github / github/ossar-action

Improve tool names in sarif output

Aperta
#23 6 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
JavaScript
Stelle
100
Fork
29
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

@davidknise You seem to be the main maintainer of this repo.

Bandit and Gosec are using the name property for outputting a description (`Security audit for python by bandit` and `Golang security checks by gosec`).

At Github Code Scanning, we use those names for displaying the tool at the Security page. We added some internal logic for handling these special cases and rename them to the tool name, but we are in the process of cleaning up the code and removing it. We suggest using the name property for outputing the tool name (Bandit, and Gosec), and the [fullName](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html#_Toc16012498) or [short](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html#_Toc16012508)/[longDescription](https://docs.oasis-open.org/sarif/sarif/v2.1.0/cs01/sarif-v2.1.0-cs01.html#_Toc16012509) properties for storing the current long name.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.