eclipse-csi
Enrich GHSA table output from list-advisories command
NOTE: This functionality seems highly useful, but could very well live outside of Otterdog. If we do want to add it here, I'm happy to add tests and docs. I'm also open to stripping the last commit, which adds the calculated information.
Description
This PR adds the following columns to the GitHub security advisory table (csv) output generated with otterdog list-advisories:
- last_commented_at (queried from GitHub)
- days_since_created (calculated)
- days_since_updated (calculated)
- days_since_last_commented (calculated)
Since the queried information is not available via GitHub's REST or GraphQL APIs, this PR makes use of Otterdog's WebClient.
Please see commit messages for details
Caveat:
- Using the WebClient requires fetching 4x as many secrets from the local password store compared to before. This makes the command significantly slower! E.g. for ~280 GitHub organizations, the command takes ~460 seconds (compared to ~230s before this PR), of which ~200s are spent on fetching passwords (compared to ~60s before).
- The used console printer splits long lines, based on available width. This is impractical for a CVE.
- Using the WebClient requires fetching 4x as many secrets from the local password store compared to before. This makes the command significantly slower! E.g. for ~280 GitHub organizations, the command takes ~460 seconds (compared to ~230s before this PR), of which ~200s are spent on fetching passwords (compared to ~60s before).
There's a work around for GitHub security managers: https://github.com/eclipse-csi/otterdog/issues/392
If you use a TextIO input instead of a Console, the indentingprinter should not split long lines.
That is useful e.g. when printing the output to a file where splitting lines do not make sense.
