Skip to main content

SARIF ์—…๋กœ๋“œ ๋ฌธ์ œ ํ•ด๊ฒฐ

code scanning ๊ฒฐ๊ณผ์˜ SARIF ํŒŒ์ผ์„ GitHub์— ์—…๋กœ๋“œํ•˜๋Š” ๋ฌธ์ œ์— ๋Œ€ํ•œ ํ•ด๊ฒฐ ๋ฐฉ๋ฒ•์„ ์•Œ์•„๋ณด์‹ญ์‹œ์˜ค.

GitHub Code Security๊ฐ€ ๋น„ํ™œ์„ฑํ™”๋˜์–ด ์—…๋กœ๋“œ ์‹คํŒจ

GitHub Code Security๊ฐ€ ํ™œ์„ฑํ™”๋œ ํ”„๋ผ์ด๋น— ๋˜๋Š” ๋‚ด๋ถ€ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์—๋งŒ SARIF ๊ฒฐ๊ณผ๋ฅผ ์—…๋กœ๋“œํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

code scanning์— CodeQL ๊ธฐ๋ณธ ์„ค์ •์„ ์‚ฌ์šฉํ•˜๋„๋ก ์„ค์ •ํ–ˆ๊ธฐ ๋•Œ๋ฌธ์— ์—…๋กœ๋“œ๊ฐ€ ๊ฑฐ๋ถ€๋˜์—ˆ์Šต๋‹ˆ๋‹ค.

code scanning์— ๋Œ€ํ•œ ๊ธฐ๋ณธ ์„ค์ •์„ ์‚ฌ์šฉํ•˜๋„๋ก ์„ค์ •๋œ ๊ฒฝ์šฐ CodeQL ์ž‘์—… ๋˜๋Š” CodeQL CLI์— ์˜ํ•ด ์ƒ์„ฑ๋œ SARIF ๊ฒฐ๊ณผ๋ฅผ ์—…๋กœ๋“œํ•  ์ˆ˜ ์—†์Šต๋‹ˆ๋‹ค. ๊ตฌ์„ฑ์„ ํ™•์ธํ•˜๊ณ  ๊ธฐ๋ณธ ์„ค์ •์„ ์œ ์ง€ํ• ์ง€ ๋˜๋Š” SARIF ์—…๋กœ๋“œ ์ฐจ๋‹จ์„ ํ•ด์ œํ• ์ง€ ๊ฒฐ์ •ํ•ฉ๋‹ˆ๋‹ค.

SARIF ๊ฒฐ๊ณผ๋ฅผ ์—…๋กœ๋“œํ•˜๋ ค๋ฉด GitHub ํ† ํฐ์ด ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค.

๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— ์•ก์„ธ์Šคํ•˜๋Š” ๋ฐ ์‚ฌ์šฉํ•  ์—…๋กœ๋“œ ํ”„๋กœ์„ธ์Šค์— ๋Œ€ํ•œ ์ธ์ฆ ๋ฐฉ๋ฒ•์„ ์ œ๊ณตํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

SARIF ํŒŒ์ผ์ด ์ž˜๋ชป๋˜์—ˆ์Šต๋‹ˆ๋‹ค.

Code scanning์€(๋Š”) ๊ตฌ๋ฌธ์ƒ ์œ ํšจํ•œ SARIF ํŒŒ์ผ๋งŒ ์ฒ˜๋ฆฌํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ž˜๋ชป๋œ ํŒŒ์ผ์ด ๊ฑฐ๋ถ€๋˜์—ˆ์Šต๋‹ˆ๋‹ค.

SARIF ๊ฒฐ๊ณผ ํŒŒ์ผ์ด ๋„ˆ๋ฌด ํผ

10MB๋ณด๋‹ค ํฐ SARIF ๊ฒฐ๊ณผ ํŒŒ์ผ์„ code scanning์— ์—…๋กœ๋“œํ•  ์ˆ˜ ์—†์Šต๋‹ˆ๋‹ค. ๊ฐ€์žฅ ํฐ ์˜ํ–ฅ ๊ฒฐ๊ณผ๋ฅผ ํฌํ•จํ•˜๋Š” ๋” ์ž‘์€ ํŒŒ์ผ์„ ์ƒ์„ฑํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ํƒ์ƒ‰ํ•ฉ๋‹ˆ๋‹ค.

SARIF ๊ฒฐ๊ณผ๊ฐ€ ํ•˜๋‚˜ ์ด์ƒ์˜ ์ œํ•œ์„ ์ดˆ๊ณผํ•ฉ๋‹ˆ๋‹ค.

ํ•˜๋‚˜ ์ด์ƒ์˜ ์ œํ•œ์ด ์ดˆ๊ณผ๋˜์–ด code scanning์—์„œ SARIF ํŒŒ์ผ์ด ๊ฑฐ๋ถ€๋  ๋•Œ ๋ฐœ์ƒํ•˜๋Š” ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ์•Œ์•„๋ด…๋‹ˆ๋‹ค.