Skip to content

Commit

Permalink
add info on triage by comments for ADO (#1983)
Browse files Browse the repository at this point in the history
  • Loading branch information
khorne3 authored Feb 24, 2025
1 parent e5fc3c7 commit 290f577
Show file tree
Hide file tree
Showing 3 changed files with 39 additions and 25 deletions.
57 changes: 32 additions & 25 deletions docs/semgrep-code/triage-remediation.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import TabItem from '@theme/TabItem';
# Triage and remediate findings

import TriageStatuses from "/src/components/reference/_triage-states.mdx"
import TriageReason from "/src/components/reference/_triage-reason.mdx"
import RemoveRuleset from "/src/components/procedure/_remove-ruleset.mdx"
import IgnoreIndividualFindingNoGrouping from "/src/components/procedure/_ignore-individual-finding-no-grouping.mdx"

Expand Down Expand Up @@ -143,6 +144,7 @@ Triage your Semgrep AppSec Platform findings displayed as comments in GitHub PRs
<Tabs
defaultValue="gh"
values={[
{label: 'Azure DevOps', value: 'ado'},
{label: 'GitHub', value: 'gh'},
{label: 'GitLab', value: 'gl'}
]}
Expand Down Expand Up @@ -173,6 +175,29 @@ You can also reopen a finding that was previously ignored. To do so, in step 2.
</TabItem> -->

<TabItem value='ado'>

### Prerequisites

- You have one or more repositories hosted by Azure DevOps Cloud.
- You have completed a [Semgrep core deployment](/deployment/core-deployment).

### Enable triage through Azure DevOps PR comments

1. Sign in to Semgrep, and go to your organization's [Settings](https://semgrep.dev/orgs/-/settings) page.
2. Under **Code (SAST)**, click the **Triage via code review comments** <i class="fa-solid fa-toggle-large-on"></i> toggle to turn on this feature.

### Triage a finding

1. Find an open comment created by Semgrep in your pull request:
![Azure DevOps PR comment with Semgrep triage options](/img/ado-pr-comment.png#md-width)
2. In a subsequent comment, reply with the action you want to take. You must provide a reason to help the reader understand why the finding has been triaged as ignored:
<TriageReason />

Triaging a finding as **Ignored** through a comment in Azure DevOps changes the status of the finding to **Ignored** in Semgrep AppSec Platform. However, the Azure DevOps conversation itself is **not** automatically resolved by this process.

</TabItem>

<TabItem value='gh'>

### Prerequisites
Expand All @@ -181,30 +206,21 @@ You can also reopen a finding that was previously ignored. To do so, in step 2.

### Enable triage through GitHub PR comments:

To enable triage through comments:

1. In Semgrep AppSec Platform, go to your organization's [Settings](https://semgrep.dev/orgs/-/settings) page.
2. Under **Code (SAST)**, click the **Triage via code review comments** <i class="fa-solid fa-toggle-large-on"></i> toggle to turn on this feature.

To triage a finding:
### Triage a finding

1. Find an open comment created by Semgrep AppSec Platform in your pull request or merge request:
![Screenshot of Semgrep AppSec Platform comment in GitHub](/img/semgrep-app-comment-github-beta.png#md-width)
2. In a subsequent comment, reply with the action you want to take. You must provide a **reason** to help the reader understand why the finding has been triaged as **ignored**:

| Comment | Description |
| - | - |
| <code>/fp <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **false positive**. |
| <code>/ar <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **acceptable risk**. |
| <code>/other <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** without specifying the reason; the triage reason value is set to **No triage reason**. |
| <code>/open <span className="placeholder">&lt;REASON&gt;</span></code> | Reopen a finding that has been triaged as **Ignored**. The comment is optional. |
| <code>/remember <span className="placeholder">&lt;REASON&gt;</span></code> | [Add Assistant Memories](/semgrep-assistant/customize#add-memories-beta). |
<TriageReason />

Semgrep supports older versions of this functionality that used the following commands:
- <code>/semgrep ignore <span className="placeholder">&lt;REASON&gt;</span></code> - triage a finding as **Ignored**.
- <code>/semgrep open <span className="placeholder">&lt;REASON&gt;</span></code> - reopen a finding that has been triaged as **Ignored**.

Triaging a finding as **Ignored** through a comment in GitHub changes the status of the finding to **Ignored** in the Semgrep AppSec Platform. However, the GitHub conversation itself is not automatically resolved by this process.
Triaging a finding as **Ignored** through a comment in GitHub changes the status of the finding to **Ignored** in Semgrep AppSec Platform. However, the GitHub conversation itself is **not** automatically resolved by this process.

</TabItem>
<TabItem value='gl'>
Expand All @@ -213,29 +229,20 @@ Triaging a finding as **Ignored** through a comment in GitHub changes the status
- A repository hosted by GitLab. Semgrep supports the use of both GitLab.com and GitLab self-managed plans.
- You have completed a [Semgrep core deployment](/deployment/core-deployment).

### Enable triage through GitLab MR comments:

To enable triage through comments:
### Enable triage through GitLab MR comments

1. In Semgrep AppSec Platform, go to your organization's [Settings](https://semgrep.dev/orgs/-/settings) page.
2. Under **Code (SAST)**, click the **Triage via code review comments** <i class="fa-solid fa-toggle-large-on"></i> toggle to turn on this feature.

To triage a finding:
### Triage a finding

1. Find an open comment created by Semgrep AppSec Platform in your pull request or merge request:
![Screenshot of Semgrep AppSec Platform comment in GitLab](/img/semgrep-app-comment-gitlab.png#md-width)

2. In a subsequent comment, reply with the corresponds with the action you want to take. If necessary, ensure that you substitute the colored placeholder `<REASON>` with text to help the reader understand why the finding has been triaged as **ignored**:
<TriageReason />

| Comment | Description |
| - | - |
| <code>/fp <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **false positive**. |
| <code>/ar <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **acceptable risk**. |
| <code>/other <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** without specifying the reason; the triage reason value is set to **No triage reason**. |
| <code>/open <span className="placeholder">&lt;REASON&gt;</span></code> | Reopen a finding that has been triaged as **Ignored**. The comment is optional. |
| <code>/remember <span className="placeholder">&lt;REASON&gt;</span></code> | [Add Assistant Memories](/semgrep-assistant/customize#add-memories-beta). |

Triaging a finding as **Ignored** through a comment in GitLab changes the status of the finding to **Ignored** in the Semgrep AppSec Platform. However, the GitLab conversation itself is not automatically resolved by this process.
Triaging a finding as **Ignored** through a comment in GitLab changes the status of the finding to **Ignored** in Semgrep AppSec Platform. However, the GitLab conversation itself is **not** automatically resolved by this process.

</TabItem>
</Tabs>
Expand Down
7 changes: 7 additions & 0 deletions src/components/reference/_triage-reason.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
| Comment | Description |
| - | - |
| <code>/fp <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **false positive**. |
| <code>/ar <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **acceptable risk**. |
| <code>/other <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** without specifying the reason; the triage reason value is set to **No triage reason**. |
| <code>/open <span className="placeholder">&lt;REASON&gt;</span></code> | Reopen a finding that has been triaged as **Ignored**. The comment is optional. |
| <code>/remember <span className="placeholder">&lt;REASON&gt;</span></code> | [Add Assistant Memories](/semgrep-assistant/customize#add-memories-beta). |
Binary file added static/img/ado-pr-comment.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit 290f577

Please sign in to comment.