fossas / fossas/fossapi

Add release-group issue-listing commands (including ignored-issue rollup)

Open
#26 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
0
Forks
0
Avg merge
2h 7m
Merged PRs (30d)
2

Description

## Why

Reconciling "RG header shows N unresolved issues but Σ per-project counts
come out higher" is a common support workflow. The answer is usually a mix
of (a) cross-project revision-level dedup and (b) issues ignored at the RG
scope. fossapi can't do either side of this today.

Two server endpoints are relevant:

1. `GET /api/project_group/{rg_id}/release/{release_id}/issues` — active
issues only (full per-issue records). Useful for diffing by logical key.
2. `GET /api/v2/issues/revisions` with `scope[type]=releaseGroup` — the
rollup-by-revision endpoint the webapp uses on the RG dashboard. This is
the only way to retrieve the RG-scoped **ignored** set.

## Current workaround

```bash
# Active issues (detailed)
curl -sH "Authorization: Bearer $FOSSA_API_KEY" \
"https://app.fossa.com/api/project_group/1234/release/5678/issues"

# Ignored issues (rollup-by-revision, UI endpoint)
curl -sH "Authorization: Bearer $FOSSA_API_KEY" \
"https://app.fossa.com/api/v2/issues/revisions?\
category=licensing&status=ignored\
&scope[type]=releaseGroup&scope[id]=1234&scope[release]=5678\
&sort=issue_count_desc&page=1&count=200"
```

Rollup response shape:
```json
{
"revisions": [
{
"revisionId": "mvn+example:pkg$1.0.0",
"dependencyName": "Example Package",
"issueCount": 3,
"projectCount": 5,
"type": {"policy_flag": 3},
"depth": {"transitive": 5}
}
]
}
```

Notable limitation on the v1 endpoint: no query param exposes ignored
issues. Tested `?status=ignored`, `?showIgnored=true`, `?ignored=true`,
`?includeResolved=true`, `?apply_resolutions=false` — all return the
identical active-only set. So you can't reconcile counts using v1 alone.

## Proposed CLI surface

```
# Detailed active issues (v1 shape):
fossapi list release-group-issues [--release ] \
[--category licensing|vulnerability|quality] [--json]

# Rollup including ignored (v2 shape):
fossapi list release-group-issue-rollup [--release ] \
--status active|ignored|all \
[--category licensing|vulnerability|quality] [--json]
```

## Repro

```bash
# "How many issues are ignored at the RG level for RG 1234's latest release?"
# Today: two-step curl + JSON grouping by hand.
# Desired:
fossapi list release-group-issue-rollup 1234 --status ignored --json \
| jq '[.revisions[].issueCount] | add'
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.