{# Secret Scanning program dashboard: findings funnel, severity donut,
   source breakdown, and a "Top findings" preview linking to the full
   register at /activities/secret-scanning/findings. #}

{% from "_macros.html" import info_tip %}

<span class="ds-overline u-d-block u-mt-8">Program dashboard</span>

<div class="stat-card-grid u-mt-4">
  <div class="stat-card has-info">
    {% call info_tip("Secrets found") %}
    <p>Secrets reported in each project's latest successful secret scan.</p>
    <p>The same secret found again on a later scan of that project is not counted twice here.</p>
    {% endcall %}
    <span class="stat-card__value">{{ secret_dash.total }}</span>
    <span class="stat-card__label">Secrets found</span>
  </div>
  <div class="stat-card has-info{% if secret_dash.looks_live_count %} stat-card--error u-border-t-error{% endif %}">
    {% call info_tip("Looks live") %}
    <p>Secrets the scan judged still valid.</p>
    <p>Rotate these before anything else. A secret that only looks leaked, but not live, is less urgent.</p>
    {% endcall %}
    <span class="stat-card__value{% if secret_dash.looks_live_count %} u-color-error{% endif %}">{{ secret_dash.looks_live_count }}</span>
    <span class="stat-card__label">Looks live — rotate now</span>
  </div>
  <div class="stat-card has-info">
    {% call info_tip("Found in documentation") %}
    <p>Secrets found in docs, READMEs, or other written material rather than in source.</p>
    <p>They are easy to publish by accident, and they are not covered by a code-only review.</p>
    {% endcall %}
    <span class="stat-card__value">{{ secret_dash.docs_count }}</span>
    <span class="stat-card__label">Found in documentation</span>
  </div>
  <div class="stat-card has-info">
    {% call info_tip("Version-control history only") %}
    <p>Secrets that appear only in version-control history, not in the current tree.</p>
    <p>They can still be cloned from the past. Removing the file from the latest commit does not remove them.</p>
    {% endcall %}
    <span class="stat-card__value">{{ secret_dash.history_count }}</span>
    <span class="stat-card__label">Version-control history only</span>
  </div>
</div>

<div class="u-d-grid u-cols-1fr-1fr u-gap-6 u-mt-8">
  <div class="card has-info">
    {% call info_tip("Severity") %}
    <p>How the scan rated each secret: High, Medium, or Low.</p>
    <p>This is separate from whether the secret still looks live. A high-severity secret can already be revoked.</p>
    {% endcall %}
    <h4 class="card__title">Severity</h4>
    {% set severity_total = secret_dash.severity_counts.high + secret_dash.severity_counts.medium + secret_dash.severity_counts.low %}
    <div class="donut-row u-mt-4">
      <div class="donut" data-donut-gradient="{{ secret_severity_gradient }}">
        <div class="donut__hole">{{ severity_total }}</div>
      </div>
      <div class="donut-legend">
        <span class="donut-legend__item"><span class="donut-legend__dot u-bg-error"></span>High ({{ secret_dash.severity_counts.high }})</span>
        <span class="donut-legend__item"><span class="donut-legend__dot u-bg-warning"></span>Medium ({{ secret_dash.severity_counts.medium }})</span>
        <span class="donut-legend__item"><span class="donut-legend__dot u-bg-teal-500"></span>Low ({{ secret_dash.severity_counts.low }})</span>
      </div>
    </div>
  </div>

  <div class="card has-info">
    {% call info_tip("By source") %}
    <p>Where each secret was found: current code, config, version-control history, or documentation.</p>
    <p>Code and config are in the tree you ship. History and docs are easier to miss in a normal review.</p>
    {% endcall %}
    <h4 class="card__title">By source</h4>
    <p class="card__body u-mb-4">Where each secret was found.</p>
    {% for key, label in [("code", "Code"), ("config", "Config"), ("history", "Version-control history"), ("docs", "Documentation")] %}
    <div class="severity-bar">
      <span class="severity-bar__dot severity-bar__dot--{{ 'high' if key in ('code', 'config') else 'medium' }}"></span>
      <span class="severity-bar__label u-w-10rem">{{ label }}</span>
      <div class="severity-bar__track"><div class="severity-bar__fill severity-bar__fill--low" data-bar-width="{{ (secret_dash.source_counts[key] / secret_dash.total * 100) if secret_dash.total else 0 }}"></div></div>
      <span class="severity-bar__count">{{ secret_dash.source_counts[key] }}</span>
    </div>
    {% endfor %}
  </div>
</div>

{% set top_findings = secret_dash.findings[:5] %}
<div class="u-d-flex u-justify-space-between u-items-flex-end u-flex-wrap u-gap-4 u-mt-10">
  <div>
    <h2 class="u-m-0 heading-with-info">Top findings
      {% call info_tip("Top findings", inline=True) %}
      <p>The five highest-severity secrets across projects.</p>
      <p>Validity says whether the secret still looks live. The full register is on the findings page.</p>
      {% endcall %}
    </h2>
    <p class="ds-body u-color-text-muted u-mt-1">The highest-severity secrets found across all projects.</p>
  </div>
  <a class="btn btn--outline btn--sm" href="/activities/secret-scanning/findings">View all findings ({{ secret_dash.total }}) &rarr;</a>
</div>

{% if top_findings %}
<div class="table-wrap u-mt-4">
  <table class="table">
    <thead>
      <tr>
        <th>Project</th><th>Severity</th><th>Secret type</th><th>Location</th><th>Source</th><th>Validity</th>
      </tr>
    </thead>
    <tbody>
      {% for f in top_findings %}
      <tr class="run-row" data-href="/activities/secret-scanning/findings/{{ f.key }}" tabindex="0">
        <td>{{ f.project_display_name }}</td>
        <td><span class="badge {{ f.severity | severity_badge }}">{{ f.severity }}</span></td>
        <td>{{ f.secret_type }}</td>
        <td><code>{{ f.location }}</code></td>
        <td>{{ f.source }}</td>
        <td>
          {% if f.validity.lower() == 'looks live' %}<span class="badge badge--error">{{ f.validity }}</span>
          {% else %}<span class="badge badge--neutral">{{ f.validity }}</span>{% endif %}
        </td>
      </tr>
      {% endfor %}
    </tbody>
  </table>
</div>
{% else %}
<div class="alert alert--info u-mt-4"><div>No secrets found yet.</div></div>
{% endif %}

<div class="u-border-b-border u-mt-8"></div>