What would you like to be added:
I have experimented a bit with this template file. For some reason, unless you install additional plugins into Azure DevOps, Sarif is not supported although Microsoft is one of the companies in the working group behind that format.
It does support junit for the PublishTestResults@2 task.
Could you please include it in the repository.
Please note I have used Google Gemini to generate it.
<?xml version="1.0" encoding="UTF-8"?>
<testsuites>
<testsuite name="grype-vulnerability-scan" tests="{{ len .Matches }}" failures="{{ len .Matches }}" errors="0" skipped="0">
{{- range .Matches }}
<testcase className="{{ .Artifact.Name }}" name="{{ .Vulnerability.ID }} ({{ .Vulnerability.Severity }})" time="0">
<failure message="Vulnerability discovered in package {{ .Artifact.Name }}" type="{{ .Vulnerability.Severity }}">
Package: {{ .Artifact.Name }}
Version: {{ .Artifact.Version }}
Type: {{ .Artifact.Type }}
Vulnerability: {{ .Vulnerability.ID }}
Severity: {{ .Vulnerability.Severity }}
Link: {{ .Vulnerability.DataSource }}
Fix Version: {{ if .Vulnerability.Fix.Versions }}{{ join .Vulnerability.Fix.Versions ", " }}{{ else }}None{{ end }}
Description:
{{ .Vulnerability.Description }}
</failure>
</testcase>
{{- end }}
</testsuite>
</testsuites>
Why is this needed:
Good reasoning is given above.
Additional context:
What would you like to be added:
I have experimented a bit with this template file. For some reason, unless you install additional plugins into Azure DevOps, Sarif is not supported although Microsoft is one of the companies in the working group behind that format.
It does support junit for the PublishTestResults@2 task.
Could you please include it in the repository.
Please note I have used Google Gemini to generate it.
Why is this needed:
Good reasoning is given above.
Additional context: