From 7c0cb35ddc01bacb6b3e24b8f531e491afd7d166 Mon Sep 17 00:00:00 2001 From: stacknil Date: Sat, 2 May 2026 13:16:09 +0800 Subject: [PATCH] Reflow summary-json CI cookbook markdown --- .../docs/summary-json-ci-cookbook.md | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/tools/sbom-diff-and-risk/docs/summary-json-ci-cookbook.md b/tools/sbom-diff-and-risk/docs/summary-json-ci-cookbook.md index c143b21..8b4c4fd 100644 --- a/tools/sbom-diff-and-risk/docs/summary-json-ci-cookbook.md +++ b/tools/sbom-diff-and-risk/docs/summary-json-ci-cookbook.md @@ -1,8 +1,12 @@ # Summary JSON CI cookbook -This page shows how to consume `--summary-json PATH` in CI without changing the `sbom-diff-risk` analysis model. +This page shows how to consume `--summary-json PATH` in CI without changing +the `sbom-diff-risk` analysis model. -`--summary-json` writes a compact machine-readable JSON object. It is the same object as `report.json["summary"]`, and is useful for CI dashboards, job summaries, and small local gates where a repository wants to set its own thresholds. +`--summary-json` writes a compact machine-readable JSON object. It is the same +object as `report.json["summary"]`, and is useful for CI dashboards, job +summaries, and small local gates where a repository wants to set its own +thresholds. ## Minimal command @@ -14,11 +18,13 @@ sbom-diff-risk compare \ --summary-json outputs/summary.json ``` -The full report remains available at `outputs/report.json`. The compact summary-only object is written to `outputs/summary.json`. +The full report remains available at `outputs/report.json`. The compact +summary-only object is written to `outputs/summary.json`. ## Python consumer -This example reads the summary and applies an explicit local threshold. The threshold is chosen by the caller; it is not a built-in package safety verdict. +This example reads the summary and applies an explicit local threshold. The +threshold is chosen by the caller; it is not a built-in package safety verdict. ```python import json @@ -41,7 +47,8 @@ if risk_counts.get("new_package", 0) > max_new_packages: ## PowerShell consumer -This example uses `ConvertFrom-Json` and applies the same kind of explicit local threshold. +This example uses `ConvertFrom-Json` and applies the same kind of explicit +local threshold. ```powershell $summary = Get-Content outputs/summary.json -Raw | ConvertFrom-Json @@ -65,7 +72,8 @@ if ($newPackageCount -gt $maxNewPackages) { - `summary.policy` appears only when policy evaluation is applied. - `summary.enrichment` appears only when PyPI or Scorecard enrichment is used. - `unchanged` is absent because unchanged components are not modeled. -- Absence of `summary.policy` or `summary.enrichment` means the feature was not used, not that it failed. +- Absence of `summary.policy` or `summary.enrichment` means the feature was + not used, not that it failed. - Consumers should treat new unrecognized fields as additive data. ## Non-claims