New sarif-issues command to create , close github issue and manage the issues lifecycle #133
Conversation
- extract SARIF location parsing to a dedicated function - simplify title
…ure of github issues
…and ref values from env vars
- create a vcs interface to create an issue comment - github plugin implements create an issue comment method - gitlab and bitbucket implement stubs - create-issues-from-sarif command writes a comment to an issue before closure when a vulnerability is resolved
…ning from repository root
…perlinks for CodeQL and Snyk styles
…update usage examples
…ARIF issues command
… functions for improved path handling in SARIF issue processing
… permalinks and update related usages in SARIF processing
…t to internalsarif package and update usages in SARIF issue processing
… and update tests accordingly
…s to return closed issue count and handle logging improvements
…pdate documentation
…adata enrichment and required parameters validation
- Combined imports from both branches (sarifissues and upload) - Integrated logger initialization from main branch - Added all command initializations with proper logger parameters - Fixed sarifissues.Init call to use correct signature (no logger parameter) - Maintained all command registrations from both branches
…djust function signatures for improved logging
…uns and improve severity handling
japroc
changed the title
|
General comment. There are several single-feature dependencies (see files in Overall, the code looks good to me. We can refactor further as more requirements arrive. I’m already covering part of this in I do have a concern about streaming the list of open issues over RPC. I’m using the same approach for PR comments. Is there any throughput limit where a large list would impact RPC transfer? My understanding is:
hashicorp/go-plugin doesn’t provide automatic chunking. FYI: we should be careful with RPC message sizes. If we approach these limits, migrating the interface to gRPC should be our first step. |
…side - to filter relevant issues by bofy-filter, and don't send not relevant items over RPC - Introduced `BodyFilter` parameter in `VCSListIssuesRequest` to filter issues based on body content. - Implemented `filterIssuesByBody` function to handle substring matching for issue bodies. - Updated `ListIssues` method to apply the body filter if provided, enhancing issue retrieval based on specific criteria. - Added unit tests for body filtering functionality to ensure correct behavior.
Summary
sarif-issuesCLI command that reads SARIF, correlates against existing GitHub issues, and manages issue lifecycleDocumentation
Read sarif-issues reference doc for details:
docs/reference/cmd-sarif-issues.md