Add jenkins-security-scan template

[daniel-beck]

If you're curious, these are the repos being used:

• https://github.com/jenkins-infra/jenkins-security-scan
• https://github.com/jenkins-infra/jenkins-codeql (and indirectly github/codeql through a submodule)

Screenshot:

[timja]

Could you add this to a repo and show what it looks like?

This sounds really cool in general nice work 😄 .

[daniel-beck]

Could you add this to a repo and show what it looks like?

There's a screenshot from my test org, or WDYM? Otherwise it's just another action and the findings are the same as in jenkins-security-scan-enabled repos, or those signed up via INFRA tickets.

[timja]

I mean of an app using this action, does it report it as check annotations / a check result?

Or just in the security section of the repo.

I didn't mean of what the workflow-template looks like, the action itself

[daniel-beck]

I mean of an app using this action, does it report it as check annotations / a check result?

Or just in the security section of the repo.

Both. These are repos currently getting branches and PRs checked, so you can see the checks on open PRs, and the Security section has findings for the default branch.

[timja]

It goes green with new issues?
jenkinsci/git-plugin#930

=/

Can't say I would ever see that in 17 other checks

[daniel-beck]

Interesting. Since I'm not setting any check results (this is GitHub itself based on uploads of complete scans of both the target branch and the PR), I have no control over that. The first screenshot here indicates this is expected behavior. I'll try to get help from GH.

Would you consider this a blocker, or something we'll just need to document and done?

[timja]

Not a blocker at all just a bit of poor UX that would be great to improve

[daniel-beck]

Looks like it's intentional:

If the code scanning results check finds any problems with a severity of error, critical, or high, the check fails and the error is reported in the check results. If all the results found by code scanning have lower severities, the alerts are treated as warnings or notes and the check succeeds.

This one is just a warning. Unsure whether these levels already existed and were used in this manner when I originally defined these checks. This one in particular is (still) notoriously false-positive heavy too, so it makes some sense at least in this case. We should probably discuss whether any finding should fail the check.