CM-68446: Render unmaintained package detections in SCA output

README.md

@@ -789,7 +789,7 @@ The Cycode CLI application offers several types of scans so that you can choose
 | `--show-secret BOOLEAN` | Show secrets in plain text. See [Show/Hide Secrets](#showhide-secrets) section for more details. |
 | `--soft-fail BOOLEAN` | Run scan without failing, always return a non-error status code. See [Soft Fail](#soft-fail) section for more details. |
 | `--severity-threshold [INFO\|LOW\|MEDIUM\|HIGH\|CRITICAL]` | Show only violations at the specified level or higher. |
-| `--sca-scan` | Specify the SCA scan you wish to execute (`package-vulnerabilities`/`license-compliance`). The default is both.  |
+| `--sca-scan` | Specify the SCA scan you wish to execute (`package-vulnerabilities`/`license-compliance`/`unmaintained-packages`). The default is all. |
 | `--monitor` | When specified, the scan results will be recorded in Cycode. |
 | `--cycode-report` | Display a link to the scan report in the Cycode platform in the console output. |
 | `--no-restore` | When specified, Cycode will not run the restore command. This will scan direct dependencies ONLY! |
@@ -867,6 +867,20 @@ In the previous example, if you wanted to only scan a branch named `dev`, you co
 
 `cycode scan -t sca --sca-scan license-compliance repository ~/home/git/codebase -b dev`
 
+#### Unmaintained Packages Option
+
+> [!NOTE]
+> This option is only available to SCA scans.
+
+To scan only for unmaintained packages (packages whose [OpenSSF Scorecard](https://scorecard.dev) `Maintained` check is low, meaning little or no recent commit and issue activity), add the argument `--sca-scan unmaintained-packages` following the `-t sca` or `--scan-type sca` option.
+
+> [!NOTE]
+> Whether unmaintained packages are reported at all is controlled by your organization's policy. This option narrows what a scan reports; it cannot enable a policy that is turned off for your tenant.
+
+In the previous example, if you wanted to only run an SCA scan on unmaintained packages, you could execute the following:
+
+`cycode scan -t sca --sca-scan unmaintained-packages repository ~/home/git/codebase`
+
 #### Lock Restore Option
 
 > [!NOTE]

cycode/cli/apps/scan/scan_command.py

@@ -93,7 +93,11 @@ def scan_command(
  help='Specify the type of SCA scan you wish to execute.',
  rich_help_panel=_SCA_RICH_HELP_PANEL,
  ),
- ] = (ScaScanTypeOption.PACKAGE_VULNERABILITIES, ScaScanTypeOption.LICENSE_COMPLIANCE),
+ ] = (
+ ScaScanTypeOption.PACKAGE_VULNERABILITIES,
+ ScaScanTypeOption.LICENSE_COMPLIANCE,
+ ScaScanTypeOption.UNMAINTAINED_PACKAGES,
+ ),
  monitor: Annotated[
  bool,
  typer.Option(

cycode/cli/apps/scan/scan_parameters.py

@@ -16,6 +16,7 @@ def _get_default_scan_parameters(ctx: typer.Context) -> dict:
  'report': ctx.obj.get('report'),
  'package_vulnerabilities': ctx.obj.get('package-vulnerabilities'),
  'license_compliance': ctx.obj.get('license-compliance'),
+ 'maintainability': ctx.obj.get('unmaintained-packages', False),
  'command_type': ctx.info_name.replace('-', '_'), # save backward compatibility
  'aggregation_id': str(generate_unique_scan_id()),
  'cli_start_time': _BOOT_WALL,

cycode/cli/cli_types.py

@@ -40,6 +40,7 @@ def __str__(self) -> str:
 class ScaScanTypeOption(StrEnum):
  PACKAGE_VULNERABILITIES = 'package-vulnerabilities'
  LICENSE_COMPLIANCE = 'license-compliance'
+ UNMAINTAINED_PACKAGES = 'unmaintained-packages'
 
 
 class SbomFormatOption(StrEnum):

cycode/cli/consts.py

@@ -314,6 +314,7 @@
 
 LICENSE_COMPLIANCE_POLICY_ID = '8f681450-49e1-4f7e-85b7-0c8fe84b3a35'
 PACKAGE_VULNERABILITY_POLICY_ID = '9369d10a-9ac0-48d3-9921-5de7fe9a37a7'
+UNMAINTAINED_PACKAGE_POLICY_ID = '7b45ee1f-ee08-4353-a00a-2586db27b0f1'
 
 # Shortcut dependency paths by remove all middle dependencies
 # between direct dependency and influence/vulnerable dependency.

cycode/cli/printers/rich_printer.py

@@ -16,6 +16,7 @@
 )
 from cycode.cli.printers.utils.detection_ordering.common_ordering import sort_and_group_detections_from_scan_result
 from cycode.cli.printers.utils.rich_helpers import get_columns_in_1_to_3_ratio, get_markdown_panel, get_panel
+from cycode.cli.printers.utils.sca_ossf import get_maintained_score, get_ossf_report_url, get_ossf_score
 
 if TYPE_CHECKING:
  from cycode.cli.models import CliError, Detection, Document, LocalScanResult
@@ -97,7 +98,13 @@ def __add_sca_scan_related_rows(details_table: Table, detection: 'Detection') ->
  dependency_path = detection_details.get('dependency_paths')
  details_table.add_row('Dependency path', dependency_path or 'N/A')
 
- if not detection.has_alert:
+ if detection.detection_type_id == consts.UNMAINTAINED_PACKAGE_POLICY_ID:
+ maintained_score = get_maintained_score(detection_details)
+ ossf_score = get_ossf_score(detection_details)
+ details_table.add_row('Maintained score', 'N/A' if maintained_score is None else str(maintained_score))
+ details_table.add_row('OSSF Scorecard score', 'N/A' if ossf_score is None else str(ossf_score))
+ details_table.add_row('Scorecard report', get_ossf_report_url(detection_details) or 'N/A')
+ elif not detection.has_alert:
  details_table.add_row('License', detection_details.get('license'))
 
  @staticmethod

cycode/cli/printers/tables/sca_table_printer.py

@@ -2,13 +2,18 @@
 from typing import TYPE_CHECKING
 
 from cycode.cli.cli_types import SeverityOption
-from cycode.cli.consts import LICENSE_COMPLIANCE_POLICY_ID, PACKAGE_VULNERABILITY_POLICY_ID
+from cycode.cli.consts import (
+ LICENSE_COMPLIANCE_POLICY_ID,
+ PACKAGE_VULNERABILITY_POLICY_ID,
+ UNMAINTAINED_PACKAGE_POLICY_ID,
+)
 from cycode.cli.models import Detection
 from cycode.cli.printers.tables.table import Table
 from cycode.cli.printers.tables.table_models import ColumnInfoBuilder
 from cycode.cli.printers.tables.table_printer_base import TablePrinterBase
 from cycode.cli.printers.utils import is_git_diff_based_scan
 from cycode.cli.printers.utils.detection_ordering.sca_ordering import sort_and_group_detections
+from cycode.cli.printers.utils.sca_ossf import get_maintained_score
 from cycode.cli.utils.string_utils import shortcut_dependency_paths
 
 if TYPE_CHECKING:
@@ -23,6 +28,7 @@
 ECOSYSTEM_COLUMN = column_builder.build(name='Ecosystem', highlight=False)
 PACKAGE_COLUMN = column_builder.build(name='Package', highlight=False)
 CVE_COLUMNS = column_builder.build(name='CVE', highlight=False)
+MAINTAINED_SCORE_COLUMN = column_builder.build(name='Maintained Score', highlight=False)
 DEPENDENCY_PATHS_COLUMN = column_builder.build(name='Dependency Paths')
 UPGRADE_COLUMN = column_builder.build(name='Upgrade')
 LICENSE_COLUMN = column_builder.build(name='License', highlight=False)
@@ -51,6 +57,8 @@ def _get_title(policy_id: str) -> str:
  return 'Dependency Vulnerabilities'
  if policy_id == LICENSE_COMPLIANCE_POLICY_ID:
  return 'License Compliance'
+ if policy_id == UNMAINTAINED_PACKAGE_POLICY_ID:
+ return 'Unmaintained Packages'
 
  return 'Unknown'
 
@@ -62,6 +70,8 @@ def _get_table(self, policy_id: str) -> Table:
  table.add_column(UPGRADE_COLUMN)
  elif policy_id == LICENSE_COMPLIANCE_POLICY_ID:
  table.add_column(LICENSE_COLUMN)
+ elif policy_id == UNMAINTAINED_PACKAGE_POLICY_ID:
+ table.add_column(MAINTAINED_SCORE_COLUMN)
 
  if is_git_diff_based_scan(self.command_scan_type):
  table.add_column(REPOSITORY_COLUMN)
@@ -120,6 +130,9 @@ def _enrich_table_with_values(table: Table, detection: Detection) -> None:
  table.add_cell(CVE_COLUMNS, detection_details.get('vulnerability_id'))
  table.add_cell(LICENSE_COLUMN, detection_details.get('license'))
 
+ maintained_score = get_maintained_score(detection_details)
+ table.add_cell(MAINTAINED_SCORE_COLUMN, 'N/A' if maintained_score is None else str(maintained_score))
+
  def _print_summary_issues(self, detections_count: int, title: str) -> None:
  self.console.print(f'[bold]Cycode found {detections_count} violations of type: [cyan]{title}[/]')
 

cycode/cli/printers/text_printer.py

@@ -7,6 +7,7 @@
 from cycode.cli.printers.utils.code_snippet_syntax import get_code_snippet_syntax, get_detection_line
 from cycode.cli.printers.utils.detection_data import get_detection_title
 from cycode.cli.printers.utils.detection_ordering.common_ordering import sort_and_group_detections_from_scan_result
+from cycode.cli.printers.utils.sca_ossf import get_maintained_score, get_ossf_report_url, get_ossf_score
 
 if TYPE_CHECKING:
  from cycode.cli.models import Detection, LocalScanResult
@@ -84,7 +85,17 @@ def __get_intermediate_summary_lines(self, detection: 'Detection') -> list[str]:
  def __get_sca_related_summary_lines(detection: 'Detection') -> list[str]:
  summary_lines = []
 
- if detection.has_alert:
+ if detection.detection_type_id == consts.UNMAINTAINED_PACKAGE_POLICY_ID:
+ maintained_score = get_maintained_score(detection.detection_details)
+ ossf_score = get_ossf_score(detection.detection_details)
+ maintained = 'N/A' if maintained_score is None else maintained_score
+ score = 'N/A' if ossf_score is None else ossf_score
+ report_url = get_ossf_report_url(detection.detection_details) or 'N/A'
+
+ summary_lines.append(f'Maintained score: [cyan]{maintained}[/]\n')
+ summary_lines.append(f'OSSF Scorecard score: [cyan]{score}[/]\n')
+ summary_lines.append(f'Scorecard report: [cyan]{report_url}[/]\n')
+ elif detection.has_alert:
  patched_version = detection.detection_details['alert'].get('first_patched_version')
  patched_version = patched_version or 'Not fixed'
 

cycode/cli/printers/utils/sca_ossf.py

@@ -0,0 +1,23 @@
+from typing import Any, Optional
+
+_MAINTAINED_CHECK_NAME = 'maintained'
+
+
+def _get_ossf_details(detection_details: dict) -> dict:
+ return detection_details.get('ossf') or {}
+
+
+def get_ossf_score(detection_details: dict) -> Optional[Any]:
+ return _get_ossf_details(detection_details).get('score')
+
+
+def get_ossf_report_url(detection_details: dict) -> Optional[str]:
+ return _get_ossf_details(detection_details).get('scorecard_report_url')
+
+
+def get_maintained_score(detection_details: dict) -> Optional[Any]:
+ for check in _get_ossf_details(detection_details).get('checks') or []:
+ if str(check.get('name', '')).lower() == _MAINTAINED_CHECK_NAME:
+ return check.get('score')
+
+ return None

tests/cli/commands/scan/test_scan_parameters.py

@@ -14,6 +14,7 @@ def mock_context() -> MagicMock:
  'report': False,
  'package-vulnerabilities': True,
  'license-compliance': True,
+ 'unmaintained-packages': True,
  }
  ctx.info_name = 'test-command'
  return ctx
@@ -27,6 +28,7 @@ def test_get_default_scan_parameters(mock_context: MagicMock) -> None:
  assert params['report'] is False
  assert params['package_vulnerabilities'] is True
  assert params['license_compliance'] is True
+ assert params['maintainability'] is True
  assert params['command_type'] == 'test_command' # hyphens replaced with underscores
  assert 'aggregation_id' in params
 
@@ -113,3 +115,30 @@ def test_get_scan_parameters_branch_with_various_names(mock_get_remote_url: Magi
  mock_context.obj['branch'] = 'release-v1.0.0'
  params = get_scan_parameters(mock_context, paths)
  assert params['branch'] == 'release-v1.0.0'
+
+
+def test_get_default_scan_parameters_maintainability_uses_unmaintained_packages_context_key(
+ mock_context: MagicMock,
+) -> None:
+ """Test that the maintainability wire parameter is taken from the unmaintained-packages context key."""
+ mock_context.obj['unmaintained-packages'] = False
+
+ params = _get_default_scan_parameters(mock_context)
+
+ assert params['maintainability'] is False
+ assert 'unmaintained_packages' not in params
+
+
+def test_get_default_scan_parameters_maintainability_filters_out_when_not_selected(
+ mock_context: MagicMock,
+) -> None:
+ """Test that narrowing --sca-scan sends an explicit False rather than omitting the parameter.
+
+ The backend treats a missing value as "no opinion" so that CLI versions predating the option still get the
+ policy. A narrowed selection is an opinion, so it has to say False out loud.
+ """
+ mock_context.obj.pop('unmaintained-packages')
+
+ params = _get_default_scan_parameters(mock_context)
+
+ assert params['maintainability'] is False

tests/cli/printers/test_sca_table_printer.py

@@ -0,0 +1,112 @@
+from unittest.mock import MagicMock
+
+import pytest
+from rich.console import Console
+
+from cycode.cli.consts import (
+ LICENSE_COMPLIANCE_POLICY_ID,
+ PACKAGE_VULNERABILITY_POLICY_ID,
+ UNMAINTAINED_PACKAGE_POLICY_ID,
+)
+from cycode.cli.printers.tables.sca_table_printer import (
+ CVE_COLUMNS,
+ LICENSE_COLUMN,
+ MAINTAINED_SCORE_COLUMN,
+ UPGRADE_COLUMN,
+ ScaTablePrinter,
+)
+from cycode.cyclient.models import Detection
+
+
+@pytest.fixture
+def printer() -> ScaTablePrinter:
+ ctx = MagicMock()
+ ctx.obj = {'scan_type': 'sca'}
+ ctx.info_name = 'path'
+ return ScaTablePrinter(ctx, Console(), Console(stderr=True))
+
+
+def _make_detection(policy_id: str, **details: object) -> Detection:
+ return Detection(
+ detection_type_id=policy_id,
+ type='Unmaintained packages',
+ message='Package is unmaintained',
+ detection_details=dict(details),
+ detection_rule_id='rule-id',
+ severity='Medium',
+ )
+
+
+def test_get_title_unmaintained_packages() -> None:
+ assert ScaTablePrinter._get_title(UNMAINTAINED_PACKAGE_POLICY_ID) == 'Unmaintained Packages'
+
+
+def test_get_title_known_policies_are_not_changed() -> None:
+ assert ScaTablePrinter._get_title(PACKAGE_VULNERABILITY_POLICY_ID) == 'Dependency Vulnerabilities'
+ assert ScaTablePrinter._get_title(LICENSE_COMPLIANCE_POLICY_ID) == 'License Compliance'
+
+
+def test_get_title_unknown_policy() -> None:
+ assert ScaTablePrinter._get_title('not-a-known-policy-id') == 'Unknown'
+
+
+def test_get_table_unmaintained_packages_columns(printer: ScaTablePrinter) -> None:
+ columns = printer._get_table(UNMAINTAINED_PACKAGE_POLICY_ID).get_columns_info()
+
+ assert MAINTAINED_SCORE_COLUMN in columns
+ assert CVE_COLUMNS not in columns
+ assert UPGRADE_COLUMN not in columns
+ assert LICENSE_COLUMN not in columns
+
+
+def test_get_table_unmaintained_packages_column_order(printer: ScaTablePrinter) -> None:
+ column_names = [column.name for column in printer._get_table(UNMAINTAINED_PACKAGE_POLICY_ID).get_columns_info()]
+
+ assert column_names == [
+ 'Severity',
+ 'Code Project',
+ 'Ecosystem',
+ 'Package',
+ 'Maintained Score',
+ 'Dependency Paths',
+ 'Direct Dependency',
+ 'Development Dependency',
+ ]
+
+
+def test_get_table_other_policies_do_not_get_the_score_column(printer: ScaTablePrinter) -> None:
+ assert MAINTAINED_SCORE_COLUMN not in printer._get_table(PACKAGE_VULNERABILITY_POLICY_ID).get_columns_info()
+ assert MAINTAINED_SCORE_COLUMN not in printer._get_table(LICENSE_COMPLIANCE_POLICY_ID).get_columns_info()
+
+
+def test_enrich_table_with_values_populates_the_score(printer: ScaTablePrinter) -> None:
+ table = printer._get_table(UNMAINTAINED_PACKAGE_POLICY_ID)
+ detection = _make_detection(
+ UNMAINTAINED_PACKAGE_POLICY_ID,
+ file_path='/repo/package.json',
+ ecosystem='npm',
+ package_name='left-pad',
+ package_version='1.0.0',
+ ossf={
+ 'score': 4.1,
+ 'scorecard_report_url': 'https://scorecard.dev/viewer/?uri=github.com/example/left-pad',
+ 'checks': [{'name': 'Maintained', 'score': 1.5, 'reason': 'no recent activity'}],
+ },
+ )
+
+ ScaTablePrinter._enrich_table_with_values(table, detection)
+
+ row = table.get_rows()[0]
+ score_index = table.get_columns_info().index(MAINTAINED_SCORE_COLUMN)
+ assert row[score_index] == '1.5'
+
+
+def test_enrich_table_with_values_missing_score(printer: ScaTablePrinter) -> None:
+ table = printer._get_table(UNMAINTAINED_PACKAGE_POLICY_ID)
+ detection = _make_detection(UNMAINTAINED_PACKAGE_POLICY_ID, file_path='/repo/package.json', package_name='left-pad')
+
+ ScaTablePrinter._enrich_table_with_values(table, detection)
+
+ row = table.get_rows()[0]
+ score_index = table.get_columns_info().index(MAINTAINED_SCORE_COLUMN)
+ assert row[score_index] == 'N/A'