-
Notifications
You must be signed in to change notification settings - Fork 309
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
upload-sarif@v2 Doesn't support suppressions
property in Sarif files.
#1230
Comments
Thank you for your question! There are currently no concrete plans for adding support for alert suppression comments to CodeQL and Code Scanning. However, we are continually reevaluating the need for this feature, especially seeing as it has some benefits over dismissing alerts through the Code Scanning UI. Your comment has been added (as a point in favour of adding support for this) to our internal tracking of this matter. |
@tausbn That's very surprising to hear. Please also add my vote for supporting suppressions, it is very useful to be able to document and communicate suppressions in code. You can see an example of that at https://github.com/Starkast/wikimum/blob/49b0656dc593e387377390cd475c8423bff254eb/config/brakeman.ignore. |
I've recently noticed, when running
semgrep
, that findings that are suppressed in code with#nosemgrep
flag the results with asuppressions
property. This seems to be valid sarif formatting.Example of a result:
When results like this are uploaded via the
github/codeql-action/upload-sarif@v2
the results are still propagated as-if valid findings.Shouldn't these be ignored, or flagged in some other way?
The text was updated successfully, but these errors were encountered: