CI: switch to scan action #372
Conversation
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
2 similar comments
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
cargo-deny produces SARIF with snippet/message fields as strings,
but the SARIF spec requires them to be objects with a text property.
This causes GitHub to reject the upload.
Add jq post-processing step to transform string values into proper
{"text": "value"} objects before upload.
GitHub's CodeQL upload-sarif action requires each SARIF file to have a unique category when uploading multiple files. Split the single batch upload into separate uploads with distinct categories: - cargo-deny - npm-audit-local-environment - npm-audit-toolkit-js - npm-audit-ui-tests - npm-audit-ui
This replaces the closed source checkmarx scan action with one using a composite of open source scanners. It should run without issues on contributers PRs.
Uses midnightntwrk/upload-sarif-github-action#43