Repository navigation
ci: add Mend scan workflow for releases - #862
Merged
Merged
Conversation
|
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
View your CI Pipeline Execution ↗ for commit 5cbd7cc
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗ ☁️ Nx Cloud last updated this comment at |
![nx-cloud[bot]](https://avatars.githubusercontent.com/in/80458?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
ancheetah
force-pushed
the
SDKS-5468-mend-scan
branch
from
October 13, 2026 15:52
168920f to
bec2840
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
ancheetah
force-pushed
the
SDKS-5468-mend-scan
branch
4 times, most recently
from
October 13, 2026 16:03
4f7db53 to
c66ce45
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
ancheetah
force-pushed
the
SDKS-5468-mend-scan
branch
from
October 13, 2026 16:11
c66ce45 to
27889dc
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
ryanbas21
approved these changes
Oct 15, 2026
ryanbas21
left a comment
ryanbas21
left a comment
Collaborator
There was a problem hiding this comment.
Overall if it works i'm happy, just left one comment regarding an env block instead of inline possibly.
Comment on lines
+32
to
+43
| export MEND_SAST_TOTAL_VULNERABILITIES_COUNT=$(jq '.[0].stats.totalVulnerabilities' ${{ inputs.MEND_SAST_REPORT_NAME }}.json) | ||
| export MEND_SAST_CRITICAL_COUNT=$(jq '.[0].stats.critical' ${{ inputs.MEND_SAST_REPORT_NAME }}.json) | ||
| export MEND_SAST_HIGH_COUNT=$(jq '.[0].stats.high' ${{ inputs.MEND_SAST_REPORT_NAME }}.json) | ||
| export MEND_SAST_MEDIUM_COUNT=$(jq '.[0].stats.medium' ${{ inputs.MEND_SAST_REPORT_NAME }}.json) | ||
| export MEND_SAST_LOW_COUNT=$(jq '.[0].stats.low' ${{ inputs.MEND_SAST_REPORT_NAME }}.json) | ||
| export MEND_SAST_SCAN_URL=$(grep -Eo '(http|https)://saas\.whitesourcesoftware\.com[^ ]+' ${{ inputs.MEND_SAST_REPORT_NAME }}.txt | head -n 1) | ||
| echo "MEND_SAST_TOTAL_VULNERABILITIES_COUNT=$MEND_SAST_TOTAL_VULNERABILITIES_COUNT" >> $GITHUB_ENV | ||
| echo "MEND_SAST_CRITICAL_COUNT=$MEND_SAST_CRITICAL_COUNT" >> $GITHUB_ENV | ||
| echo "MEND_SAST_HIGH_COUNT=$MEND_SAST_HIGH_COUNT" >> $GITHUB_ENV | ||
| echo "MEND_SAST_MEDIUM_COUNT=$MEND_SAST_MEDIUM_COUNT" >> $GITHUB_ENV | ||
| echo "MEND_SAST_LOW_COUNT=$MEND_SAST_LOW_COUNT" >> $GITHUB_ENV | ||
| echo "MEND_SAST_SCAN_URL=$MEND_SAST_SCAN_URL" >> $GITHUB_ENV |
Collaborator
There was a problem hiding this comment.
This is fine - but perhaps brittle, couldn't we do this in an env: block?
Collaborator
Author
There was a problem hiding this comment.
Is that possible? I think you need to use bash to do this. This reads from the report json and stores those values in variables on the gh environment. I thought the env: block was intended for static values or reading from GH defined inputs or secrets or vars.
ancheetah
marked this pull request as draft
October 15, 2026 20:26
ancheetah
force-pushed
the
SDKS-5468-mend-scan
branch
3 times, most recently
from
October 15, 2026 20:59
be0aaf5 to
aa54510
Compare
@forgerock/davinci-client
@forgerock/device-client
@forgerock/journey-client
@forgerock/oidc-client
@forgerock/protect
@forgerock/recognize
@forgerock/sdk-types
@forgerock/sdk-utilities
@forgerock/iframe-manager
@forgerock/sdk-logger
@forgerock/sdk-oidc
@forgerock/sdk-request-middleware
@forgerock/storage
commit: |
Contributor
|
Deployed 066da8e to https://ForgeRock.github.io/ping-javascript-sdk/pr-862/066da8e5628adad283f173d0a16b042dc1c018f8 branch gh-pages in ForgeRock/ping-javascript-sdk |
Contributor
Interface Mapping Out of DateThe Drift reportTo fix, run: pnpm mapping:generateThen commit the updated |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #862 +/- ##
===========================================
+ Coverage 18.07% 96.29% +78.22%
===========================================
Files 155 1 -154
Lines 24398 81 -24317
Branches 1203 17 -1186
===========================================
- Hits 4410 78 -4332
+ Misses 19988 3 -19985 🚀 New features to boost your workflow:
|
Contributor
📦 Bundle Size Analysis📦 Bundle Size Analysis🚨 Significant Changes🔻 @forgerock/journey-client - 0.0 KB (-95.4 KB, -100.0%) ➖ No Changes➖ @forgerock/recognize - 5605.5 KB 15 packages analyzed • Baseline from latest Legend🆕 New package ℹ️ How bundle sizes are calculated
🔄 Updated automatically on each push to this PR |
ancheetah
force-pushed
the
SDKS-5468-mend-scan
branch
6 times, most recently
from
October 16, 2026 13:49
787d29f to
f37efe8
Compare
ancheetah
force-pushed
the
SDKS-5468-mend-scan
branch
4 times, most recently
from
October 16, 2026 14:53
409006b to
f365d1f
Compare
ancheetah
commented
Oct 16, 2026
| MEND_URL: ${{ inputs.MEND_SERVER_URL }} | ||
| MEND_SAST_PATH_EXCLUSIONS: '/node_modules/,/dist/,/coverage/,/out-tsc/,/temp/' | ||
| shell: bash | ||
| run: mend code --dir ${{ inputs.scan_dir }} --scope 'Mobile//unified-sdk-javascript' --retries 2 --non-interactive --report --filename ${{ inputs.MEND_SAST_REPORT_NAME }} --formats json --name ${{ inputs.MEND_SAST_REPORT_NAME }}_$(date +%s) > ${{ inputs.MEND_SAST_REPORT_NAME }}.txt |
Collaborator
Author
There was a problem hiding this comment.
We can hide the scope in a GitHub secret or var if it's a concern but I don't really think this is sensitive information.
ancheetah
commented
Oct 16, 2026
| echo '```' >> $GITHUB_STEP_SUMMARY | ||
| echo "</details>" >> $GITHUB_STEP_SUMMARY | ||
|
|
||
| # Step 1: Decide Check Conclusion |
Collaborator
Author
There was a problem hiding this comment.
Leaving these "Check" steps in case we decide to run this as part of PR CI in the future. This tells Github to mark the Mend scan check with a green checkmark (success) or red X (failure) next to the commit hash.
ancheetah
marked this pull request as ready for review
October 16, 2026 19:32
ancheetah
force-pushed
the
SDKS-5468-mend-scan
branch
5 times, most recently
from
October 20, 2026 17:58
425fddb to
30aa269
Compare
ancheetah
force-pushed
the
SDKS-5468-mend-scan
branch
from
October 20, 2026 18:30
30aa269 to
ec5892f
Compare
ancheetah
commented
Oct 20, 2026
Collaborator
Author
There was a problem hiding this comment.
This runs the steps in the order we specify them instead of alphabetically
ancheetah
marked this pull request as draft
October 21, 2026 14:17
Contributor
There was a problem hiding this comment.
Nx Cloud has identified a flaky task in your failed CI:
🔂 Since the failure was identified as flaky, we triggered a CI rerun by adding an empty commit to this branch.
🎓 Learn more about Self-Healing CI on nx.dev
ancheetah
marked this pull request as ready for review
October 21, 2026 14:57
ryanbas21
approved these changes
Oct 21, 2026
ryanbas21
left a comment
ryanbas21
left a comment
Collaborator
There was a problem hiding this comment.
approved pending us running this scan off a branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JIRA Ticket
https://pingidentity.atlassian.net/browse/SDKS-5468
Description
packages/directory to generate security reports for releasesSample report:
https://github.com/ForgeRock/ping-javascript-sdk/actions/runs/39470642163?pr=862