Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configure WhiteSource for github.com #1525

Merged
merged 1 commit into from
Nov 11, 2021
Merged

Conversation

mend-for-github-com[bot]
Copy link
Contributor

Welcome to WhiteSource for github.com! This is an onboarding PR to help you understand and configure settings before WhiteSource starts scanning your repository for security vulnerabilities.

🚦 WhiteSource for github.com will start scanning your repository only once you merge this Pull Request. To disable WhiteSource for github.com, simply close this Pull Request.


What to Expect

This PR contains a '.whitesource' configuration file which can be customized to your needs. If no changes were applied to this file, WhiteSource for github.com will use the default configuration.

Before merging this PR, Make sure the Issues tab is enabled. Once you merge this PR, WhiteSource for github.com will scan your repository and create a GitHub Issue for every vulnerability detected in your repository.

If you do not want a GitHub Issue to be created for each detected vulnerability, you can edit the '.whitesource' file and set the 'minSeverityLevel' parameter to 'NONE'.

If WhiteSource Remediate Workflow Rules are set on your repository (from the WhiteSource 'Integrate' tab), WhiteSource will also generate a fix Pull Request for relevant vulnerabilities.


❓ Got questions? Check out WhiteSource for github.com docs.
If you need any further assistance then you can also request help here.

@opensearch-ci-bot
Copy link
Collaborator

Can one of the admins verify this patch?

@opensearch-ci-bot
Copy link
Collaborator

✅   Gradle Wrapper Validation success 25427bf

@bbarani
Copy link
Member

bbarani commented Nov 10, 2021

Please merge this PR to enable automated scanning using whitesource bot. More info on this file can be found here. You can edit this file based on your needs to add any additional parameters as listed on the above link.

@opensearch-ci-bot
Copy link
Collaborator

✅   Gradle Precommit success 25427bf

"displayMode": "diff"
},
"issueSettings": {
"minSeverityLevel": "LOW"
Copy link
Member

@saratvemulapalli saratvemulapalli Nov 10, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trying to understand, @CEHENKLE /@bbarani looks like the bot opens up issues in public if minServerityLevel is not NONE.
Do we really want all the security vulnerabilities reported publicly ? I would rather have it reported on whitesource dashboard instead of an issue in the open.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Never mind just saw your comment. Makes sense!

@opensearch-ci-bot
Copy link
Collaborator

✅   Gradle Check success 25427bf
Log 1022

Reports 1022

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants