Comments (3)
Correct. Will add this issue to my list for the week.
from sast-scan.
Still not done with SARIF for staticcheck. Actually, got distracted and trying to build a test tool for testing sast-scan since I am currently check all project types and CI integrations manually :(
But here is a secret. If you create a local .sastscanrc you can override pretty much anything including replacing or including staticcheck in addition to gosec for golang.
https://github.com/AppThreat/sast-scan/blob/master/docs/TRICKS.md#config-file
For the key golang, if the value is a list then it is considered as a single tool. If instead the value is a map (for eg: depscan) then the tool would execute one tool at a time.
So the config for golang would resemble
"golang": {
"gosec": [go sec args],
"staticcheck": [static check args]
}
Let me know if this workaround helps for now.
from sast-scan.
staticcheck is now available with version 1.1.1
tool description critical high medium low status total
----------- ------------------------------- ---------- ------ -------- ----- -------- -------
staticcheck Go static analysis 7 0 0 0 ❌ 7
gosec Golang security checks by gosec 0 0 1 0 ✅ 1
from sast-scan.
Related Issues (20)
- Aggregate all sarif reports into a single jsonlines file HOT 1
- Make build break logic a configurable parameter HOT 1
- Universal suppressions support HOT 1
- Normalise the metrics property HOT 1
- Time to look at open-source dependency scanning HOT 2
- Let's do pull request scanning HOT 2
- It's time to benchmark sast-scan HOT 1
- Support for html view HOT 1
- Improve visual studio integration on Windows
- Unable to find repo details from the local repository HOT 14
- Improve windows experience HOT 1
- AppThreat is joining the ShiftLeft family
- nodejsscan exception: "No such file or directory" HOT 2
- Gitlab-CI integration example HOT 2
- Has the Terraform dropped out ? HOT 2
- the process stop when running 'cdxgen' command HOT 6
- Use uriBaseId to specify root for relative urls HOT 1
- Populate version control details HOT 1
- Populate runAutomationDetails HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sast-scan.