feat: add code scanning coverage report and alert dismissal scripts #144
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
📋 Lint Results⚡ ./gh-cli scripts🔧 ./scripts scriptsLint results updated at Tue Jan 13 17:11:34 UTC 2026 |
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request introduces a comprehensive code scanning coverage report tool for GitHub organizations. The implementation includes both a Node.js script (in scripts/) and a bash script (in gh-cli/), along with documentation for both.
Key changes:
- Adds a parallelized Node.js script for generating detailed CodeQL coverage reports with sub-report generation capabilities
- Adds a bash alternative using the gh CLI for users without Node.js
- Includes comprehensive documentation with usage examples, options, and output descriptions
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/get-code-scanning-coverage-report/package.json | Defines Node.js package metadata and dependencies (octokit v4) |
| scripts/get-code-scanning-coverage-report/package-lock.json | Lock file for npm dependencies |
| scripts/get-code-scanning-coverage-report/get-code-scanning-coverage-report.js | Main Node.js implementation with parallel API calls and CSV generation |
| scripts/get-code-scanning-coverage-report/README.md | Detailed documentation for the Node.js script with usage examples |
| scripts/README.md | Adds entry for the new script to the scripts directory index |
| gh-cli/get-code-scanning-coverage-report.sh | Bash implementation using gh CLI for users without Node.js |
| gh-cli/README.md | Adds entry for the bash script to the gh-cli directory index |
Files not reviewed (1)
- scripts/get-code-scanning-coverage-report/package-lock.json: Language not supported
scripts/code-scanning-coverage-report/code-scanning-coverage-report.js
Outdated
Show resolved
Hide resolved
scripts/code-scanning-coverage-report/code-scanning-coverage-report.js
Outdated
Show resolved
Hide resolved
scripts/code-scanning-coverage-report/code-scanning-coverage-report.js
Outdated
Show resolved
Hide resolved
…cs in code scanning report also not checking for alerts for each repo to conserve rate limit
scripts/code-scanning-coverage-report/code-scanning-coverage-report.test.js
Outdated
Show resolved
Hide resolved
Co-authored-by: Copilot <[email protected]>
…eport.test.js Co-authored-by: Copilot <[email protected]>
and fix critical alerts
…n code scanning coverage report
…in code scanning coverage report
…nt in code scanning coverage report
…on in code scanning coverage report
joshjohanning
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 11 changed files in this pull request and generated 10 comments.
Comments suppressed due to low confidence (1)
scripts/code-scanning-coverage-report/code-scanning-coverage-report.js:940
- The value assigned to rateLimitOctokit here is unused.
rateLimitOctokit = createTokenOctokit();
scripts/code-scanning-coverage-report/code-scanning-coverage-report.js
Outdated
Show resolved
Hide resolved
scripts/dismiss-code-scanning-alerts/dismiss-code-scanning-alerts.test.js
Show resolved
Hide resolved
scripts/dismiss-code-scanning-alerts/dismiss-code-scanning-alerts.test.js
Outdated
Show resolved
Hide resolved
scripts/code-scanning-coverage-report/code-scanning-coverage-report.js
Outdated
Show resolved
Hide resolved
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces two new scripts to the
scriptsdirectory:code-scanning-coverage-reportanddismiss-code-scanning-alerts. Both tools are designed to help organizations manage and improve their code scanning posture across GitHub repositories. The changes include documentation, package manifests, and updates to the mainREADME.mdto reference these new scripts.You would run the script like this:
export GITHUB_TOKEN=ghp_aaaaa node code-scanning-coverage-report.js my-org --output report.csvRecommended to use GitHub App instead, and use relevant environment variables (GitHub Apps have a higher rate limit)
GITHUB_APP_IDGITHUB_APP_PRIVATE_KEY_PATHGITHUB_APP_INSTALLATION_IDGITHUB_API_URLhttps://api.github.com)Example results:
results-stale.csvresults-missing-languages.csv:results-disabled.csv:results-analysis-issues.csv: