You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+65-83
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
<divalign="center">
2
-
2
+
3
3
# JFrog Frogbot
4
4
5
5
[](#readme)
@@ -14,15 +14,6 @@
14
14
15
15
</div>
16
16
17
-
## Table of contents
18
-
19
-
-[🤖 About JFrog Frogbot](#-about-jfrog-frogbot)
20
-
-[🖥️ Setting up Frogbot](#️-setting-up-frogbot)
21
-
-[🚥 Using Frogbot](#-using-frogbot)
22
-
-[📛 Adding the Frogbot badge](#-adding-the-frogbot-badge)
23
-
-[🔥 Reporting issues](#-reporting-issues)
24
-
-[💻 Contributions](#-contributions)
25
-
26
17
<divid="what-is-frogbot"></div>
27
18
28
19
## 🤖 About JFrog Frogbot
@@ -32,29 +23,42 @@ JFrog Frogbot is a Git bot that scans your Git repositories for security vulnera
32
23
1. It scans pull requests immediately after they are opened but before they are merged. This process notifies you if the pull request is about to introduce new vulnerabilities to your code. This unique capability ensures the code is scanned and can be fixed even before vulnerabilities are introduced into the codebase.
33
24
2. It scans the Git repository periodically and creates pull requests with fixes for detected vulnerabilities.
-**Software Composition Analysis (SCA)**: Scan your project dependencies for security issues. For selected security issues, get leverage-enhanced CVE data provided by our JFrog Security Research team. Frogbot uses JFrog's vast vulnerabilities database, to which we continuously add new component vulnerability data. Also included is VulnDB, the industry's most comprehensive security database, to further extend the range of vulnerabilities detected and fixed by Frogbot.
43
-
-**Vulnerability Contextual Analysis**: This feature uses the code context to eliminate false positive reports on vulnerable dependencies that are not applicable to the code. Vulnerability Contextual Analysis is currently supported for Python and JavaScript code.
40
+
-**Software Composition Analysis (SCA)**: Scan your project dependencies for security issues. For selected security issues, get leverage-enhanced CVE data from our JFrog Security Research team. Frogbot uses JFrog's vast vulnerabilities database, to which we continuously add new component vulnerability data. Also included is VulnDB, the industry's most comprehensive security database, to further extend the range of vulnerabilities detected and fixed by Frogbot.
41
+
-**Static Application Security Testing (SAST)**: Provides fast and accurate security-focused engines that detect zero-day security vulnerabilities on your source code sensitive operations, while minimizing false positives.
42
+
-**CVE Vulnerability Contextual Analysis**: This feature uses the code context to eliminate false positive reports on vulnerable dependencies that are not applicable to the code. For CVE vulnerabilities that are applicable to your code, Frogbot will create pull request comments on the relevant code lines with full descriptions regarding the security issues caused by the CVE. Vulnerability Contextual Analysis is currently supported for Python, JavaScript, and Java code.
44
43
-**Secrets Detection**: Detect any secrets left exposed inside the code. to stop any accidental leak of internal tokens or credentials.
45
44
-**Infrastructure as Code scans (IaC)**: Scan Infrastructure as Code (Terraform) files for early detection of cloud and infrastructure misconfigurations.
46
45
47
-
> **_NOTE:_****Vulnerability Contextual Analysis**, **Secrets Detection** and **Infrastructure as Code scans**
46
+
> **_NOTE:_****SAST**, **Vulnerability Contextual Analysis**, **Secrets Detection** and **Infrastructure as Code scans**
48
47
> require the [JFrog Advanced Security Package](https://jfrog.com/xray/).
<summary> Optional - set up a FREE JFrog Environment in the Cloud</summary>
@@ -92,6 +96,7 @@ After the setup is complete, you'll receive an email with your JFrog environment
92
96
<divid="reporting-issues"></div>
93
97
94
98
## 🚥 Using Frogbot
99
+
95
100
<details>
96
101
<summary>Scanning pull requests</summary>
97
102
@@ -103,98 +108,85 @@ The following features use the package manager used for building the project:
103
108
* Software Composition Analysis (SCA)
104
109
* Vulnerability Contextual Analysis
105
110
106
-
The supported package managers are:
107
-
- Go
108
-
- Gradle
109
-
- Maven
110
-
- .NET
111
-
- npm
112
-
- NuGet
113
-
- Pip
114
-
- Pipenv
115
-
- Poetry
116
-
- Yarn
117
-
118
111
### How to use Pull Request scanning?
119
-
120
112
<details>
121
-
<summary>Azure Repos</summary>
113
+
<summary>GitHub</summary>
122
114
123
-
After you create a new pull request, Frogbot will automatically scan it.
115
+
After you create a new pull request, the maintainer of the Git repository can trigger Frogbot to scan the pull request from the pull request UI.
124
116
125
117
> **_NOTE:_** The scan output will include only new vulnerabilities added by the pull request.
126
118
> Vulnerabilities that aren't new, and existed in the code before the pull request was created, will not be included in
127
119
> the
128
-
> report. In order to include all the vulnerabilities in the report, including older ones that weren't added by this
120
+
> report. In order to include all of the vulnerabilities in the report, including older ones that weren't added by this
129
121
> PR, use the includeAllVulnerabilities parameter in the frogbot-config.yml file.
130
122
131
-
The Frogbot Azure Repos scan workflow is:
123
+
The Frogbot GitHub scan workflow is:
132
124
133
125
1. The developer opens a pull request.
134
-
2. Frogbot scans the pull request and adds a comment with the scan results.
135
-
3. Frogbot can be triggered again following new commits, by adding a comment with the `rescan` text.
126
+
2. The Frogbot workflow automatically gets triggered and a [GitHub environment](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#creating-an-environment) named `frogbot` becomes pending for the maintainer's approval.
After you create a new pull request, the maintainer of the Git repository can trigger Frogbot to scan the pull request from the pull request UI.
158
+
After you create a new pull request, Frogbot will automatically scan it.
162
159
163
160
> **_NOTE:_** The scan output will include only new vulnerabilities added by the pull request.
164
161
> Vulnerabilities that aren't new, and existed in the code before the pull request was created, will not be included in
165
162
> the
166
-
> report. In order to include all of the vulnerabilities in the report, including older ones that weren't added by this
163
+
> report. In order to include all the vulnerabilities in the report, including older ones that weren't added by this
167
164
> PR, use the includeAllVulnerabilities parameter in the frogbot-config.yml file.
168
165
169
-
The Frogbot GitHub scan workflow is:
166
+
The Frogbot Azure Repos scan workflow is:
170
167
171
168
1. The developer opens a pull request.
172
-
2. The Frogbot workflow automatically gets triggered and a [GitHub environment](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#creating-an-environment) named `frogbot` becomes pending for the maintainer's approval.
2. Frogbot scans the pull request and adds a comment with the scan results.
189
+
3. Frogbot can be triggered again following new commits, by adding a comment with the `rescan` text.
198
190
199
191
</details>
200
192
@@ -250,17 +242,7 @@ When Frogbot detects secrets that have been inadvertently exposed within the cod
250
242
251
243
### Automatic pull requests creation
252
244
Frogbot scans your Git repositories periodically and automatically creates pull requests for upgrading vulnerable dependencies to a version with a fix.
0 commit comments