fix columns width on terminal

Author: Yann-P

security_overview/cli.py

@@ -9,6 +9,7 @@
 from . import render_md, render_terminal
 from .constants import ALL_STATES
 from .fetch import check_token, fetch, fetch_pulls
+from .render_common import HEADER_COLS
 
 RENDERERS = {
     "terminal": render_terminal,
@@ -26,6 +27,16 @@ def parse_states(value):
     return states
 
 
+def parse_columns(value):
+    cols = [c.strip() for c in value.split(",") if c.strip()]
+    for c in cols:
+        if c not in HEADER_COLS:
+            raise argparse.ArgumentTypeError(
+                f"invalid column {c!r} (choose from {', '.join(HEADER_COLS)})"
+            )
+    return cols
+
+
 def parse_date(value):
     try:
         date.fromisoformat(value)
@@ -66,6 +77,16 @@ async def main():
         metavar="STATE[,STATE...]",
         help="filter by state; repeatable and/or comma-separated (default: all states)",
     )
+    parser.add_argument(
+        "--columns",
+        type=parse_columns,
+        action="append",
+        metavar="COL[,COL...]",
+        help=(
+            "show only these columns; repeatable and/or comma-separated, always "
+            f"printed in the canonical order (default: all of {', '.join(HEADER_COLS)})"
+        ),
+    )
     parser.add_argument(
         "--redact",
         action="store_true",
@@ -103,6 +124,7 @@ async def main():
     )
     args = parser.parse_args()
     states = [s for group in (args.state or []) for s in group] or ALL_STATES
+    columns = [c for group in (args.columns or []) for c in group] or None
     renderer = RENDERERS[args.format]
 
     headers = {
@@ -133,13 +155,22 @@ async def main():
             for fork_url in fork_urls:
                 nursery.start_soon(fetch_pulls, client, fork_url, pull_results)
 
-    render_kwargs = {"pull_results": pull_results, "redact": args.redact}
+    render_kwargs = {"pull_results": pull_results, "redact": args.redact, "columns": columns}
     if args.format == "terminal":
         # tab-separated plain output when piped, so cut/awk/datamash can parse it
         plain = not sys.stdout.isatty()
         render_kwargs["plain"] = plain
+        # one width per column for the whole run: every org and the header line
+        # up in a single table, instead of each org sizing its own columns
+        widths = None if plain else render_terminal.column_widths(
+            states, results, pull_results, args.redact, columns
+        )
+        render_kwargs["widths"] = widths
         # headers go to stderr so stdout stays 1 line = 1 advisory
-        print(render_terminal.header(redact=args.redact, plain=plain), file=sys.stderr)
+        print(
+            render_terminal.header(redact=args.redact, plain=plain, columns=columns, widths=widths),
+            file=sys.stderr,
+        )
     for org in args.orgs:
         out = renderer.render_org(org, states, results, **render_kwargs)
         if out:

security_overview/render_common.py

@@ -3,9 +3,25 @@
 # Column set shared by the terminal and md renderers. The md renderer carries
 # org/repo as headings instead of columns, but the rest line up 1:1.
 HEADER_COLS = ["created", "updated", "to-publish", "state", "org", "repo", "ghsa", "cve", "title", "PRs"]
+# what survives --redact: ages and state, nothing that identifies the advisory
+REDACT_COLS = ["created", "updated", "to-publish", "state", "org", "repo"]
 NVD_URL = "https://nvd.nist.gov/vuln/detail/{}"
 
 
+def select_columns(columns=None, redact=False):
+    """The columns to show, always in HEADER_COLS order.
+
+    `columns` is the --columns allow-list (None means all). Redaction is applied
+    last, so it wins over anything the caller asked for. Both renderers derive
+    their header and their cells from this one list, which is what keeps the two
+    in step and keeps rows matching the header.
+    """
+    cols = HEADER_COLS if columns is None else [c for c in HEADER_COLS if c in columns]
+    if redact:
+        cols = [c for c in cols if c in REDACT_COLS]
+    return cols
+
+
 def time_to_publish(advisory):
     """Days from creation to publication; None unless the advisory is published."""
     if advisory.get("state") != "published":

security_overview/render_md.py

@@ -1,32 +1,31 @@
 from .render_common import (
-    HEADER_COLS,
     NVD_URL,
     days_ago,
     group_by_repo,
     pr_label,
+    select_columns,
     time_to_publish,
 )
 
-# org/repo are headings in markdown, so they drop out of the table itself
-_COLS = [c for c in HEADER_COLS if c not in ("org", "repo")]
-# redaction strips advisory-identifying columns, same as the terminal renderer
-_REDACTED_COLS = _COLS[: _COLS.index("state") + 1]
-
 
 def _cell(text):
     """Escape what would otherwise break out of a table cell."""
     return str(text).replace("|", "\\|").replace("\n", " ")
 
 
-def render_org(org, states, results_by_key, pull_results=None, redact=False):
+def render_org(org, states, results_by_key, pull_results=None, redact=False, columns=None):
     advisories = []
     for state in states:
         advisories.extend(results_by_key.get((org, state), []))
 
     if not advisories:
         return ""
 
-    cols = _REDACTED_COLS if redact else _COLS
+    # org/repo are headings in markdown, so they never appear as columns
+    cols = [c for c in select_columns(columns, redact) if c not in ("org", "repo")]
+    if not cols:
+        return ""
+
     header = "| " + " | ".join(cols) + " |"
     divider = "|" + "|".join("-" * (len(c) + 2) for c in cols) + "|"
 
@@ -39,27 +38,22 @@ def render_org(org, states, results_by_key, pull_results=None, redact=False):
         lines.append(divider)
         for advisory in items:
             ttp = time_to_publish(advisory)
-            cells = [
-                days_ago(advisory.get("created_at", "")),
-                days_ago(advisory.get("updated_at", "")),
-                "" if ttp is None else ttp,
-                advisory.get("state") or "?",
-            ]
-
-            if not redact:
-                url = advisory.get("html_url", "")
-                ghsa_id = advisory.get("ghsa_id") or ""
-                cve = advisory.get("cve_id") or ""
-                fork = advisory.get("private_fork")
-                fork_html_url = fork.get("html_url") if fork else None
-                pulls = (pull_results or {}).get(fork_html_url, []) if fork_html_url else []
-                cells += [
-                    f"[{ghsa_id}]({url})" if (ghsa_id and url) else ghsa_id,
-                    f"[{cve}]({NVD_URL.format(cve)})" if cve else "",
-                    _cell(advisory.get("summary") or ""),
-                    ", ".join(f"[{pr_label(p)}]({p['html_url']})" for p in pulls),
-                ]
-
-            lines.append("| " + " | ".join(str(c) for c in cells) + " |")
+            url = advisory.get("html_url", "")
+            ghsa_id = advisory.get("ghsa_id") or ""
+            cve = advisory.get("cve_id") or ""
+            fork = advisory.get("private_fork")
+            fork_html_url = fork.get("html_url") if fork else None
+            pulls = (pull_results or {}).get(fork_html_url, []) if fork_html_url else []
+            cell = {
+                "created": days_ago(advisory.get("created_at", "")),
+                "updated": days_ago(advisory.get("updated_at", "")),
+                "to-publish": "" if ttp is None else ttp,
+                "state": advisory.get("state") or "?",
+                "ghsa": f"[{ghsa_id}]({url})" if (ghsa_id and url) else ghsa_id,
+                "cve": f"[{cve}]({NVD_URL.format(cve)})" if cve else "",
+                "title": _cell(advisory.get("summary") or ""),
+                "PRs": ", ".join(f"[{pr_label(p)}]({p['html_url']})" for p in pulls),
+            }
+            lines.append("| " + " | ".join(str(cell[c]) for c in cols) + " |")
 
     return "\n".join(lines)