github / github/ossar-action

Improve tool names in sarif output

Open
#23 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
100
Forks
29
PR merge metrics
No merged PRs in 30d

Description

@davidknise You seem to be the main maintainer of this repo.

Bandit and Gosec are using the name property for outputting a description (`Security audit for python by bandit` and `Golang security checks by gosec`).

At Github Code Scanning, we use those names for displaying the tool at the Security page. We added some internal logic for handling these special cases and rename them to the tool name, but we are in the process of cleaning up the code and removing it. We suggest using the name property for outputing the tool name (Bandit, and Gosec), and the [fullName](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html#_Toc16012498) or [short](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html#_Toc16012508)/[longDescription](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html#_Toc16012509) properties for storing the current long name.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.