Skip to content

Re-consider the role of coverage #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sgb-io opened this issue Jan 3, 2021 · 1 comment
Closed

Re-consider the role of coverage #58

sgb-io opened this issue Jan 3, 2021 · 1 comment
Labels
help wanted Extra attention is needed question Further information is requested

Comments

@sgb-io
Copy link
Owner

sgb-io commented Jan 3, 2021

A few thoughts

  • The complexityReport data is the most interesting part. Mixing in "times depended on" seems a useful way to contextualize a "threat", and coverage can help users better understand the risk.
  • Maybe just the complexity numbers plus TDO is enough to make decisions
  • The current coverage mapping is quite limited, requires a specific format, won't work out of the box for almost anyone
  • The cli makes assumptions that the project has coverage and it has been generated against the current code that has just been scanned, this is not a safe assumption
  • The cli currently shouts quite loudly when coverage is missing = annoying

It this feature were to be considered valuable, it should probably

  • Check if the coverage is outdated (e.g. how long ago were these files created?)
  • Exclude coverage without shouting about it, when it's not available or old
  • Treat coverage as a nice bonus that users can plug in to enhance the data, rather than something that should be always there
  • Display the coverage in the CLI output table
  • Ensure it's included in the main example that contains the full tree

We could also run the coverage step for the user but this could be fraught with bad assumptions so probably isn't worth it.

@sgb-io
Copy link
Owner Author

sgb-io commented May 13, 2023

Closing due to #122

@sgb-io sgb-io closed this as completed May 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted Extra attention is needed question Further information is requested
Projects
None yet
Development

No branches or pull requests

1 participant