14 hours ago · Tech · hide · 0 comments

Two weeks ago a new version of Sobelow was released. Sobelow is a static code analysis tool focused on security and these days it is a de facto standard for providing a minimal security measures to Elixir projects. I am mentioning this release because it contains one feature suggested and developed by me: Github Workflow commands formatter. The strory behind this feature is relatively simple and may sound familiar. When you have Sobelow check added as a Githb Aciton on your PR and the code change actually violates on of the rules, the check fails and you need to go to the job output to read it. This is bearable, but if you are like me then you probably are not a fan of Github Actions UI in the web and find it at the very least tedious. The standard alternative is to generate Sobelow report in a SARIF format and upload to the Github Code Security. This has a few upsides, especially for public repositories, but might have drawbacks in enterprise projects – the violations are only…

No comments yet. Log in to reply on the Fediverse. Comments will appear here.