dependency-check / dependency-check/azuredevops

separate warning threshold or CVSS score output

Open
#139 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
TypeScript
Stars
53
Forks
35
PR merge metrics
No merged PRs in 30d

Description

Hi,
I would like to suggest adding a separate warning threshold.
I know there's warnOnCVSSViolation parameter, but unfortunately it's implemented as boolean only.

The idea is to be able to have different task result based on CVSS score.

e.g.
0-4 => ok
4-6 => warning
6-10 => fail

Alternatively, would it be possible to declare CVSS score as output variable? This way we could easily evaluate the score and break the pipe in a subsequent task ourself...

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.