Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add callout for branch protection #1098

Closed
wants to merge 5 commits into from
Closed

add callout for branch protection #1098

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
73e5be9
add callout for branch protectiton
s-santillan Jun 28, 2023
a83c1ea
updated wording
s-santillan Jun 28, 2023
efbf09e
updated wording
s-santillan Jun 28, 2023
4d9247c
Merge branch 'main' into sara/quickfix/branch-protection
s-santillan Aug 4, 2023
045a987
address review notes
s-santillan Aug 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions src/components/procedure/_platform-add-repo.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,15 @@ To add a repository from GitHub, GitLab, or BitBucket, follow these steps:
4. Click **Scan new project**, and then click **Run scan in CI**.
5. Select which CI provider for Semgrep to integrate with.
6. Follow the instructions displayed on Semgrep Cloud Platform page for your particular CI provider.
7. Optional: For GitHub Actions users, if you have given Semgrep access to more than 1 repository, you can bulk add many repositories.

You have now added a repository to Semgrep Cloud Platform. A scan begins automatically after adding a new repository.

:::caution
For **GitHub** users: This method of adding a repository commits a GitHub Actions workflow file directly into your trunk or default branch, such as `main` or `develop`. **Branch protection** can prevent Semgrep from onboarding your repositories, whether in bulk or one-by-one, through this method.

If you encounter issues with adding repositories, such as being unable to commit the Semgrep workflow file, change your [branch protection](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches) settings temporarily while you add repositories to Semgrep.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think most customers will actually be willing/able to modify their branch protection settings. I'd also suggest that they introduce the workflow file through a PR and then merge it into the repo.

As the feature bakes - I'd also encourage linking somewhere in here to auto-scan as an alternative.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd also suggest that they introduce the workflow file through a PR and then merge it into the repo.

Thanks for the reply. Just confirming that you're suggesting, IF the user CAN'T change their branch protection:

  1. The user has to do it manually (copy paste the yml file, make a PR).
  2. The user has to do this for every repo.

Is that correct?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup that's exactly right.

Regarding the "do this for every repo" - it might be helpful to caveat if they are looking to deploy to many repos where this would be cumbersome - they might consider some of the approaches outlined by github here:

https://github.blog/2023-04-05-building-organization-wide-governance-and-re-use-for-ci-cd-and-automation-with-github-actions/

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we could also link to our required/reusable workflows KBs!


![Branch protection error message in Semgrep Cloud Platform.](/img/github-branch-protection.png#md-width)
*Figure.* This error message appears when Branch protection prevents Semgrep from adding your repository.
:::
Binary file added static/img/github-branch-protection.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.