Repository navigation
Detect report types from content and accept SARIF - #108
Merged
Merged
Conversation
Report type now comes from the file contents. The filename is only used when the contents do not say what the file is. SARIF 2.1.0 reports can be listed, validated, and bundled. Any CycloneDX JSON BOM with vulnerabilities uses the cyclonedx rules, whichever tool wrote it. Fixes #97 Fixes #98 Fixes #99 Fixes #80 Co-authored-by: Bacchus Jackson (BJaX) <BacchusJackson@users.noreply.github.com>
Deploying gatecheck-website with
|
| Latest commit: |
1cbaf15
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://66b5f771.gatecheck-website.pages.dev |
| Branch Preview URL: | https://cursor-report-types-4e64.gatecheck-website.pages.dev |
Member
Author
|
Code looks good to me. This conflicts with main now that #107 (Trivy) landed, so CI hasn't run yet. Can you merge main in, make sure Trivy JSON goes through the new content detection, and push? |
Windows cannot delete a temp config while the decoder still has it open. Co-authored-by: Bacchus Jackson (BJaX) <BacchusJackson@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #97
Fixes #98
Fixes #99
Fixes #80
Report type now comes from the file contents. The filename is only used when the contents do not say what the file is. That fixes CycloneDX reports with grype in the name being read as Grype.
SARIF 2.1.0 reports can be listed, validated, and bundled. Severity limits use security-severity when the tool sets it, and the SARIF level otherwise. Rule ids can be allowed or denied in the config, same shape as the CVE lists.
Any CycloneDX JSON BOM with vulnerabilities is listed and validated the same way. Grype, Trivy, and other producers share that path. A missing severity string falls back to the CVSS score.
Trivy JSON and osv-scanner JSON from main use that same content detection. The filename is the fallback when a file is ambiguous, including an empty
{"results":[]}.