search

microsoft / security-devops-azdevops

Microsoft Security DevOps extension for Azure DevOps.
MIT License
60 stars 16 forks source link

[Q] How to configure suppressions file for CredScanner and use it? #48

Closed VolodymyrMolodets closed 1 year ago

VolodymyrMolodets commented 1 year ago

Previously when using the Microsoft Security Code Analysis (MSCA) extension there was an option to specify the suppressions file path. What would be the right way to use suppressions files in the Microsoft Security DevOps extension?

Unfortunately, the documentation over here https://github.com/microsoft/security-devops-action/wiki#how-to-configure-analyzers does not provide any examples.

This one https://learn.microsoft.com/en-us/azure/defender-for-cloud/detect-exposed-secrets#suppress-false-positives only suggests adding inline suppressions, but that's not a scalable and maintainable solution.

Looking forward for your suggestions.

chrisnielsen-MS commented 1 year ago

Hi! We plan to release a better user experience for this in an upcoming release, but for now you can configure this by following the instructions in this reply to another issue: https://github.com/microsoft/security-devops-azdevops/issues/38#issuecomment-1509461347

VolodymyrMolodets commented 1 year ago

Hi! We plan to release a better user experience for this in an upcoming release, but for now you can configure this by following the instructions in this reply to another issue: #38 (comment)

@chrisnielsen-MS Is there a place where this is gonna be published so I can check periodically or even get notified?