v2.7

Updating action's engine to be node16. More in-depth work would be needed to change the project to use node 18 under the hood but this might push the version to 3.0.

v2.6

Bug Fixes

This version addresses the following issues:

• createPDF function hangs in Linux.

v2.5

Bug Fixes

This version addresses the following issues:

• Repos with multiple pages resulting from a GraphQL query for vulnerabilities or dependencies would enter a never-ending loop until the access token expired and a Bad Credentials error was thrown.

v2.4

Bug Fixes

This version addresses the following issues:

• Repos with multiple languages configured in CodeQL throw a sarifRules.push is not iterable exception, since there are instances where the extension.rules are null.

v2.3

Bug Fixes

This version addresses the following issues:

• Applied rules and CWEs always yield 0 as reported in issue 7.

New Functionality

This version also adds the following functionality:

• It is possible to specify a report template using the template parameter.
• Severity has been expanded to include critical, high and low, as presented by GitHub's UI.
• The summary report shows the new severity classifications with their number of incidences.
• An alerts component has been created to be available for reports.
• The report template has been modified to include all open alerts grouped by severity.
• An aggregated_report template has been included to create less verbose reports showing the number of instances a rule was matched.

Development Experience Improvements

Additionally, this version has the following proposed development experience improvements:

• The "Build and Test" action now generates a "results" file for debugging purposes.
• Mocking is introduced to allow tests to work without the need to have access to any repositories.

Mocking is achieved by leveraging a mocking directory inside samples. JSON files representing the mocked responses for the paginate and graphql methods are used by testUtils.js to provide this functionality.

v2.2

Release meant to allow specifying a report template.