search

mercedes-benz / sechub

SecHub provides a central API to test software with different security tools.
https://mercedes-benz.github.io/sechub/
MIT License
259 stars 58 forks source link

Add SecHub report to the build-summary #2685

Open sarunasr opened 7 months ago

sarunasr commented 7 months ago

Hello, I'm currently using this action to scan my repositories (https://github.com/mercedes-benz/sechub/tree/develop/github-actions/scan), but I'd like to see a report in the build summary (https://github.blog/2022-05-09-supercharging-github-actions-with-job-summaries/) instead of artifacts, is that possible?

de-jcup commented 7 months ago

With #2441 / PR #2448 there will be multiple changes done for the SecHub github action implementation. Maybe It is possible to implement your feature request after this has been done.

But what exactly should such a report look like? Shall it be

  1. a table containing an overview of the reports - in this case you would still need the artifact. Or would you like to have
  2. something like the HTML report but as a markdown variant inside the build?
sarunasr commented 7 months ago

Hello @de-jcup The second option would be great, but if it's difficult to create, I think the first option (work summary + artifact) would be enough, we could download the html for more details.

sarunasr commented 7 months ago

Hello @de-jcup I saw this pull request: https://github.com/mercedes-benz/sechub/pull/2580 I want to ask you which branch/tag we should use in production? I saw this action in the documentation: - uses: mercedes-benz/sechub/github-actions/scan@72a27282da80952e6fadcef452c6a9085971c688 However, using this action I still get warnings about node12, I saw that changes were made in the develop branch, so I changed the step to: - uses: mercedes-benz/sechub/github-actions/scan@develop and the warning is gone. So what action should I use in production? Maybe there is another one?