Repository navigation
fix: Invoke-InforcerAssessment no longer scores unassessed checks as failures - #46
Merged
Merged
Conversation
…failures The 2026-09-29 OpenAPI refresh (#45) added findings.status: pass, fail, insufficientPermissions or error. The last two mean the check never ran, yet they carry compliant=false, and the cmdlet derived Status from compliant alone. Unassessed checks became Fail, rendered as Non-Compliant and lowered the score. Copilot flagged it on the merged PR. Confirmed live on tenant 14436 (CIS M365 L1+L2): two PIM approval checks came back as status=error with "data could not be read from the tenant", turning 79/106 (74.5%) into 79/108 (73.1%). Status now follows findings.status (falling back to compliant when absent). One $summarize block replaces the two duplicated score calculations and scores Pass / (Pass + Fail). Multi-tenant JSON gains NotAssessed, hence 0.8.0. Both HTML reports render the state neutrally: badge, filter, a "?" matrix cell, and an em dash for a category with nothing assessed. The matrix "All Passed" filter no longer counts a not-assessed row as passed. Four tests go through the real cmdlet with mocked API calls; removing the insufficientPermissions/error mapping fails them. 475/0/2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
The matrix report still lacks the dedicated Not Assessed filter promised in the PR description and changelog.
1 open issue
What changed in this PR
Corrects assessment scoring so checks the API could not assess are reported separately rather than counted as failures.
Changes:
- Maps API statuses and shares score calculation across single-tenant and multi-tenant runs.
- Adds neutral HTML presentation and a multi-tenant JSON
NotAssessedcount. - Adds regression tests, updates documentation, and bumps the module to 0.8.0.
| File | Description |
|---|---|
| Tests/Consistency.Tests.ps1 | Adds status, scoring, and HTML regression tests. |
| module/Public/Invoke-InforcerAssessment.ps1 | Maps statuses and excludes unassessed checks from scoring. |
| module/Private/ConvertTo-InforcerAssessmentMatrixHtml.ps1 | Displays unassessed cells and counts; adjusts All Passed filtering. |
| module/Private/ConvertTo-InforcerAssessmentHtml.ps1 | Adds neutral badges, filtering, and assessed-only category scores. |
| module/InforcerCommunity.psd1 | Bumps the version to 0.8.0. |
| docs/CMDLET-REFERENCE.md | Documents statuses and scoring behavior. |
| CHANGELOG.md | Records the fix, output addition, and migration guidance. |
Review effort: Balanced
The single-tenant report got a Not Assessed filter but the matrix did not, although the changelog says both reports have one. A row whose only non-pass cell is "?" was hidden under both Has Failures and All Passed, so it was reachable only through All. Flagged by Copilot on #46. The button appears only when a tenant has unassessed checks and selects rows with a "?" in a displayed tenant column. Verified by clicking every filter in headless Chromium against a rendered report; the test also asserts the button is absent when nothing is unassessed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of changes
The 2026-09-29 OpenAPI refresh (#45) added
findings.status(pass,fail,insufficientPermissions,error). The last two mean the check was never assessed, but they still carrycompliant: false.Invoke-InforcerAssessmentonly readcompliant, so these checks came out asFail, showed as Non-Compliant in the HTML report and lowered the score. Copilot flagged this on #45 (comment).Confirmed live: CIS M365 L1 + L2 on tenant 14436 returned two PIM approval checks as
status: "error"("data could not be read from the tenant"). The module reported 73.1% (79/108); the correct figure is 74.5% (79/106, 2 not assessed).Statusfollowsfindings.status:Pass,Fail,InsufficientPermissionsorError. When the API sends nostatus,compliantdecides as before.$summarizeblock replaces the two duplicated score calculations (single-tenant and multi-tenant). The score isPass ÷ (Pass + Fail).-OutputType JsonObjectgainsNotAssessed. That is a new output property, so this is 0.8.0.?cell in the matrix, and an em dash for a category where nothing was assessed. The matrix's "All Passed" filter no longer includes rows where a tenant was not assessed.Related issue
None. Follow-up to the review comment on #45.
Checklist
insufficientPermissions/errormapping is removed..DESCRIPTIONlists the Status values)main, nothing new.🤖 Generated with Claude Code