Call for feedback: OpenScanHub integration #2371
Replies: 11 comments 46 replies
-
|
We have also enabled find-unicode-control in production today. |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
|
I've just seen "osh-diff-scan:fedora-rawhide-x86_64" in avahi/avahi#635 and ended up here. Both those issues could have been found with |
Beta Was this translation helpful? Give feedback.
-
|
One more thing. It would be really cool if it could show compiler warnings introduced in PRs (as far as I understand it should be differential eventually). Unfortunately I can't flip Edit: looks like it already works. I introduced an unused variable and it was reported in https://openscanhub.fedoraproject.org/task/6611/log/added.html. |
Beta Was this translation helpful? Give feedback.
-
|
@evverx Thanks for feedback! OSH provides differential scan results for both GCC an Cppcheck but the differential output is empty for the mentioned PR. Could you please provide the exact steps to detect this bug with GCC/Cppcheck? OSH can transparently change the flags for both GCC and Cppcheck. However, we need to be careful with overriding the default configuration in order to keep the signal-to-noise ratio acceptable. |
Beta Was this translation helpful? Give feedback.
-
|
@evverx Thank you for clarifying it! Unfortunately, the Nevertheless, the scanning configuration in OSH can be customized for individual scans if needed. I have triggered a scan manually with the option given to Cppcheck: ... and the differential scan reported (as fixed) only the two findings that you were looking for: https://openscanhub.fedoraproject.org/task/6245/log/fixed.html I think we would need to extend Packit such that it can pass custom options to OSH for users with specific needs... |
Beta Was this translation helpful? Give feedback.
-
|
Hey! I started playing around with this a bit, and one thing I noticed straight away is that links to added/fixed/results pages in the job overview all link to JSON versions instead of the HTML ones: Is this expected? It's a bit annoying from the UX point of view, since the HTML versions are much more human friendly, and right now you have to click through the first link to get to them. Or is it expected to consume the OSH results primarily by downloading the JSON reports and piping them to |
Beta Was this translation helpful? Give feedback.
-
It has been fixed now. For example, you can see the scan for the packit package was successful and it uses dynamic dependencies. |
Beta Was this translation helpful? Give feedback.
-
|
I have submitted a cscppc pull request and the Is there any way to display logs to check what actually happened? |
Beta Was this translation helpful? Give feedback.
-
@lbarcziova Shall this be marked as fixed? |
Beta Was this translation helpful? Give feedback.
-
Retriggering of scansNote Issue: packit/packit-service#2710 Last week one of our users hit an issue with a flake during the scan, it blocked their merging process and they weren't aware of how to retrigger the OSH scan1. As one of the follow-ups we should implement retriggering via comment (and probably also GitHub Check Re-Run). Footnotes
|
Beta Was this translation helpful? Give feedback.

Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
We are happy to share the news about our recently added feature - SAST using OpenScanHub. Currently, this feature runs by default for successful Copr builds for
fedora-rawhide-x86_64for users that have both Copr builds for pull requests and commits configured (see more details in the 📝 docs 📝 ).ℹ️ This functionality is an initial prototype and both configuration and functionality will likely change in the future. If you want to try it, just make sure you have the needed Copr build jobs configured.
💡 Therefore, we welcome any feedback, suggestions, or ideas! Please share your thoughts in the comments below.
Looking forward to your input!
Beta Was this translation helpful? Give feedback.
All reactions