Webhooks access and permissions for triage by comment#2453
Webhooks access and permissions for triage by comment#2453armchairlinguist wants to merge 20 commits intomainfrom
Conversation
✅ Deploy Preview for semgrep-docs-prod ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
armchairlinguist
changed the title
|
@armchairlinguist I took the work you started and expanded it. I did reconsider updating the SMS snippets for reuse here, but I was afraid that the permissions required for these two features would diverge, so I did not. Perhaps we’ll decide to standardize the requirements for features that require code access, and at that point, we could revisit the use of snippets. You'll also notice that I introduced a bit of redundancy -- because the user already has to go to so many places, I opted to include all of the instructions required in the Triage through PR comments section to minimize the need switch to other pages. I also cleaned up the dataflow traces information so that these pages no longer display irrelevant details. Let me know what you think; I'd be happy to change anything or even go back to the drawing board if you think these changes hurt more than they help! |
|
@khorne3 I think this is the way to go for now. I don't love how long the pages are with it, but partly that's just because the whole process is more complex than it ought to be, not a problem with the docs. I did notice a few things when I was re-reading:
|
|
To be explicit - I can take that stuff on if you like, other than the wording which I think we should decide mutually, or I'm happy for you to continue. |
|
@armchairlinguist Sorry for the delay -- my email dumped all my GitHub notifications into spam (I was wondering why things were so quiet). Because we use If you have time, feel free to continue. Otherwise, I'll pick this up near the end of next week when I'm done with release notes! |
|
Picking up work on this again! |
armchairlinguist
force-pushed
the
armchairlinguist/triage-by-comment-support
branch
from
94ba39f to
5296895
Compare
khorne3
left a comment
khorne3
left a comment
There was a problem hiding this comment.
Just some minor things -- thank you!
docs/semgrep-appsec-platform/bitbucket-data-center-pr-comments.md
Outdated
Show resolved
Hide resolved
thanks for fixing my derps Co-authored-by: Katie Horne <katie.horne@semgrep.com>
| @@ -23,17 +23,17 @@ | |||
| | - | - | | |||
| | Azure DevOps Cloud | <ul><li>Query console</li><li>Auto PRs for Supply Chain findings</li></ul> | | |||
| | Azure DevOps Server | <ul><li>Semgrep Assistant</li><li>Semgrep Managed Scans</li><li>Pull request comments</li><li>Query console</li><li>Diff-aware scans</li><li>Sending findings to Semgrep AppSec Platform</li><li>Default branch identification</li><li>Auto PRs for Supply Chain findings</li><li>Generic secrets (requires Semgrep Assistant)</li></ul> | | |||
There was a problem hiding this comment.
Not a part of this work but are sending findings to the platform and diff scans really unsupported on ado server? As far as I know git repos should be supported (and have been the default for some time) -- tfvc repos would be unsupported.
|
|
||
| #### Triage through PR comments | ||
|
|
||
| Developers can triage Semgrep findings without leaving Azure DevOps by responding to the PR comments authored by Semgrep. To turn this feature on, you must update your source code manager (SCM) connection to use a personal access token that grants **Full Access**. This is because Semgrep requires webhooks for the triage through PR comments feature. |
There was a problem hiding this comment.
Is Full Access true here? Token scopes can be set pretty granularly on ADO.
|
|
||
| ### Get cross-file findings | ||
|
|
||
| To get cross-file (interfile) findings in your organization, follow the steps in [<i class="fa-regular fa-file-lines"></i> Perform cross-file analysis](/semgrep-code/semgrep-pro-engine-intro). |
There was a problem hiding this comment.
This feels slightly out of place given that we're talking about PR comments and we don't do interfile on diff scans but I feel like the intent is to be complete about what additional settings there are, so I'm torn on it.
There was a problem hiding this comment.
Or perhaps if this is unselected then intrafile doesn't happen either?
| | GitLab Premium | <ul><li>Query console</li><li>Auto PRs for Supply Chain findings</li></ul> | | ||
| | GitLab Ultimate | <ul><li>Query console</li><li>Auto PRs for Supply Chain findings</li></ul> | | ||
| | GitLab Dedicated / Dedicated for Government | <ul><li>Query console</li><li>Auto PRs for Supply Chain findings</li></ul> | | ||
| | GitLab Self-Managed Free | <ul><li>Semgrep Managed Scans*<br /> Query console</li><li>Auto PRs for Supply Chain findings</li></ul> | |
There was a problem hiding this comment.
Also not a part of this PR but happened to notice Query Console isn't showing up as a part of a list but just some text. Look like we're missing some
3 participants
Fixing a few issues where we don't clearly articulate requirements for feature support related to webhooks (particularly GitLab Free).
Fixes https://linear.app/semgrep/issue/TEC-492/ensure-webhooks-requirementssupport-are-properly-documented.
Please ensure
Adding a new documentation page? Click to expand the checklist
.mdor.mdxfile in/docs/[section]/with frontmatter:slug,title,description,displayed_sidebar,tags/sidebars.js(shows in side nav)/src/theme/Navbar/Content/index.tsx→ add path togetCurrentSection()(highlights top nav)Sidebars fields for
displayed_sidebar:scanSidebar|rulewritingSidebar|devSidebar|learnSidebar|aboutSidebar|kbSidebar|whatsSemgrepSidebarTop nav fields for
getCurrentSection():'scan'|'write-rules'|'learning-guides'|'help'|'explore'