Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add XML output with common schema #772

Open
LINKIT-HIVE opened this issue Oct 13, 2023 · 7 comments
Open

Add XML output with common schema #772

LINKIT-HIVE opened this issue Oct 13, 2023 · 7 comments
Labels
status:new This issue needs to be reviewed type:feature Feature request

Comments

@LINKIT-HIVE
Copy link

Is your feature request related to a problem? Please describe.

I tested ggshield in an Azure DevOps pipeline. The pipeline fails when secrets are detected. I need to assess the output to find out where the issues occur, which is not user friendly.
Currently, when secrets are detected, I automatically create a BUG on the backlog with the JSON output as attachment. But also the JSON file is hard to read/assess.

Describe the solution you'd like

Currently the output off ggshield is TXT or JSON. If I could choose a XML output which uses a standard test schema (JUnit/NUnit/XUnit/CTest/VSTest) I could publish the results to the "Test and coverage" section in the pipeline result summary, which would make the output more accesible a/o user friendly.

Describe alternatives you've considered

The alternative is to scan the code with SonarQube. SonarQube provides a Azure DevOps task to publish the report to the pipeline result summary.

Additional context

na
@LINKIT-HIVE LINKIT-HIVE added status:new This issue needs to be reviewed type:feature Feature request labels Oct 13, 2023
@agateau-gg
Copy link
Collaborator

Hi, thanks for your report!

Our JSON format indeed lacks documentation. We plan to work on fixing that.

I am not convinced by unit-test oriented file formats because I would expect a bit of impedance mismatch to map ggshield output to these formats. I think SARIF would be a better fit, since it's been designed from the beginning for static analysis tools. It's JSON, not XML, but it is a standard format, supported by Azure DevOps and other tools. What do you think?

@LINKIT-HIVE
Copy link
Author

LINKIT-HIVE commented Oct 19, 2023 via email •
edited

@agateau-gg
Copy link
Collaborator

Normally our scan and/or test results are collected and published in Azure DevOps like shown in the picture below.

There are no pictures in your message. I think GitHub discarded them.

@LINKIT-HIVE
Copy link
Author

LINKIT-HIVE commented Oct 19, 2023 via email

@agateau-gg
Copy link
Collaborator

Another try..

Still no picture 😞. I think you need to use the web interface to attach them.

@LINKIT-HIVE
Copy link
Author

1

and

2

@agateau-gg
Copy link
Collaborator

Thanks for the pictures, I can see them now.

I still believe there is more value in adding SARIF support than in shoehorning ggshield outputs in a unit-test output format. It is not clear to me how to turn a found secret or an IaC rule violation into a failed test.

Since Microsoft is one of of the creators of SARIF I think it's safe to assume the Azure extension is going to be correctly supported.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
status:new This issue needs to be reviewed type:feature Feature request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@LINKIT-HIVE @agateau-gg