Separate out ignored packages in the report

[ericcornelissen]

Currently, at least when using dirty-waters-action@v1.11.43, the report puts ignored packages in the "Other info" section together with e.g. the note that a package isn't hosted on GitHub (and it's implications). I would expect these two things to be separated, in particular I would expect a dedicated section for the ignored findings. I find it to be a bit confusing to have these two in the same table and it makes it a bit hard to tell why its there.

As an additional request, I'd also like to know which rule caused a particular result to be ignored.

Example

Current

The below is an extract of the relevant part of the report, currently.

---

...

Notes

Other info:

• Source code repo is not hosted on GitHub: 4

  This could be due, for example, to the package being hosted on a different platform.

  This does not mean that the source code URL is invalid.

  However, for non-GitHub repositories, not all checks can currently be performed.

index	package_name	github_url	parent
1	concat-map@0.0.1	Could not find repo from package registry	['brace-expansion@1.1.11']
2	file-entry-cache@8.0.0	Could not find repo from package registry	[]
3	micro-spelling-correcter@1.1.1	Could not find repo from package registry	[]
4	pp-test-kit@0.5.1	git+https://gitlab.com/ericcornelissen/pp-test-kit.git	[]

...

---

Suggested

The below is my suggested structure of the relevant part of the report. To clarify, under the "ignored" section I'm expecting the same structure as in the "Fine grained information" section, but instead with the ignored packages only.

---

...

Notes

Other info:

• Source code repo is not hosted on GitHub: 4

  This could be due, for example, to the package being hosted on a different platform.

  This does not mean that the source code URL is invalid.

  However, for non-GitHub repositories, not all checks can currently be performed.

index	package_name	github_url	parent
1	pp-test-kit@0.5.1	git+https://gitlab.com/ericcornelissen/pp-test-kit.git	[]

Ignored:

• Source code links that could not be found(3)

index	package_name	github_url	parent
1	concat-map@0.0.1	Could not find repo from package registry	['brace-expansion@1.1.11']
2	file-entry-cache@8.0.0	Could not find repo from package registry	[]
3	micro-spelling-correcter@1.1.1	Could not find repo from package registry	[]

• List of packages with available source code repos but with inaccessible commit SHAs/tags(0)
• Packages without code signature(0)
• List packages with valid code signature(0)

...

---

[ericcornelissen]

This is similar to #137, from my point of view resolving that would resolve this. That being said, it probably also makes sense to let the user know exactly which packages were ignored. This is especially true when an ignore pattern is used, which is somewhat easy to mess up leading (in this context) to packages being ignored unintentionally.

[randomicecube]

@ericcornelissen what do you think of the following aspect? Maybe the footnotes are overkill because of the table entries already listing the amounts

---

Software Supply Chain Report of ericcornelissen/shescape - 3304b1744c0691dbc71f063708023f5d364a7988

Enabled Checks

The following checks were specifically requested:

• Source Code: source_code
• Source Code Sha: source_code_sha
• Code Signature: code_signature

---

How to read the results 📖

Dirty-waters has analyzed your project dependencies and found different categories for each of them:

• ⚠️⚠️⚠️ : high severity

• ⚠️⚠️: medium severity

• ⚠️: low severity

Total packages in the supply chain: 1071

❗ Packages with no source code URL (⚠️⚠️⚠️): 5

⛔ Packages with repo URL that is 404 (⚠️⚠️⚠️): 1 ¹

🔧 Packages with inaccessible commit SHA/tag (⚠️⚠️): 16 ²

🔒 Packages without code signature (⚠️⚠️): 0

🔓 Packages with invalid code signature (⚠️⚠️): 0

Fine grained information

🐬 For further information about software supply chain smells in your project, take a look at the following tables.

Source code links that could not be found(6)

package_name	github_url	github_exists	parent
@andrewbranch/untar.js@1.0.3	No_repo_info_found		[]
@braidai/lang@1.1.1	No_repo_info_found		[]
micro-spelling-correcter@1.1.1	No_repo_info_found		[]
minipass-pipeline@1.2.4	No_repo_info_found		[]
promise-all-reject-late@1.0.1	No_repo_info_found		[]
flat-cache@4.0.1	https://github.com/jaredwray/flat-cache	False	[]

List of packages with available source code repos but with inaccessible commit SHAs/tags(16)

package_name	sha_info	tag_info	parent
@fast-check/ava@2.0.2	Commit SHA not directly available	Release tag not found in repo	[]
@jridgewell/gen-mapping@0.3.8	Commit SHA present but not found in repo	Release tag not found in repo	[]
@loaderkit/resolve@1.0.4	Commit SHA not directly available	Release tag not found in repo	[]
@pnpm/config.env-replace@1.1.0	Commit SHA not directly available	Release tag not found in repo	[]
@pnpm/network.ca-file@1.0.2	Commit SHA not directly available	Release tag not found in repo	[]
@pnpm/npm-conf@2.3.1	Commit SHA not directly available	Release tag not found in repo	[]
acorn-import-attributes@1.9.5	Commit SHA not directly available	Release tag not found in repo	[]
cacheable-request@10.2.14	Commit SHA not directly available	Release tag not found in repo	[]
cli-progress@3.12.0	Commit SHA not directly available	Release tag not found in repo	[]
keyv@4.5.4	Commit SHA not directly available	Release tag not found in repo	[]
lines-and-columns@1.2.4	Commit SHA present but not found in repo	Release tag not found in repo	[]
lodash.get@4.4.2	Commit SHA not directly available	Release tag not found in repo	[]
lodash.merge@4.6.2	Commit SHA not directly available	Release tag not found in repo	[]
lodash.truncate@4.4.2	Commit SHA not directly available	Release tag not found in repo	[]
slashes@3.0.12	Commit SHA not directly available	Release tag not found in repo	[]
tap-yaml@3.0.0	Commit SHA present but not found in repo	Release tag not found in repo	['tap-parser@17.0.0']

All packages have code signature.

All packages have valid code signature.

Ignored Smells

The following smells were ignored in this project.

Source code links that could not be found(2)

package_name	github_url	github_exists	parent
concat-map@0.0.1	https://github.com/substack/node-concat-map	False	['brace-expansion@1.1.11']
file-entry-cache@8.0.0	https://github.com/jaredwray/file-entry-cache	False	[]

List of packages with available source code repos but with inaccessible commit SHAs/tags(12)

package_name	sha_info	tag_info	parent
@types/debug@4.1.12	Commit SHA not directly available	Release tag not found in repo	[]
@types/estree@1.0.7	Commit SHA not directly available	Release tag not found in repo	['rollup@4.41.0']
@types/http-cache-semantics@4.0.4	Commit SHA not directly available	Release tag not found in repo	[]
@types/istanbul-lib-coverage@2.0.6	Commit SHA not directly available	Release tag not found in repo	[]
@types/json-schema@7.0.15	Commit SHA not directly available	Release tag not found in repo	[]
@types/json5@0.0.29	Commit SHA not directly available	Release tag not found in repo	[]
@types/katex@0.16.7	Commit SHA not directly available	Release tag not found in repo	[]
@types/mdast@4.0.4	Commit SHA not directly available	Release tag not found in repo	[]
@types/ms@0.7.34	Commit SHA not directly available	Release tag not found in repo	[]
@types/normalize-package-data@2.4.4	Commit SHA not directly available	Release tag not found in repo	[]
@types/unist@2.0.11	Commit SHA not directly available	Release tag not found in repo	[]
@types/unist@3.0.3	Commit SHA not directly available	Release tag not found in repo	[]

All packages have code signature.

All packages have valid code signature.

No smells were ignored in this project.

---

Call to Action:

👻What do I do now?

For packages without source code & accessible SHA/release tags:

• Why? Missing or inaccessible source code makes it impossible to audit the package for security vulnerabilities or malicious code.

1. Pull Request to the maintainer of dependency, requesting correct repository metadata and proper versioning/tagging.

For packages without code signature:

• Why? Code signatures help verify the authenticity and integrity of the package, ensuring it hasn't been tampered with.

1. Open an issue in the dependency's repository to request the inclusion of code signature in the CI/CD pipeline.

For packages with invalid code signature:

• Why? Invalid signatures could indicate tampering or compromised build processes.

1. It's recommended to verify the code signature and contact the maintainer to fix the issue.

Notes

Other info:

• Source code repo is not hosted on GitHub: 1

  This could be due, for example, to the package being hosted on a different platform.

  This does not mean that the source code URL is invalid.

  However, for non-GitHub repositories, not all checks can currently be performed.

index	github_url	parent
1	git+https://gitlab.com/ericcornelissen/pp-test-kit.git	[]

---

Report created by dirty-waters.

Report created on 2025-06-01 23:52:35

• Tool version: f8d95b2
• Project Name: ericcornelissen/shescape
• Project Version: 3304b1744c0691dbc71f063708023f5d364a7988
• Package Manager: npm

Footnotes

1. Suppressed 2 warnings for ⛔ Packages with repo URL that is 404 (⚠️⚠️⚠️) ↩

2. Suppressed 12 warnings for 🔧 Packages with inaccessible commit SHA/tag (⚠️⚠️) ↩

[ericcornelissen]

Three pieces of feedback:

1. I would agree that the footnotes are unnecessary, but maybe instead of the footnote you can still specify the number of ignored smells inline? E.g.:

   "⛔ Packages with repo URL that is 404 (⚠️⚠️⚠️): 1 [+2 suppressed]"

2. The wording of "Source code links that could not be found" appearing under "Ignored smells" feels a bit off to me (I kinda get it, but it's not quite right because one was the user's choice and the other was not) I don't have any concrete suggestions for how to change it tho...

3. You seem to be mixing "ignore" and "suppress", I'd suggest to pick one and use it consistently.