l3montree-dev / l3montree-dev/devguard
Issues with devguard-scanner links in CI jobs
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 161
- Forks
- 43
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 37
Description
Describe the bug
If a CI jobs fails because of unhandled vulnerabilities a link to devguard is printed.
This link has two issues:
- It is based on the API url, and thus you can't open it in the browser
- The link has no artifact filter set - if your CI generates multiple artifacts the displayed list also includes vulnerabilities in other artifacts.
Generated link in my case: https://api.devguard.awesome-it.de/awesome-it/projects/container-hardening/assets/mongodb/refs/main/dependency-risks/
Link to the dependency risks: https://devguard.awesome-it.de/awesome-it/projects/container-hardening/assets/mongodb/refs/main/dependency-risks/
Link to the relevant issues: https://devguard.awesome-it.de/awesome-it/projects/container-hardening/assets/mongodb/refs/main/dependency-risks?filterQuery%5Bartifact_dependency_vulns.artifact_artifact_name%5D%5Bis%5D=pkg%3Aoci%2Fmongodb-7-0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Find the CI job code that constructs the devguard dependency-risks link and reproduce the case with multiple artifacts. Compare the generated URL with the browser-facing example and the artifact-filtered example in the issue. Done means the link opens the web URL and limits results to the relevant artifact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100