Comments (7)
Thanks for the pictures, I can see them now.
I still believe there is more value in adding SARIF support than in shoehorning ggshield outputs in a unit-test output format. It is not clear to me how to turn a found secret or an IaC rule violation into a failed test.
Since Microsoft is one of of the creators of SARIF I think it's safe to assume the Azure extension is going to be correctly supported.
from ggshield.
Hi, thanks for your report!
Our JSON format indeed lacks documentation. We plan to work on fixing that.
I am not convinced by unit-test oriented file formats because I would expect a bit of impedance mismatch to map ggshield output to these formats. I think SARIF would be a better fit, since it's been designed from the beginning for static analysis tools. It's JSON, not XML, but it is a standard format, supported by Azure DevOps and other tools. What do you think?
from ggshield.
from ggshield.
Normally our scan and/or test results are collected and published in Azure DevOps like shown in the picture below.
There are no pictures in your message. I think GitHub discarded them.
from ggshield.
from ggshield.
Another try..
Still no picture 😞. I think you need to use the web interface to attach them.
from ggshield.
and
from ggshield.
Related Issues (20)
- Add command-line tests for --ignore-known-secrets HOT 1
- Add incident URL to JSON output HOT 1
- [Question] How to enable generic password detection in ggshield pre-commit HOT 2
- Update docker GitHub actions
- ggshield secret scan --verbose --ignore-known-secrets pre-receive --web options does not ignore known secrets on Gitlab IDE HOT 1
- Docker scans do not use `ignored-paths` configuration option
- SSLEOFError when scanning a windows docker image HOT 42
- ggshield and pygitguardian disagree on the way to check the maximum document size
- appdirs is deprecated
- GitHub action incorrect behavior HOT 1
- Improve action template
- ggshield secret scan repo aborts with little debugging information HOT 2
- Command line options to recursively search other repositories for secrets HOT 2
- Remove the need for custom environment variables in GitHub actions HOT 2
- Brew installation is very slow HOT 2
- Your service is spam and scum HOT 1
- Add an option to make `secret scan path` honor .gitignore files HOT 1
- GGShield test suite fails with Python 3.12
- Improve identification of binaries
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ggshield.