default } from './module'; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[low] test-inadequate
The error-case test does not verify the URL is included in the error message due to substring matching.