Retitle the report and drop the report and artifact ids
The report now covers every finding from all tools, so "SAST/SCA Report" undersold it. The report and artifact ids were never filled in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
1 parent
2e2ab63232
commit
5959d9364b
3 files changed
+5
-7
No files matched your search
@@ -96,7 +96,7 @@ vectors by `persistent_storage.utils.cvss_utils`.
|
|||||||
### What it cannot fill in
|
### What it cannot fill in
|
||||||
|
|
||||||
A field the artifacts do not answer is written as `<xxx>`, never guessed or quietly dropped. Today
|
A field the artifacts do not answer is written as `<xxx>`, never guessed or quietly dropped. Today
|
||||||
that is the report and artifact ids, the manufacturer, the analysed lines of code, the language
|
that is the manufacturer, the analysed lines of code, the language
|
||||||
breakdown, and the tools and profile of each pipeline stage — the metadata records that a stage ran
|
breakdown, and the tools and profile of each pipeline stage — the metadata records that a stage ran
|
||||||
and how long it took, not what it ran.
|
and how long it took, not what it ran.
|
||||||
|
|
||||||
|
|||||||
@@ -25,6 +25,8 @@ from typing import TYPE_CHECKING, Any
|
|||||||
from .vendor.cipherverifier.core.services.sarif import summarize_sarif
|
from .vendor.cipherverifier.core.services.sarif import summarize_sarif
|
||||||
from .vendor.cipherverifier.core.services.vdr import summarize_vdr
|
from .vendor.cipherverifier.core.services.vdr import summarize_vdr
|
||||||
|
|
||||||
|
from .layout import TITLE
|
||||||
|
|
||||||
if TYPE_CHECKING:
|
if TYPE_CHECKING:
|
||||||
from .vendor.cipherverifier.core.services.sarif import Finding, SarifReport
|
from .vendor.cipherverifier.core.services.sarif import Finding, SarifReport
|
||||||
from .vendor.cipherverifier.core.services.vdr import VdrReport, Vulnerability
|
from .vendor.cipherverifier.core.services.vdr import VdrReport, Vulnerability
|
||||||
@@ -161,13 +163,9 @@ def _cover(
|
|||||||
"subject": _stated(configuration.get("repository_name")),
|
"subject": _stated(configuration.get("repository_name")),
|
||||||
"footer_date": datetime.now(UTC).strftime("%d %B %Y"),
|
"footer_date": datetime.now(UTC).strftime("%d %B %Y"),
|
||||||
"logo": "cc_logo.png",
|
"logo": "cc_logo.png",
|
||||||
"title": "SAST/SCA Report",
|
"title": TITLE,
|
||||||
"identity": [
|
"identity": [
|
||||||
_fact("Scan Identifier", sources.scan_id, kind="mono"),
|
_fact("Scan Identifier", sources.scan_id, kind="mono"),
|
||||||
# Neither exists in the store today: a scan has artifacts, and a report of it is not
|
|
||||||
# itself recorded as one.
|
|
||||||
_fact("Report ID", None, kind="mono"),
|
|
||||||
_fact("Artifact ID", None, kind="mono"),
|
|
||||||
_fact("Technology", ", ".join(technologies) or None),
|
_fact("Technology", ", ".join(technologies) or None),
|
||||||
_fact("Project", configuration.get("repository_name"), gap=True),
|
_fact("Project", configuration.get("repository_name"), gap=True),
|
||||||
_fact("Version", configuration.get("repository_version")),
|
_fact("Version", configuration.get("repository_version")),
|
||||||
|
|||||||
@@ -23,7 +23,7 @@ TEMPLATE_NAME = "report.html.j2"
|
|||||||
STYLESHEET = TEMPLATE_DIR / "report.css"
|
STYLESHEET = TEMPLATE_DIR / "report.css"
|
||||||
|
|
||||||
# What the document calls itself, in the PDF's own metadata rather than only on its first page.
|
# What the document calls itself, in the PDF's own metadata rather than only on its first page.
|
||||||
TITLE = "SAST/SCA Report"
|
TITLE = "Complete Security Findings Report"
|
||||||
|
|
||||||
AUTHOR = "CipherCell"
|
AUTHOR = "CipherCell"
|
||||||
|
|
||||||
|
|||||||
Reference in new issue
Block a user