Pull request commenting
When a pull request (PR) in a repository is submitted, FortiCNAPP runs scans on both the source and target branches. It compares the results to identify any issues or vulnerabilities which will be introduced into the target branch. If a potential violation is identified, FortiCNAPP will return comments to explain the violation and provide a warning.
PR comments can include information on issues and vulnerabilities related to 3rd Party Vulnerabilities, Internal Code, Hard-coded Secrets, License Risks, and Infrastructure-as-Code (IaC) violations. By expanding the details within the PR comment, you can view information on the Severity, Location, and the affected Secret, Package, Violation, and so on.
PR comments are enabled for both SCA and IaC scans. For more information on available scanning, see Infrastructure-as-Code Security and Software Composition Analysis (SCA).
PR commenting is not currently supported in self-hosted GitLab. See GitLab self-hosted pipeline.
Example one: SCA scan results
The following example demonstrates the PR comments returned after an SCA scan. The SCA scan identified multiple potential issues, including CVEs, internal code issues, exposed secrets, and license compliance violations.
By expanding each section, you can find information on the identified issue:
-
3rd Party Vulnerabilities: Provides details of identified CVEs at a high level, including the package and severity.
To view more in-depth information, expand details of each Package. This will include information on the CVE ID, severity, suggested fix version, and so on.
-
Internal Code: Provides information on the identified issues with internal code, including a description of the issue, the severity, and the URL to the exact location where the issue is introduced.
-
Hard-coded Secrets: Provides information on identified secrets in the source branch, include the secret category and severity.
-
License Risks: Provides information on potential license compliance violations, including the licence and license category.
Example two: IaC scan results
The following example demonstrates the PR comments returned after an IaC scan. The IaC scan identified 8 new, potential violations for review.
Upon expanding the details, you can find information on the identified violation, including a high-level Description, the Location of the violation, and its Severity.
