Produce SARIF report and exit
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 372
- Forks
- 107
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 5
Description
Is your feature request related to a problem? Please describe.
Creating a comment every time a commit is pushed to a PR is a non-starter for us. We would prefer to just upload the vulns to GHAS.
Describe the solution you'd like to see
The ability to tell Frogbot to scan for vulns on the filesystem, produce a SARIF report, and then exit would be preferable. This way we can interact with the vulnerabilities found by Frogbot in any way we wish.
This would allow folks to workaround issues like #158.
Describe alternatives you've considered
There doesn't seem to be any other way to get the SARIF data from Frogbot. We could use jf xr directly, but then we lose out on Frogbot's ability to automatically detect the dependencies in use.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing Frogbot’s filesystem scanning flow and how it currently exposes vulnerability results, then compare that with the requested SARIF output and exit behavior. Check how the result could be consumed by GHAS without creating a pull-request comment; done means a filesystem scan produces a SARIF report and exits for downstream use.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, go
- Domain
- ci-cd, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100