Trainee SAST Analyzers Maintainer: Lucas Charles
Basic setup
-
Change this issue title to include your name, project, and maintainer type: Trainee SAST Maintainer: [full name]
. -
Indicate your selected analyzer projects: -
analyzers/bandit
#11685 (comment 802483685) -
analyzers/brakeman
#11685 (comment 859117186) -
analyzers/eslint
#11685 (comment 716544233) -
analyzers/flawfinder
#11685 (comment 859124168) -
analyzers/gosec
#11685 (comment 603408251) -
analyzers/kics
#11685 (comment 859086910) -
analyzers/kubesec
#11685 (comment 641234952) -
analyzers/mobsf
#11685 (comment 662315729) -
analyzers/nodejs-scan
-
analyzers/phpcs-security-audit
-
analyzers/pmd-apex
-
analyzers/secrets
#11685 (comment 926648296) -
analyzers/security-code-scan
-
analyzers/semgrep
#11685 (comment 926633094) -
analyzers/sobelow
#11685 (comment 662335352) -
analyzers/spotbugs
#11685 (comment 641206264)
-
-
Read the code review page in the handbook -
Understand how to become a maintainer -
Understand our Secure Team standards and style guidelines -
Understand our Secure Release Process -
Understand our Secure QA Process -
Create a merge request updating your team member entry) adding yourself as a trainee maintainer -- !82406 (merged) -
Ask your manager to set up a check in on this issue every six weeks or so.
Working towards becoming a maintainer
There is no checklist here, only guidelines. Remember that there is no specific timeline on this.
Your reviews should aim to cover maintainer responsibilities as well as reviewer responsibilities. Your approval means you think it is ready to merge.
After each MR is merged or closed, add a discussion to this issue using this template:
### (Merge request title): (Merge request URL)
During review:
- (List anything of note, or a quick summary. "I suggested/identified/noted...")
Post-review:
- (List anything of note, or a quick summary. "I missed..." or "Merged as-is")
(Maintainer who reviewed this merge request) Please add feedback, and compare
this review to the average maintainer review.
Tip: There are tools available to assist with this task.
When you're ready to make it official
When reviews have accumulated, and recent reviews consistently fulfill maintainer responsibilities, any maintainer can take the next step. The trainee should also feel free to discuss their progress with their manager or any maintainer at any time.
-
Create a merge request updating your team member entry proposing yourself as a maintainer. -
Create a merge request for CODEOWNERS
for the relevant project, adding yourself accordingly, and ask a maintainer to review it. -
Keep reviewing, start merging 🤘 -
Keep reviewing, and helping with merge requests! 🎉 -
Important Read: If you are not currently a backend or frontend maintainer, please assign the merge requests to a maintainer who can merge on your behalf, specifying that it has already been approved by a CI/CD templates maintainer.
🤖
Auto-Summary Discoto Usage
Points
Discussion points are declared by headings, list items, and single lines that start with the text (case-insensitive)
point:
. For example, the following are all valid points:
#### POINT: This is a point
* point: This is a point
+ Point: This is a point
- pOINT: This is a point
point: This is a **point**
Note that any markdown used in the point text will also be propagated into the topic summaries.
Topics
Topics can be stand-alone and contained within an issuable (epic, issue, MR), or can be inline.
Inline topics are defined by creating a new thread (discussion) where the first line of the first comment is a heading that starts with (case-insensitive)
topic:
. For example, the following are all valid topics:
# Topic: Inline discussion topic 1
## TOPIC: **{+A Green, bolded topic+}**
### tOpIc: Another topic
Quick Actions
Action Description /discuss sub-topic TITLE
Create an issue for a sub-topic. Does not work in epics /discuss link ISSUABLE-LINK
Link an issuable as a child of this discussion
Last updated by this job
- TOPIC [semgrep] Bump version to 2 for GitLab config UI support: gitlab-org/security-products/analyzers/semgrep!22 (merged) #11685 (comment 572876722)
- TOPIC [gosec] Update to gosec v2.6.1 : gitlab-org/security-products/analyzers/gosec!87 (merged) #11685 (comment 572887574)
- TOPIC [gosec] Update gosec to 2.5.0: gitlab-org/security-products/analyzers/gosec!80 (merged) #11685 (comment 572888699)
- TOPIC [gosec] Update common: gitlab-org/security-products/analyzers/gosec!79 (merged) #11685 (comment 572890040)
- TOPIC [gosec] cwe-info-go version bump (include CWE-118): gitlab-org/security-products/analyzers/gosec!67 (merged) #11685 (comment 572891336)
- TOPIC [gosec] Update SAST downstream tests to not use DinD: gitlab-org/security-products/analyzers/gosec!52 (merged) #11685 (comment 572893630)
- TOPIC [gosec] Upgrade to securego/gosec:2.0.0: gitlab-org/security-products/analyzers/gosec!16 (merged) #11685 (comment 572904526)
- TOPIC [gosec] Integrate CWE information into gosec reports: gitlab-org/security-products/analyzers/gosec!25 (merged) #11685 (comment 572910832)
- TOPIC [spotbugs] Add downstream test for monorepos gitlab-org/security-products/analyzers/spotbugs!83 (merged) #11685 (comment 641206264)
- TOPIC [kubesec] Initial release of the Kubesec analyzer gitlab-org/security-products/analyzers/kubesec!1 (merged) #11685 (comment 641234952)
- TOPIC [mobsf] Update MobSF to version 3.2.9 gitlab-org/security-products/analyzers/mobsf!15 (merged) #11685 (comment 662315729)
- TOPIC [sobelow] Update debug with a better description of command gitlab-org/security-products/analyzers/sobelow!25 (merged) #11685 (comment 662335352)
- TOPIC [eslint] AUTHOR Use split common packages directly - gitlab-org/security-products/analyzers/eslint!71 (merged) #11685 (comment 716544233)
Discoto Settings
---
summary:
max_items: -1
sort_by: created
sort_direction: ascending
See the settings schema for details.