Mucha dev gitlab security output #147
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ing report output Adds support for generating GitLab-compatible Dependency Scanning reports that integrate with GitLab's Security Dashboard. This feature enables Socket security findings to be displayed natively in GitLab merge requests and security dashboards. Key Features: - New --enable-gitlab-security flag to generate GitLab reports - New --gitlab-security-file flag for custom output paths (default: gl-dependency-scanning-report.json) - Generates GitLab Dependency Scanning schema v15.0.0 compliant reports - Supports multiple simultaneous output formats (JSON, SARIF, GitLab) - Includes actionable security alerts (error/warn level) in vulnerability reports - Maps Socket severity levels to GitLab severity (Critical, High, Medium, Low) - Extracts CVE identifiers and dependency chain information - Generates deterministic UUIDs for vulnerability tracking Implementation: - Added GitLab report generator in messages.py with helper functions for severity mapping, identifier extraction, and location parsing - Refactored OutputHandler to support multiple simultaneous output formats - Added comprehensive unit tests (test_gitlab_format.py) and integration tests - Updated documentation with usage examples, CI/CD integration guide, and alert filtering details Co-Authored-By: Claude Sonnet 4.5 <[email protected]>
|
❌ Version Check Failed Please increment... |
|
🚀 Preview package published! Install with: pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.2.63.dev2Docker image: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds GitLab Security Dashboard integration with Dependency Scanning report output.
Socket CLI can now generate GitLab-compatible security reports that display
vulnerability findings directly in GitLab's native Security Dashboard and merge
request security widgets.
Why?
This feature enables Socket users to leverage GitLab's built-in Security Dashboard
for centralized vulnerability tracking and compliance reporting. Key benefits:
Security Dashboard, merge request security tabs, and vulnerability reports without
requiring external tools
support security audits and compliance requirements
view Socket findings alongside other security scanners
rules for merge requests
App - the App provides real-time PR comments and blocking, while Security
Dashboard reports provide centralized tracking and historical analysis
The implementation includes:
gl-dependency-scanning-report.json)
and remediation suggestions
Public Changelog
New Feature: GitLab Security Dashboard Integration
Socket CLI now supports generating GitLab-compatible Dependency Scanning reports
that integrate with GitLab's Security Dashboard. Enable with
--enable-gitlab-security to display Socket vulnerability findings directly in
GitLab merge requests and security dashboards.
Features:
v15.0.0
interface
guidance
Usage:
socketcli --enable-gitlab-security --repo owner/repo
See documentation for GitLab CI/CD integration examples and configuration options.