Configure Mend Bolt for GitHub#9
Conversation
📝 WalkthroughThis PR introduces a new The configuration enables automated scanning with failure conditions when vulnerabilities are detected, making it an important addition to the CI/CD pipeline. While the configuration is functional, there are a few minor improvements that could be made to optimize its effectiveness and reduce potential noise from low-severity alerts. 📊 Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
title Mend Security Scanning Process Flow
actor Developer
participant GitRepo as "Git Repository"
participant CI as "CI/CD Pipeline"
participant MendScanner as "Mend Scanner"
participant MendAPI as "Mend API"
participant CheckRun as "GitHub Check Run"
participant PRView as "PR Diff View"
Developer->>GitRepo: Create/Update PR
GitRepo->>CI: Trigger CI workflow
CI->>MendScanner: Start security scan
Note over MendScanner: Using configuration:
Note over MendScanner: - Empty baseBranches
Note over MendScanner: - Failure on vulnerabilities
Note over MendScanner: - Diff display mode
Note over MendScanner: - Custom Mend check names
MendScanner->>MendScanner: Scan dependencies
alt Vulnerabilities found
MendScanner->>MendAPI: Report vulnerabilities
Note over MendAPI: Filter issues based on:
Note over MendAPI: - Min severity: LOW
Note over MendAPI: - Issue type: DEPENDENCY
MendAPI->>CheckRun: Create check run with "failure" conclusion
CheckRun-->>PRView: Display vulnerabilities in diff view
PRView-->>Developer: Show security findings
else No vulnerabilities
MendScanner->>MendAPI: Report clean scan
MendAPI->>CheckRun: Create check run with "success" conclusion
CheckRun-->>PRView: Display success status
PRView-->>Developer: Show PR is safe to merge
end
🔒 Security Analysis
Caution 1 comment is outside the diff range and can't be posted inline due to platform limitations.
|
![entelligence-ai-pr-reviews[bot]](https://avatars.githubusercontent.com/in/932812?s=60&v=4){kind=small}
| @@ -0,0 +1,14 @@ | |||
| { | |||
| "scanSettings": { | |||
| "baseBranches": [] | |||
There was a problem hiding this comment.
Correctness: The baseBranches array is empty which means Mend will use default branch scanning behavior instead of explicitly specifying which branches to scan
📝 Committable Code Suggestion
‼️ Ensure you review the code suggestion before committing it to the branch. Make sure it replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| "baseBranches": [] | |
| { | |
| "scanSettings": { | |
| "baseBranches": ["master", "main"], | |
| "configMode": "AUTO" | |
| }, | |
| "checkRunSettings": { | |
| "vulnerableCheckRunConclusionLevel": "failure", | |
| "displayMode": "diff", | |
| "useMendCheckNames": true | |
| }, | |
| "issueSettings": { | |
| "minSeverityLevel": "MEDIUM", | |
| "issueType": "DEPENDENCY" | |
| } | |
| } | |
| "useMendCheckNames": true | ||
| }, | ||
| "issueSettings": { | ||
| "minSeverityLevel": "LOW", |
There was a problem hiding this comment.
Performance: The minSeverityLevel is set to "LOW" which will report all vulnerabilities including low-severity ones, potentially creating noise
📝 Committable Code Suggestion
‼️ Ensure you review the code suggestion before committing it to the branch. Make sure it replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| "minSeverityLevel": "LOW", | |
| { | |
| "scanSettings": { | |
| "baseBranches": [] | |
| }, | |
| "checkRunSettings": { | |
| "vulnerableCheckRunConclusionLevel": "failure", | |
| "displayMode": "diff", | |
| "useMendCheckNames": true | |
| }, | |
| "issueSettings": { | |
| "minSeverityLevel": "MEDIUM", | |
| "issueType": "DEPENDENCY" | |
| } | |
| } | |
| { | ||
| "scanSettings": { | ||
| "baseBranches": [] | ||
| }, | ||
| "checkRunSettings": { | ||
| "vulnerableCheckRunConclusionLevel": "failure", | ||
| "displayMode": "diff", | ||
| "useMendCheckNames": true | ||
| }, | ||
| "issueSettings": { | ||
| "minSeverityLevel": "LOW", | ||
| "issueType": "DEPENDENCY" | ||
| } | ||
| } No newline at end of file |
There was a problem hiding this comment.
Correctness: Missing configMode setting to explicitly control scan behavior
📝 Committable Code Suggestion
‼️ Ensure you review the code suggestion before committing it to the branch. Make sure it replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| { | |
| "scanSettings": { | |
| "baseBranches": [] | |
| }, | |
| "checkRunSettings": { | |
| "vulnerableCheckRunConclusionLevel": "failure", | |
| "displayMode": "diff", | |
| "useMendCheckNames": true | |
| }, | |
| "issueSettings": { | |
| "minSeverityLevel": "LOW", | |
| "issueType": "DEPENDENCY" | |
| } | |
| } | |
| { | |
| "scanSettings": { | |
| "baseBranches": [], | |
| "configMode": "AUTO" | |
| }, | |
| "checkRunSettings": { | |
| "vulnerableCheckRunConclusionLevel": "failure", | |
| "displayMode": "diff", | |
| "useMendCheckNames": true | |
| }, | |
| "issueSettings": { | |
| "minSeverityLevel": "MEDIUM", | |
| "issueType": "DEPENDENCY" | |
| } | |
| } | |
| }, | ||
| "issueSettings": { | ||
| "minSeverityLevel": "LOW", | ||
| "issueType": "DEPENDENCY" |
There was a problem hiding this comment.
Correctness: Only "DEPENDENCY" issues are configured, consider adding "LICENSE" or "POLICY" if relevant to project needs
Welcome to Mend Bolt for GitHub (formerly WhiteSource). This is an onboarding PR to help you understand and configure settings before Mend starts scanning your repository for security vulnerabilities.
🚦 Mend Bolt for GitHub will start scanning your repository only once you merge this Pull Request. To disable Mend Bolt for GitHub, simply close this Pull Request.
What to Expect
This PR contains a '.whitesource' configuration file which can be customized to your needs. If no changes were applied to this file, Mend Bolt for GitHub will use the default configuration.
Before merging this PR, Make sure the Issues tab is enabled. Once you merge this PR, Mend Bolt for GitHub will scan your repository and create a GitHub Issue for every vulnerability detected in your repository.
If you do not want a GitHub Issue to be created for each detected vulnerability, you can edit the '.whitesource' file and set the 'minSeverityLevel' parameter to 'NONE'.
❓ Got questions? Check out Mend Bolt for GitHub docs.
If you need any further assistance then you can also request help here.
EntelligenceAI PR Summary
Added Mend (formerly WhiteSource) security scanning configuration via a new
.whitesourcefile to enable automated vulnerability detection in dependencies, license compliance monitoring, and supply chain security.