Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature/add tool ggshield Parser #7083

Merged
merged 2 commits into from
Nov 19, 2022
Merged

Feature/add tool ggshield Parser #7083

merged 2 commits into from
Nov 19, 2022

Conversation

iamnihal
Copy link
Contributor

@iamnihal iamnihal commented Nov 8, 2022

This PR will add ggshield (https://github.com/GitGuardian/ggshield) secret scanner JSON Report as a new scanner/importer.

Copy link
Contributor

@Maffooch Maffooch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good to me
@damiencarol what do you think?

@Gby56
Copy link
Contributor

Gby56 commented Nov 16, 2022

@iamnihal Hello ! Cool idea to add ggshield, is this intended for use with the pre-commit hook ? Do you think we could add an example in the docs, how to reconfigure the pre-commit to upload the results to a Defectdojo instance ?

I think ggshield isn't reporting the issues found via the gitguardian API, so we don't really get reporting through it, defectdojo could be a temporary solution. GitGuardian/ggshield#421 I have reported the problem to GGuardian

@damiencarol damiencarol merged commit 17d3ad3 into DefectDojo:dev Nov 19, 2022
@iamnihal
Copy link
Contributor Author

Hello @Gby56!!
This PR is not intended to be used with the pre-commit hook as ggshield currently doesn't provide the scan's output in pre-commit scan mode and hence in this case it's not possible to integrate ggshield with Defectdojo. However, pre-push hook scan mode supports JSON output.

Yes, ggshield is not reporting when used via Gitguadian API. Thank you @Gby56, for raising the issue in ggshield. If they add a feature to provide the scan's output in the pre-commit scan mode, then we can think of integrating Defectdojo with ggshield (in the pre-commit hook).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants