Skip to content

feat: add Security Debt Trend tracking (Phase 2.3) - #23

Merged
Falkesand merged 10 commits into
mainfrom
feature/security-debt-trend
Feb 12, 2026
Merged

Falkesand merged 10 commits into
mainfrom
feature/security-debt-trend

Conversation

@Falkesand

Copy link
Copy Markdown
Owner

Summary

  • Adds --snapshot flag to cra-report that persists project metrics as JSON files in %LocalAppData%/DepSafe/snapshots/
  • Compares against prior snapshots to compute trend direction (Improving/Stable/Degrading) across 7 key metrics
  • Displays trend deltas via Spectre.Console CLI table and a new HTML report section with inline SVG sparklines
  • SHA256-hashed project paths prevent path traversal; millisecond-precision filenames prevent parallel CI collisions
  • IOException + JsonException graceful degradation for corrupted/locked snapshot files

Test plan

  • 6 TrendSnapshotStore tests (save/load round-trip, chronological order, maxCount, isolation, corrupted file skip)
  • 10 TrendAnalyzer tests (single/multiple snapshots, direction logic, higher/lower-is-better polarity, overall direction)
  • 1 BuildSnapshot integration test (CraReport → TrendSnapshot field mapping)
  • 503 total tests pass, 0 warnings, 0 errors
  • Dual code review (Sonnet + Opus) — both approved

…arklines

- Add --snapshot option to cra-report command for trend tracking
- Thread snapshot bool through Execute* and Generate*ReportAsync pipelines
- Add SetTrendData to CraReportGenerator with backing fields
- Add DisplayTrendSummary CLI output with Spectre.Console table
- Add Security Debt Trend HTML section with sparkline SVG polylines,
  summary card, metric rows, and collapsible history table
- Add trend CSS styles to report-styles.css
- Handle empty state: first snapshot prints dim guidance message
…tore

Broadens LoadAsync catch to handle IOException (locked/permission-denied
files) alongside JsonException. Adds millisecond precision to snapshot
filenames to prevent collisions in parallel CI environments.
@Falkesand
Falkesand merged commit a7332d1 into main Feb 12, 2026
1 check passed
@Falkesand
Falkesand deleted the feature/security-debt-trend branch February 12, 2026 10:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant