fix(scan report): handle large alert output

.github/workflows/ci.yml

@@ -5,15 +5,12 @@
 name: 'ci: native package'
 run-name: 'ci: native package'
 
-# PUSH, never pull_request. The fleet takes no outside contributions and
-# lands on main directly, so a pull_request trigger adds no coverage a push
-# trigger does not already give — and it is the fragile half: GitHub has
-# narrowed pull_request defaults for security, and a silently non-firing
-# trigger reads as a green repo with no CI at all.
 on:
   push:
     branches: [main]
     tags: ['*']
+  pull_request:
+    branches: [main, fix/scan-report-large-output]
   workflow_dispatch:
 
 permissions:

src/command/scan/output-scan-report.mts

@@ -38,9 +38,9 @@ export type OutputScanReportConfig = {
 
 export type ReportAlertRow = {
   alertType: string
-  introducedBy: string
   manifest: string
   packageName: string
+  packageVersion: string
   policy: string
   url: string
 }
@@ -57,9 +57,9 @@ export function flattenReportAlerts(report: ScanReport): ReportAlertRow[] {
       return {
         __proto__: null,
         alertType: type,
-        introducedBy: keys[2] || '<unknown>',
         manifest: joinAnd(manifest),
         packageName: keys[1] || '<unknown>',
+        packageVersion: keys[2] || '<unknown>',
         policy,
         url,
       }
@@ -76,19 +76,34 @@ export function formatAlertTable(rows: ReportAlertRow[]): string[] {
     'POLICY',
     'ALERT TYPE',
     'PACKAGE',
-    'INTRODUCED BY',
+    'VERSION',
     'MANIFEST FILE',
   ]
   const cells = rows.map(row => [
     row.policy,
     row.alertType,
     row.packageName,
-    row.introducedBy,
+    row.packageVersion,
     row.manifest,
   ])
-  const widths = headers.map((header, i) =>
-    Math.max(header.length, ...cells.map(cell => (cell[i] ?? '').length)),
-  )
+  const widths = headers.map(header => header.length)
+  for (
+    let rowIndex = 0, { length: rowCount } = cells;
+    rowIndex < rowCount;
+    rowIndex += 1
+  ) {
+    const cell = cells[rowIndex]!
+    for (
+      let cellIndex = 0, { length: cellLength } = cell;
+      cellIndex < cellLength;
+      cellIndex += 1
+    ) {
+      widths[cellIndex] = Math.max(
+        widths[cellIndex] ?? 0,
+        cell[cellIndex]?.length ?? 0,
+      )
+    }
+  }
   const toRow = (values: string[]) =>
     `  ${values
       .map((value, i) => value.padEnd(widths[i] ?? 0))
@@ -116,6 +131,12 @@ export function formatLabelledPairs(pairs: Array<[string, string]>): string[] {
   )
 }
 
+export function isFullScanReport(
+  report: ScanReport | { healthy: boolean },
+): report is ScanReport {
+  return 'alerts' in report
+}
+
 export async function outputGeneratedScanReport(
   scanReport: Extract<ReturnType<typeof generateReport>, { ok: true }>,
   config: Pick<
@@ -159,10 +180,10 @@ export async function outputGeneratedScanReport(
 
   if (short) {
     logger.log(scanReport.data.healthy ? 'OK' : 'ERR')
+  } else if (isFullScanReport(scanReport.data)) {
+    logger.log(toPlainTextReport(scanReport.data, includeLicensePolicy))
   } else {
-    logger.log(
-      toPlainTextReport(scanReport.data as ScanReport, includeLicensePolicy),
-    )
+    logger.log(scanReport.data.healthy ? 'OK' : 'ERR')
   }
 }
 
@@ -286,7 +307,7 @@ export function toMarkdownReport(
     __proto__: null,
     'Alert Type': row.alertType,
     Package: row.packageName,
-    'Introduced by': row.introducedBy,
+    Version: row.packageVersion,
     url: row.url,
     'Manifest file': row.manifest,
     Policy: row.policy,
@@ -334,7 +355,7 @@ ${
         'Policy',
         'Alert Type',
         'Package',
-        'Introduced by',
+        'Version',
         'url',
         'Manifest file',
       ])
@@ -401,8 +422,10 @@ export function toPlainTextReport(
   lines.push(
     `  ${rows.length} ${pluralize('alert', { count: rows.length })} with a policy set to at least "${reportLevel}".`,
     '',
-    ...formatAlertTable(rows),
-    '',
   )
+  for (const line of formatAlertTable(rows)) {
+    lines.push(line)
+  }
+  lines.push('')
   return lines.join('\n')
 }

test/unit/command/scan/output-scan-report-markdown.test.mts

@@ -100,12 +100,12 @@ describe('output-scan-report', () => {
 
         All the alerts from the scan with a policy set to at least "warn".
 
-        | ------ | ---------- | ------- | ------------- | ------------------------------------------- | ----------------- |
-        | Policy | Alert Type | Package | Introduced by | url                                         | Manifest file     |
-        | ------ | ---------- | ------- | ------------- | ------------------------------------------- | ----------------- |
-        | error  | envVars    | tslib   | 1.14.1        | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json |
-        | error  | envVars    | tslib   | 1.14.1        | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json |
-        | ------ | ---------- | ------- | ------------- | ------------------------------------------- | ----------------- |
+        | ------ | ---------- | ------- | ------- | ------------------------------------------- | ----------------- |
+        | Policy | Alert Type | Package | Version | url                                         | Manifest file     |
+        | ------ | ---------- | ------- | ------- | ------------------------------------------- | ----------------- |
+        | error  | envVars    | tslib   | 1.14.1  | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json |
+        | error  | envVars    | tslib   | 1.14.1  | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json |
+        | ------ | ---------- | ------- | ------- | ------------------------------------------- | ----------------- |
         "
       `)
     })