-
Notifications
You must be signed in to change notification settings - Fork 80
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Output SonarQube reports #15
Comments
Hi @cynthiabaran, First of all, I would like to thank you for opening this issue! Thx! |
I actually did it 3 days ago, but one day later you guys released v2 😅 You okay with my suggestion for the naming convention of the rules' ids? |
Hey @cynthiabaran What do you think guys @hermescanutodesouza @bieeldeveloper @GouveaHeitor |
Another issue worth discussing is the name of the SonarQube report. I just noticed that in v2 you've added a timestamp to the name of the report file. That's kind of an issue when adding this tool to automatic CI pipelines, since it requires extra work for the pipeline script to figure out the name of the report to send to SonarQube. Off the top of my head, I think we could output a fixed filename such as Any thoughts? |
Hi @cynthiabaran , really sorry for delay. About the timestamps on report, the insider have a About the sonarqube report, I think that we should create a new flag |
Describe the solution you'd like
Insider could generate a SonarQube-compatible report, which should have this format. To achieve this, we will need to assign an unique ID for each rule.
Describe alternatives you've considered
Let every rule id have the prefix "insider", and the suffix composed of an abbreviation of the language and an integer, for example,
INSIDER-JS1
.Additional context
Other SAST tools, such as GoSec, already have this feature. The id of GoSec rules follows the pattern
G101
The text was updated successfully, but these errors were encountered: