jfrog / jfrog/jfrog-cli-security
add Xray scan id to SARIF output
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Is your feature request related to a problem? Please describe.
the scan id is included in --format=json but not in --format sarif
$ jq -r '.[].scan_id' ./xray.json
0d0a1fd8-ece8-4e2a-6be4-f59edf917227
$ jq -r '.runs[].automationDetails.guid' ./xray-sarif.json
null
the scan id is used to access the On-Demand Scanning report. e.g.
https://artifactory.example.com/ui/onDemandScanning/0d0a1fd8-ece8-4e2a-6be4-f59edf917227
some scans take a long time so running them twice to get both the SARIF output and the scan id is less than ideal.
Describe the solution you'd like to see
output the scan id in the guid field of the automationDetails object for each run object
Describe alternatives you've considered
Selling all my worldly possessions and retreating into the forest.
Additional context
SARIF v2.1.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the SARIF formatter and the existing JSON handling for scan_id, then compare how each output is assembled. Use the SARIF automationDetails.guid field for each run and verify that it contains the scan ID from the same scan without requiring a second scan.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100