awslabs / awslabs/simple-code-scanning-pipeline
SCSP via Pre-Commit
- Dominant language
- TypeScript
- Stars
- 19
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Implementing the pipeline through Pre-Commit would allow for de-duplicating client and server side scanning configuration.
Example pre-commit configuration:
```yaml
repos:
- repo: https://github.com/bridgecrewio/checkov.git
rev: 2.1.266
hooks:
- id: checkov
- repo: https://github.com/PyCQA/bandit.git
rev: 1.7.4
hooks:
- id: bandit
# args: [--skip, "B101", --recursive, .]
- repo: https://github.com/awslabs/git-secrets
rev: b9e96b3212fa06aea65964ff0d5cda84ce935f38
hooks:
- id: git-secrets
entry: git-secrets --scan
files: .
args: [--untracked]
```
And then run `pre-commit run --all-files` in the pipeline.
The reporting would need some refactoring, but this could be a really neat way to standardize and make the tool more repo-agnostic.
Contributor guide
Research direction
Start by reviewing the existing client- and server-side scanning configuration and the pipeline entry point. Compare the current reporting flow with the proposed pre-commit configuration and determine the required refactoring. Done means the checks run through pre-commit with deduplicated configuration and standardized reporting across repositories.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, typescript
- Domain
- ci-cd, security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100