feat: Scan code for security issues #90
Conversation
ptiurin
force-pushed
the
feat_security_scan
branch
from
b132509 to
33e2596
Compare
stepansergeevitch
left a comment
stepansergeevitch
left a comment
There was a problem hiding this comment.
Overall LGTM.
One issue is that currently sonar cloud seems to fail because of no coverage.
I assume that we would not provide coverage soon
Is it possible to disable the coverage check so it passes?
|
Also, it seems like FOSSA fails with an exception |
Unfortunately no, sonarqube/cloud does not let us disable the check. It's annoying, but we might need to ignore this check ourselves or re-visit a way to provide coverage information. |
Followed up on IM: Fossa decoration is not working for some reason. I've added the next recommended thing - fossa-test that fails the PR if issues are found. This is not the build itself, it's FOSSA finding problems (which we'll address shortly). |
|
In fact, both issues Fossa has found are false-positives. I didn't resolve them in order to provide an indication what will happen if such issues are found. |
|
SonarCloud Quality Gate failed. |
Adding security scan GH action. It's supposed to be run manually on a PR, at the same time as the integration tests. It also runs automatically on merge to master.
Using pipenv to build the project in order for Fossa to pick deep dependencies according to the docs.