$ the-wire · showcase
Maintainers get to set the format of scanner reports and patches
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
3 people shipped this
oss-scanner now lets project maintainers define how reports and patches should look, via two new optional files, and two enrolments landed alongside it.
Let maintainers say how reports and patches should look anthropics/oss-scanner
Two new optional files, `report_guidelines.md` and `patch_guidelines.md`, live either in the project's own repository at the path given in `project.yaml` or next to `project.yaml`; neither has a default path, unlike `threat_model.md`, and both keys sit commented out in `templates/project.yaml`. The author flags it as not merge-ready until the scanner accepts the two new keys.
Merge pull request #1406 from anthropics/sambb/guidelines-files anthropics/oss-scanner
The guidelines-files change is now merged, so the configuration surface for report and patch formatting is in the tree ahead of the scanner reading those keys.
Move Yopass build and threat model into its repository anthropics/oss-scanner
Yopass's Dockerfile and threat model now live in its own repository under `.oss-scanner/`, with `project.yaml` pointing at `dockerfile: .oss-scanner/Dockerfile` and the threat model on the default path, so the build can follow Yopass's move to Rust without a pull request here.
Enrol projects/crewjam-saml anthropics/oss-scanner
crewjam-saml is enrolled as a new project, with `project.yaml` validated against the toolkit before submission. The enrolment PR was merged.
Merge pull request #1445 from crewjam/ross/add-crewjam-saml anthropics/oss-scanner
The crewjam-saml enrolment is merged, making the project live in the scanner's project list.
Action items
- → Hold merging report_guidelines.md and patch_guidelines.md support until the scanner accepts the two new keys anthropics/oss-scanner [plan]
