Skip to content

Commit 290f577

Browse files
khorne3khorne3
authored
add info on triage by comments for ADO (#1983)
1 parent e5fc3c7 commit 290f577

File tree

3 files changed

+39
-25
lines changed

3 files changed

+39
-25
lines changed

‎docs/semgrep-code/triage-remediation.md

Lines changed: 32 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import TabItem from '@theme/TabItem';
1616
# Triage and remediate findings
1717

1818
import TriageStatuses from "/src/components/reference/_triage-states.mdx"
19+
import TriageReason from "/src/components/reference/_triage-reason.mdx"
1920
import RemoveRuleset from "/src/components/procedure/_remove-ruleset.mdx"
2021
import IgnoreIndividualFindingNoGrouping from "/src/components/procedure/_ignore-individual-finding-no-grouping.mdx"
2122

@@ -143,6 +144,7 @@ Triage your Semgrep AppSec Platform findings displayed as comments in GitHub PRs
143144
<Tabs
144145
defaultValue="gh"
145146
values={[
147+
{label: 'Azure DevOps', value: 'ado'},
146148
{label: 'GitHub', value: 'gh'},
147149
{label: 'GitLab', value: 'gl'}
148150
]}
@@ -173,6 +175,29 @@ You can also reopen a finding that was previously ignored. To do so, in step 2.
173175
174176
</TabItem> -->
175177

178+
<TabItem value='ado'>
179+
180+
### Prerequisites
181+
182+
- You have one or more repositories hosted by Azure DevOps Cloud.
183+
- You have completed a [Semgrep core deployment](/deployment/core-deployment).
184+
185+
### Enable triage through Azure DevOps PR comments
186+
187+
1. Sign in to Semgrep, and go to your organization's [Settings](https://semgrep.dev/orgs/-/settings) page.
188+
2. Under **Code (SAST)**, click the **Triage via code review comments** <i class="fa-solid fa-toggle-large-on"></i> toggle to turn on this feature.
189+
190+
### Triage a finding
191+
192+
1. Find an open comment created by Semgrep in your pull request:
193+
![Azure DevOps PR comment with Semgrep triage options](/img/ado-pr-comment.png#md-width)
194+
2. In a subsequent comment, reply with the action you want to take. You must provide a reason to help the reader understand why the finding has been triaged as ignored:
195+
<TriageReason />
196+
197+
Triaging a finding as **Ignored** through a comment in Azure DevOps changes the status of the finding to **Ignored** in Semgrep AppSec Platform. However, the Azure DevOps conversation itself is **not** automatically resolved by this process.
198+
199+
</TabItem>
200+
176201
<TabItem value='gh'>
177202

178203
### Prerequisites
@@ -181,30 +206,21 @@ You can also reopen a finding that was previously ignored. To do so, in step 2.
181206

182207
### Enable triage through GitHub PR comments:
183208

184-
To enable triage through comments:
185-
186209
1. In Semgrep AppSec Platform, go to your organization's [Settings](https://semgrep.dev/orgs/-/settings) page.
187210
2. Under **Code (SAST)**, click the **Triage via code review comments** <i class="fa-solid fa-toggle-large-on"></i> toggle to turn on this feature.
188211

189-
To triage a finding:
212+
### Triage a finding
190213

191214
1. Find an open comment created by Semgrep AppSec Platform in your pull request or merge request:
192215
![Screenshot of Semgrep AppSec Platform comment in GitHub](/img/semgrep-app-comment-github-beta.png#md-width)
193216
2. In a subsequent comment, reply with the action you want to take. You must provide a **reason** to help the reader understand why the finding has been triaged as **ignored**:
194-
195-
| Comment | Description |
196-
| - | - |
197-
| <code>/fp <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **false positive**. |
198-
| <code>/ar <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **acceptable risk**. |
199-
| <code>/other <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** without specifying the reason; the triage reason value is set to **No triage reason**. |
200-
| <code>/open <span className="placeholder">&lt;REASON&gt;</span></code> | Reopen a finding that has been triaged as **Ignored**. The comment is optional. |
201-
| <code>/remember <span className="placeholder">&lt;REASON&gt;</span></code> | [Add Assistant Memories](/semgrep-assistant/customize#add-memories-beta). |
217+
<TriageReason />
202218

203219
Semgrep supports older versions of this functionality that used the following commands:
204220
- <code>/semgrep ignore <span className="placeholder">&lt;REASON&gt;</span></code> - triage a finding as **Ignored**.
205221
- <code>/semgrep open <span className="placeholder">&lt;REASON&gt;</span></code> - reopen a finding that has been triaged as **Ignored**.
206222

207-
Triaging a finding as **Ignored** through a comment in GitHub changes the status of the finding to **Ignored** in the Semgrep AppSec Platform. However, the GitHub conversation itself is not automatically resolved by this process.
223+
Triaging a finding as **Ignored** through a comment in GitHub changes the status of the finding to **Ignored** in Semgrep AppSec Platform. However, the GitHub conversation itself is **not** automatically resolved by this process.
208224

209225
</TabItem>
210226
<TabItem value='gl'>
@@ -213,29 +229,20 @@ Triaging a finding as **Ignored** through a comment in GitHub changes the status
213229
- A repository hosted by GitLab. Semgrep supports the use of both GitLab.com and GitLab self-managed plans.
214230
- You have completed a [Semgrep core deployment](/deployment/core-deployment).
215231

216-
### Enable triage through GitLab MR comments:
217-
218-
To enable triage through comments:
232+
### Enable triage through GitLab MR comments
219233

220234
1. In Semgrep AppSec Platform, go to your organization's [Settings](https://semgrep.dev/orgs/-/settings) page.
221235
2. Under **Code (SAST)**, click the **Triage via code review comments** <i class="fa-solid fa-toggle-large-on"></i> toggle to turn on this feature.
222236

223-
To triage a finding:
237+
### Triage a finding
224238

225239
1. Find an open comment created by Semgrep AppSec Platform in your pull request or merge request:
226240
![Screenshot of Semgrep AppSec Platform comment in GitLab](/img/semgrep-app-comment-gitlab.png#md-width)
227241

228242
2. In a subsequent comment, reply with the corresponds with the action you want to take. If necessary, ensure that you substitute the colored placeholder `<REASON>` with text to help the reader understand why the finding has been triaged as **ignored**:
243+
<TriageReason />
229244

230-
| Comment | Description |
231-
| - | - |
232-
| <code>/fp <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **false positive**. |
233-
| <code>/ar <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **acceptable risk**. |
234-
| <code>/other <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** without specifying the reason; the triage reason value is set to **No triage reason**. |
235-
| <code>/open <span className="placeholder">&lt;REASON&gt;</span></code> | Reopen a finding that has been triaged as **Ignored**. The comment is optional. |
236-
| <code>/remember <span className="placeholder">&lt;REASON&gt;</span></code> | [Add Assistant Memories](/semgrep-assistant/customize#add-memories-beta). |
237-
238-
Triaging a finding as **Ignored** through a comment in GitLab changes the status of the finding to **Ignored** in the Semgrep AppSec Platform. However, the GitLab conversation itself is not automatically resolved by this process.
245+
Triaging a finding as **Ignored** through a comment in GitLab changes the status of the finding to **Ignored** in Semgrep AppSec Platform. However, the GitLab conversation itself is **not** automatically resolved by this process.
239246

240247
</TabItem>
241248
</Tabs>

‎src/components/reference/_triage-reason.mdx

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
| Comment | Description |
2+
| - | - |
3+
| <code>/fp <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **false positive**. |
4+
| <code>/ar <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** with the triage reason **acceptable risk**. |
5+
| <code>/other <span className="placeholder">&lt;REASON&gt;</span></code> | Triage a finding as **Ignored** without specifying the reason; the triage reason value is set to **No triage reason**. |
6+
| <code>/open <span className="placeholder">&lt;REASON&gt;</span></code> | Reopen a finding that has been triaged as **Ignored**. The comment is optional. |
7+
| <code>/remember <span className="placeholder">&lt;REASON&gt;</span></code> | [Add Assistant Memories](/semgrep-assistant/customize#add-memories-beta). |

‎static/img/ado-pr-comment.png

347 KB
Loading

0 commit comments

Comments
 (0)