fix: apply ruff format, fix scorecard-action tag v2 -> v2.4.0

- Run ruff format on all 31 unformatted files
- Fix ossf/scorecard-action@v2 (tag doesn't exist) to @v2.4.0
- Fix scorecard generator template to use v2.4.0
- All ruff check + format + 147 tests pass

Author: kirankotari

.github/workflows/scorecard.yml

@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run Scorecard"
-        uses: ossf/scorecard-action@v2
+        uses: ossf/scorecard-action@v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif

src/ossguard/analyzers/audit.py

@@ -34,17 +34,22 @@ def config_pct(self) -> int:
         return int((self.config_score / self.config_total) * 100)
 
     def to_json(self) -> str:
-        return json.dumps({
-            "audit_time": self.audit_time,
-            "overall_grade": self.overall_grade,
-            "config_score": f"{self.config_score}/{self.config_total}",
-            "dep_health_score": self.dep_health.aggregate_score if self.dep_health else None,
-            "total_vulns": self.dep_health.total_vulns if self.dep_health else 0,
-            "reachable_vulns": self.reachability.reachable_vulns if self.reachability else 0,
-            "noise_reduction": self.reachability.noise_reduction_pct if self.reachability else 0,
-            "findings": self.findings,
-            "recommendations": self.recommendations,
-        }, indent=2)
+        return json.dumps(
+            {
+                "audit_time": self.audit_time,
+                "overall_grade": self.overall_grade,
+                "config_score": f"{self.config_score}/{self.config_total}",
+                "dep_health_score": self.dep_health.aggregate_score if self.dep_health else None,
+                "total_vulns": self.dep_health.total_vulns if self.dep_health else 0,
+                "reachable_vulns": self.reachability.reachable_vulns if self.reachability else 0,
+                "noise_reduction": self.reachability.noise_reduction_pct
+                if self.reachability
+                else 0,
+                "findings": self.findings,
+                "recommendations": self.recommendations,
+            },
+            indent=2,
+        )
 
 
 def run_audit(project_path: str | Path) -> AuditReport:
@@ -104,9 +109,7 @@ def run_audit(project_path: str | Path) -> AuditReport:
         report.dep_health = dep_report
 
         if dep_report.critical_vulns > 0:
-            findings.append(
-                f"{dep_report.critical_vulns} CRITICAL vulnerabilities in dependencies"
-            )
+            findings.append(f"{dep_report.critical_vulns} CRITICAL vulnerabilities in dependencies")
             recommendations.append("Immediately update packages with critical vulns")
         if dep_report.high_vulns > 0:
             findings.append(f"{dep_report.high_vulns} HIGH severity vulnerabilities")

src/ossguard/analyzers/badge.py

@@ -40,22 +40,54 @@ def is_ready(self) -> bool:
 _CRITERIA = [
     # Basics
     ("basics_description", "Basics", "The project MUST have a description of what it does."),
-    ("basics_interact", "Basics", "The project MUST provide a way for users to interact with developers."),
+    (
+        "basics_interact",
+        "Basics",
+        "The project MUST provide a way for users to interact with developers.",
+    ),
     ("basics_contribution", "Basics", "The project MUST have a contribution guide."),
-    ("basics_license", "Basics", "The project MUST be released under an OSI-approved open source license."),
+    (
+        "basics_license",
+        "Basics",
+        "The project MUST be released under an OSI-approved open source license.",
+    ),
     # Change control
-    ("change_public_repo", "Change Control", "The project MUST have a public version-controlled repository."),
+    (
+        "change_public_repo",
+        "Change Control",
+        "The project MUST have a public version-controlled repository.",
+    ),
     ("change_version_semver", "Change Control", "The project MUST use semantic versioning."),
     # Reporting
-    ("report_vulnerability_process", "Reporting", "The project MUST have a vulnerability reporting process (SECURITY.md)."),
-    ("report_vulnerability_private", "Reporting", "The project MUST support private vulnerability reporting."),
+    (
+        "report_vulnerability_process",
+        "Reporting",
+        "The project MUST have a vulnerability reporting process (SECURITY.md).",
+    ),
+    (
+        "report_vulnerability_private",
+        "Reporting",
+        "The project MUST support private vulnerability reporting.",
+    ),
     # Quality
     ("quality_tests", "Quality", "The project MUST have an automated test suite."),
     ("quality_ci", "Quality", "The project MUST use CI to run tests automatically."),
     # Security
-    ("security_static_analysis", "Security", "The project MUST use at least one static analysis tool (e.g. CodeQL)."),
-    ("security_dependency_monitoring", "Security", "The project MUST monitor dependencies for known vulnerabilities."),
-    ("security_hardened_dependencies", "Security", "Dependencies MUST be updated when vulnerabilities are found."),
+    (
+        "security_static_analysis",
+        "Security",
+        "The project MUST use at least one static analysis tool (e.g. CodeQL).",
+    ),
+    (
+        "security_dependency_monitoring",
+        "Security",
+        "The project MUST monitor dependencies for known vulnerabilities.",
+    ),
+    (
+        "security_hardened_dependencies",
+        "Security",
+        "Dependencies MUST be updated when vulnerabilities are found.",
+    ),
     # Analysis
     ("analysis_scorecard", "Analysis", "The project SHOULD use OpenSSF Scorecard."),
     ("analysis_sbom", "Analysis", "The project SHOULD generate SBOMs."),
@@ -75,14 +107,16 @@ def assess_badge_readiness(project_path: str | Path) -> BadgeReport:
     # Assess each criterion
     for crit_id, category, question in _CRITERIA:
         status, evidence, suggestion = _assess_criterion(crit_id, info, path)
-        criteria.append(BadgeCriterion(
-            id=crit_id,
-            category=category,
-            question=question,
-            status=status,
-            evidence=evidence,
-            suggestion=suggestion,
-        ))
+        criteria.append(
+            BadgeCriterion(
+                id=crit_id,
+                category=category,
+                question=question,
+                status=status,
+                evidence=evidence,
+                suggestion=suggestion,
+            )
+        )
 
     met = sum(1 for c in criteria if c.status == "met")
     unmet = sum(1 for c in criteria if c.status == "unmet")
@@ -98,9 +132,7 @@ def assess_badge_readiness(project_path: str | Path) -> BadgeReport:
     )
 
 
-def _assess_criterion(
-    crit_id: str, info: ProjectInfo, path: Path
-) -> tuple[str, str, str]:
+def _assess_criterion(crit_id: str, info: ProjectInfo, path: Path) -> tuple[str, str, str]:
     """Assess a single criterion. Returns (status, evidence, suggestion)."""
 
     if crit_id == "basics_description":
@@ -143,6 +175,7 @@ def _assess_criterion(
                 return "met", "Version found in pyproject.toml", ""
         if pkg_json.exists():
             import json
+
             data = json.loads(pkg_json.read_text())
             if "version" in data:
                 return "met", f"Version {data['version']} in package.json", ""