feat: GitLab CI integration with SARIF output for Security Dashboard#43
Open
apex-cl wants to merge 1 commit intocounterspec:mainfrom
Open
feat: GitLab CI integration with SARIF output for Security Dashboard#43apex-cl wants to merge 1 commit intocounterspec:mainfrom
apex-cl wants to merge 1 commit intocounterspec:mainfrom
Conversation
Adds GitLab CI/CD pipeline integration for the ISNAD Scanner with SARIF (Static Analysis Results Interchange Format) output compatible with GitLab Security Dashboard and GitHub Code Scanning. Changes: - Add SARIF export module (scanner/src/sarif.ts) - analysisResultToSarif() converts scan results to SARIF 2.1.0 format - Maps severity levels: critical/high->error, medium->warning, low->note - Includes artifact locations, line numbers, code snippets, and rules - Extend CLI with --sarif-output flag (scanner/src/cli.ts) - batch command now supports --sarif-output <path> option - Combines results from multiple files into a single SARIF report - Report appears in GitLab MR widget under Security tab - Add .gitlab-ci.yml template - Ready-to-use pipeline with configurable SCAN_TARGETS and SCAN_FAIL_LEVEL - SARIF artifact uploaded for GitLab SAST reports - Runs on push, MR, and scheduled pipelines - Add .gitlab-ci-templates.yml with advanced templates - Auto-issue creation on critical findings via GitLab API - Add documentation (docs/GITLAB_CI.md) - Quick start guide, configuration reference, and pipeline examples - Add unit tests for SARIF export (scanner/tests/sarif.test.ts) - Tests rule generation, severity mapping, and JSON serialization Fixes: counterspec#5
|
@apex-cl is attempting to deploy a commit to the Rapi's projects Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the GitLab CI/CD integration with SARIF output support for the ISNAD Scanner.
This resolves Issue #5: GitLab CI integration template
What's Included
1. SARIF Export Module (
scanner/src/sarif.ts)analysisResultToSarif()— Converts scan results to SARIF 2.1.0 format2. CLI Enhancement (
scanner/src/cli.ts)--sarif-output <path>flag on thebatchcommand3. GitLab CI Pipeline (
.gitlab-ci.yml)SCAN_TARGETS— Directories/files to scanSCAN_FAIL_LEVEL— Pipeline fail threshold (critical/high/medium/low)ISNAD_SCANNER_VERSION— Scanner version to use4. Advanced Templates (
.gitlab-ci-templates.yml)5. Documentation (
docs/GITLAB_CI.md)6. Unit Tests (
scanner/tests/sarif.test.ts)Checklist
.gitlab-ci.ymltemplate for isnad-scannpm run build)Testing
Built and tested locally:
All 8 unit tests pass for SARIF export module. SARIF output validates against the official 2.1.0 schema.