Link Security warnings to dashboard outcome views (#384)

Author: Copilot

pages/dashboard/src/overview-data.js

@@ -24,7 +24,7 @@ export function deriveOverviewSources(sources) {
   const disabledWorkflows = workflows.filter((row) => String(row['workflow-active']) === 'false').length;
   const overviewMetadata = createOverviewMetadata(sources);
   const packageUsage = summarizePackageAicUsage(workflows, usage);
-  const securitySignals = buildSecuritySignals({ workflows, runs, findings });
+  const securitySignals = buildSecuritySignals({ workflows, runs, findings, outcomes });
   const valueSignals = buildValueSignals({ sources, graderObservations, operationalValues, outcomes });
   const costSignals = buildCostSignals(sources.usage);
 
@@ -612,10 +612,11 @@ function buildSecuritySummary(input) {
 }
 
 /**
- * @param {{ workflows: Array<Record<string, unknown>>, runs: Array<Record<string, unknown>>, findings: Array<Record<string, unknown>> }} input
+ * @param {{ workflows: Array<Record<string, unknown>>, runs: Array<Record<string, unknown>>, findings: Array<Record<string, unknown>>, outcomes: Array<Record<string, unknown>> }} input
  */
 function buildSecuritySignals(input) {
   const workflowNames = new Map(input.workflows.map((row) => [String(row.workflow ?? ''), String(row['workflow-name'] ?? row.workflow ?? 'Unknown workflow')]));
+  const outcomeIds = new Set(input.outcomes.map((row) => String(row['safe-output'] ?? '')).filter(Boolean));
   const signals = [
     ...groupRows(input.runs.filter((row) => String(row['run-conclusion']) === 'action-required'), (row) => String(row.workflow ?? ''))
       .map(([workflow, rows]) => ({
@@ -644,18 +645,24 @@ function buildSecuritySignals(input) {
         'navigation-page': 'packages'
       })),
     ...groupRows(input.findings.filter(isAuthoredWarning), findingWorkflowKey)
-      .map(([workflow, rows]) => ({
-        priority: 3,
-        count: rows.length,
-        tone: 'warning',
-        icon: 'issue',
-        kind: 'Authored warning',
-        title: workflowNames.get(workflow) ?? String(rows[0]?.['finding-summary'] ?? workflow),
-        detail: `${formatNumber(rows.length)} retained output${rows.length === 1 ? ' contains' : 's contain'} an explicit warning block`,
-        evidence: 'Output content',
-        action: 'View evidence',
-        'external-link': latestRow(rows)?.['external-link']
-      }))
+      .map(([workflow, rows]) => {
+        const latest = latestRow(rows);
+        const outcomeId = String(latest?.finding ?? '');
+        return {
+          priority: 3,
+          count: rows.length,
+          tone: 'warning',
+          icon: 'issue',
+          kind: 'Authored warning',
+          title: workflowNames.get(workflow) ?? String(rows[0]?.['finding-summary'] ?? workflow),
+          detail: `${formatNumber(rows.length)} retained output${rows.length === 1 ? ' contains' : 's contain'} an explicit warning block`,
+          evidence: 'Output content',
+          action: 'View evidence',
+          ...(outcomeIds.has(outcomeId)
+            ? { 'navigation-href': `#page-outcome-detail?outcome=${encodeURIComponent(outcomeId)}` }
+            : { 'external-link': latest?.['external-link'] })
+        };
+      })
   ];
   return signals.sort((left, right) => left.priority - right.priority || right.count - left.count || left.title.localeCompare(right.title));
 }

pages/dashboard/src/specification.js

@@ -287,7 +287,7 @@ export const SOURCE_FIELDS = {
   'operational-values': ['organization', 'repository', 'workflow', 'run', 'experiment', 'operational-case', 'evaluator-digest', 'rollout-mode', 'operational-value', 'operational-value-definition', 'requested-evidence-at', 'evidence-cutoff', 'maturity-at', 'maturity-status', 'baseline-value', 'delta-from-baseline', 'observed-at', 'evidence-link', 'organization-link', 'repository-link', 'workflow-link', 'run-link'],
   'overview-attention-domains': ['domain', 'state', 'tone', 'icon', 'value', 'detail', 'href', 'priority', 'order'],
   'security-summary': ['label', 'value'],
-  'security-signals': ['priority', 'count', 'tone', 'icon', 'kind', 'title', 'detail', 'evidence', 'action', 'navigation-page', 'run-link', 'external-link'],
+  'security-signals': ['priority', 'count', 'tone', 'icon', 'kind', 'title', 'detail', 'evidence', 'action', 'navigation-page', 'navigation-href', 'run-link', 'external-link'],
   'value-summary': ['label', 'value'],
   'value-signals': ['priority', 'count', 'tone', 'icon', 'kind', 'title', 'detail', 'evidence', 'action', 'navigation-page', 'run-link', 'external-link'],
   'value-workflows': ['organization', 'repository', 'workflow', 'run', 'operational-value-definition', 'opportunities', 'mature-observations', 'mean-operational-value', 'mean-baseline', 'observed-at', 'evidence-link', 'run-link', 'organization-link', 'repository-link', 'workflow-link'],

pages/dashboard/test/unit/presenter.test.js

@@ -406,6 +406,14 @@ describe('presenter built-in and custom pages', () => {
             'external-link': { relation: 'external', href: 'https://github.com/githubnext/central-agentic-ops/issues/1', label: 'View warning output' }
           }],
           metadata
+        },
+        outcomes: {
+          source: 'outcomes',
+          rows: [{
+            'safe-output': 'warning-1',
+            'outcome-title': 'Release warning'
+          }],
+          metadata
         }
       }
     });
@@ -429,7 +437,7 @@ describe('presenter built-in and custom pages', () => {
     expect(signals[0]?.querySelector('a')?.getAttribute('href')).toContain('/actions/runs/102');
     expect(signals[1]?.querySelector('a')?.getAttribute('href')).toBe('#page-packages');
     expect(signals[1]?.textContent).toContain('View package');
-    expect(signals[2]?.querySelector('a')?.getAttribute('href')).toContain('/issues/1');
+    expect(signals[2]?.querySelector('a')?.getAttribute('href')).toBe('#page-outcome-detail?outcome=warning-1');
     expect(page?.textContent).toContain('No vulnerability feed is retained.');
   });