jfrog / jfrog/frogbot

Support Scan on github tags

Open
#868 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature request
Dominant language
Go
Stars
372
Forks
107
Avg merge
2d 20h
Merged PRs (30d)
5

Description

Is your feature request related to a problem? Please describe.
Currently, we use GitHub tags to manage microservice versions in our project. When I try to run a scan via workflow dispatch, I encounter the following error:

Image

Describe the solution you'd like to see
I would like the ability to scan a specific GitHub tag to identify vulnerabilities in that version. It would also be beneficial to tag these versions as "production" or "development" (ideally with customizable tags to accommodate different versions in various regions).

Describe alternatives you've considered
Alternatively, we could create separate "production" and "development" branches, push changes to them, and use these branches exclusively for running Frogbot. However, this approach would add complexity, as each new deployment would require cherry-picking changes to each branch.

In my experience with other tools, specifying the version as an argument was a straightforward setup. This simplified the process and allowed us to easily identify issues in different development phases.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how workflow dispatch receives the repository ref and how Frogbot selects branches for scanning. Compare the requested GitHub tag input with the current branch-based flow, including production or development labels and regional customization. Done means a workflow can target a specific tag and identify its scan context without requiring separate branches.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, github, github-actions, go
Domain
ci-cd, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.