Gathering detailed insights and metrics for @cucumber/messages
Gathering detailed insights and metrics for @cucumber/messages
A message protocol for representing results and other information from Cucumber
Installations
npm install @cucumber/messagesDeveloper
cucumber
Developer Guide
BETA
Module System
ESM
Min. Node Version
Typescript Support
Yes
Node Version
20.18.0
NPM Version
10.8.2
Statistics
21 Stars
1,698 Commits
19 Forks
71 Watching
16 Branches
146 Contributors
Updated on 28 Nov 2024
Languages
C# (19.2%)
PHP (18.28%)
Java (15.76%)
C++ (11.37%)
Ruby (11.26%)
CMake (7.91%)
Perl (7.15%)
HTML (2.87%)
TypeScript (1.91%)
Go (1.9%)
Makefile (1.55%)
Elixir (0.73%)
Dockerfile (0.07%)
JavaScript (0.03%)
Total Downloads
Cumulative downloads
Total Downloads
250,989,047
Last day
-2.7%
679,523
Compared to previous day
Last week
3.5%
3,802,519
Compared to previous week
Last month
10.2%
15,733,124
Compared to previous month
Last year
91.7%
139,550,573
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
4
Dev Dependencies
7
Versions
Cucumber Messages
Cucumber Messages is a message protocol for representing results and other information from Cucumber. The protocol aims to decouple various components of the Cucumber platform, with the following advantages:
- Each component only needs to know about a subset of messages
- Gherkin is decoupled from the Cucumber execution component
- Enables the future support other formats such as Markdown and Excel
Message Overview
Note: Markdown and Excel formats are currently not supported and mentioned here as potential future alternative languages to express BDD scenarios.
JSON Schema
The jsonschema directory contains JSON Schema definitions for each message type.
See messages.md for a detailed description of each message type.
Encoding
When Cucumber Messages are stored in a file or sent over a network, they are encoded as NDJSON. We call this a message stream.
Each message in a message stream is of type Envelope.
Language implementations
Each subdirectory defines language-specific implementations of these messages, generated from the JSON schemas. The current implementations are:
- C++
- .NET
- Go
- Java
- Javascript
- Perl
- PHP
- Ruby
There is also 1 subdirectory for Elixir which contains the legacy implementation which was largely driven by protobuf. This is currently not implemented or tested / integrated into our CI and will require the process of porting over to the JSON schema protocol.
- Elixir
Message emitters
Cucumber Messages are currently sent by the following versions of Cucumber (using the message formatter):
- Cucumber-JVM
6.0.0and later - Cucumber-Ruby
4.0.0and later - Cucumber.js
7.0.0and later
Messages emitters for the other Cucumber languages (e.g. Perl) are not yet implemented.
Why Cucumber Messages
Cucumber needs to produce results in a machine-readable format so that other tools can generate reports.
Historically, Cucumber did this with the json and junit formatters.
These formats however, have several shortcomings that are now addressed by using Cucumber Messages.
The json formatter is now in maintenance mode for these implementations, and Messages is the preferred standard.
See utilities for a list of tools that may help with backward and forward compatibility
with the json format.
High memory footprint
JSON and XML production/consumption is done by serialising/deserialising an object graph. For "big" Cucumber runs this graph may consume a considerable amount of RAM, in particular if several large attachments (screenshots) are attached.
This can cause out of memory errors, aborting Cucumber runs or reporting jobs. It also means that no results can be consumed by downstream processors until the last scenario has finished.
With Cucumber Messages, several messages containing smaller pieces of information are emitted continuously to a stream (NDJSON, see above), avoiding high memory consumption and enabling real-time processing of results.
Lack of a schema
The JSON reporter does not have a formal schema. This has led to slightly inconsistent implementations of the JSON formatter in various Cucumber implementations. Consumers of the JSON format have to anticipate and detect these inconsistencies and try to cope with them.
Limited information
The junit XML format can only contain very limited information such as test case name and status.
While there isn't an official schema for JUnit XML, there are a few defacto ones around which are very limited.
The json format represents the following information:
- Gherkin source (as a rough and lossy representation of a Gherkin document's abstract syntax tree)
- Attachments (formerly called
embeddings) - Path and line for step definitions
- Results for hooks
However, it does not contain the following information (but Cucumber Messages does):
- Original source code of the Gherkin document
- Gherkin document abstract syntax tree
- Step definitions
- Parameter types
This kind of information is required to produce rich reports and analytics, and is used in @cucumber/react-components and Cucumber Reports.
Examples
You will find examples of Cucumber Messages in the compatibility-kit project.
Utilities
- @cucumber/react - React component that renders Cucumber Messages nicely
- Used internally by Cucumber Reports.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/cucumber/.github/SECURITY.md:1
- Warn: no linked content found
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/cucumber/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/cucumber/.github/SECURITY.md:1
Reason
Found 1/28 approved changesets -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-cpan.yaml:13
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-github.yaml:13
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-hex.yaml:13
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-php.yaml:13
- Warn: no topLevel permission defined: .github/workflows/release-cpan.yaml:1
- Warn: no topLevel permission defined: .github/workflows/release-github.yaml:1
- Warn: no topLevel permission defined: .github/workflows/release-hex.yaml:1
- Warn: no topLevel permission defined: .github/workflows/release-mvn.yml:1
- Warn: no topLevel permission defined: .github/workflows/release-npm.yml:1
- Warn: no topLevel permission defined: .github/workflows/release-nuget.yaml:1
- Warn: no topLevel permission defined: .github/workflows/release-php.yaml:1
- Warn: no topLevel permission defined: .github/workflows/release-rubygem.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-codegen.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-cpp.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-dotnet.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-elixir.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-go.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-java.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-javascript.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-perl.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-php.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-ruby.yml:1
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cpan.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-cpan.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-cpan.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-cpan.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-github.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-github.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-github.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-github.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-hex.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-hex.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-hex.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-hex.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-hex.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-hex.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-hex.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-hex.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-mvn.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-mvn.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-mvn.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-mvn.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-mvn.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-mvn.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-npm.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-npm.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-npm.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-npm.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-npm.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-npm.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-nuget.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-nuget.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-nuget.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-nuget.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-nuget.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-nuget.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-php.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-php.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-php.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-php.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-rubygem.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-rubygem.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-rubygem.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-rubygem.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-rubygem.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/release-rubygem.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-codegen.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-codegen.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-codegen.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-codegen.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-codegen.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-codegen.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-cpp.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-cpp.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-cpp.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-cpp.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-dotnet.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-dotnet.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-dotnet.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-dotnet.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-elixir.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-elixir.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-elixir.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-elixir.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-elixir.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-elixir.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-go.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-go.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-go.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-go.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-java.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-java.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-java.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-java.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-javascript.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-javascript.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-javascript.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-javascript.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-perl.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-perl.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-perl.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-perl.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-php.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-php.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-php.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-php.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-php.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-php.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-ruby.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-ruby.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-ruby.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/cucumber/messages/test-ruby.yml/main?enable=pin
- Warn: containerImage not pinned by hash: cpp/Dockerfile:4
- Warn: containerImage not pinned by hash: cpp/Dockerfile:24
- Warn: containerImage not pinned by hash: cpp/Dockerfile:33
- Warn: npmCommand not pinned by hash: .github/workflows/release-npm.yml:20
- Info: 0 out of 27 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 18 third-party GitHubAction dependencies pinned
- Info: 0 out of 3 containerImage dependencies pinned
- Info: 1 out of 2 npmCommand dependencies pinned
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 6 are checked with a SAST tool
Score
5.1
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More