Add .whitesource and config files to activate whitesource integration #165

zelinh · 2021-12-30T20:40:57Z

Signed-off-by: Zelin Hao [email protected]

Description

We @bbarani already enable the access of WhiteSource integration with Github.com for this repo. However, the automatic PR of .whitesource is not created. We asked for the support from WhiteSource side and they suggested we could raise one by ourselves. This PR will also set the WhiteSource integration config mode LOCAL so it will be using the whitesource.config in the root directory. Dashboards team can modify this configuration on their own to customize it. We are providing the one we had for all repos at this time.

Another PR we created for the same issue. opensearch-project/OpenSearch-Dashboards#999

Please be aware that when this PR is merged, WhiteSource integration might be automatically created CVEs Github issues like these in build repo.

Issues Resolved

[List any issues this PR will resolve]

Check List

New functionality includes testing.
- All tests pass
New functionality has been documented.
Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Zelin Hao <[email protected]>

codecov-commenter · 2021-12-30T20:51:06Z

Codecov Report

Merging #165 (5297cae) into main (ec768b7) will decrease coverage by 0.16%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main     #165      +/-   ##
==========================================
- Coverage   44.12%   43.95%   -0.17%     
==========================================
  Files         156      156              
  Lines        5145     5173      +28     
  Branches      948      953       +5     
==========================================
+ Hits         2270     2274       +4     
- Misses       2657     2681      +24     
  Partials      218      218

Impacted Files	Coverage Δ
...hboards-plugin/public/redux/reducers/opensearch.ts	`56.47% <0.00%> (-0.68%)`	⬇️
...pages/DetectorDetail/containers/DetectorDetail.tsx	`16.05% <0.00%> (-0.61%)`	⬇️
...ages/DetectorResults/containers/AnomalyHistory.tsx	`12.54% <0.00%> (-0.44%)`	⬇️
...aly-detection-dashboards-plugin/utils/constants.ts	`100.00% <0.00%> (ø)`
...s/AnomalyCharts/containers/AnomalyHeatmapChart.tsx	`51.12% <0.00%> (ø)`
...ugin/public/pages/DetectorDetail/utils/helpers.tsx	`25.80% <0.00%> (+4.97%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ec768b7...5297cae. Read the comment docs.

ylwu-amzn · 2022-01-07T09:01:18Z

.whitesource

+    "displayMode": "diff"
+  },
+  "issueSettings": {
+    "minSeverityLevel": "LOW"


Do we have agreement on all repos that we should care LOW level issues?

This is something that each team can change it based their demand. You can always modify the severity level issue would be created by changing this parameter. https://whitesource.atlassian.net/wiki/spaces/WD/pages/697696422/WhiteSource+for+GitHub.com#Issue-Settings-(issueSettings). This PR is to help onboard WhiteSource with some default values.

ylwu-amzn · 2022-01-07T09:06:51Z

whitesource.config

+resolveAllDependencies=false
+#excludeDependenciesFromNodes=.*commons-io.*,.*maven-model
+
+resolveAllDependencies=false


Duplicate line as line 78

Removed. Thanks!

Signed-off-by: Zelin Hao <[email protected]>

ylwu-amzn

LGTM. Thanks for the change!

ohltyler · 2022-01-10T16:50:22Z

@zelinh we have seen with Dependabot that oftentimes the alerts are for dependencies stored in yarn.lock that are actually coming from core Dashboards, but pulled into the plugin's dependency tree, and can't be fixed at the plugin level. Do you know if this will add similar issues, such as automatic PRs for dependencies stored in core Dashboards?

zelinh · 2022-01-10T17:59:15Z

@zelinh we have seen with Dependabot that oftentimes the alerts are for dependencies stored in yarn.lock that are actually coming from core Dashboards, but pulled into the plugin's dependency tree, and can't be fixed at the plugin level. Do you know if this will add similar issues, such as automatic PRs for dependencies stored in core Dashboards?

I think this will mostly create issues for those vulnerabilities as long as they are existed in this repo. You can always whitelist those issues that can't fix at your level in the WhiteSource dashboard to ignore them. Furthermore, automatic fix for CVEs is disabled in default, so it won't create PR to fix CVEs unless you allow it.

ohltyler · 2022-01-10T18:16:35Z

@zelinh we have seen with Dependabot that oftentimes the alerts are for dependencies stored in yarn.lock that are actually coming from core Dashboards, but pulled into the plugin's dependency tree, and can't be fixed at the plugin level. Do you know if this will add similar issues, such as automatic PRs for dependencies stored in core Dashboards?

I think this will mostly create issues for those vulnerabilities as long as they are existed in this repo. You can always whitelist those issues that can't fix at your level in the WhiteSource dashboard to ignore them. Furthermore, automatic fix for CVEs is disabled in default, so it won't create PR to fix CVEs unless you allow it.

Got it, sounds good. Thanks for adding!

…#165) * Add .whitesource and config files to trigger whitesource integration Signed-off-by: Zelin Hao <[email protected]> * Remove duplicate code for example config Signed-off-by: Zelin Hao <[email protected]> (cherry picked from commit ef40275)

Add .whitesource and config files to trigger whitesource integration

190cbee

Signed-off-by: Zelin Hao <[email protected]>

zelinh requested a review from a team December 30, 2021 20:40

zelinh mentioned this pull request Jan 3, 2022

Enable the WhiteSource native integration to other repositories under opensearch org opensearch-project/opensearch-build#1423

Closed

31 tasks

ylwu-amzn reviewed Jan 7, 2022

View reviewed changes

Remove duplicate code for example config

5297cae

Signed-off-by: Zelin Hao <[email protected]>

ylwu-amzn approved these changes Jan 7, 2022

View reviewed changes

ohltyler approved these changes Jan 10, 2022

View reviewed changes

ylwu-amzn merged commit ef40275 into opensearch-project:main Jan 13, 2022

ohltyler added the backport 1.x label Mar 2, 2022

opensearch-trigger-bot bot mentioned this pull request Mar 2, 2022

[Backport 1.x] Add .whitesource and config files to activate whitesource integration #193

Merged

ohltyler added the infra Changes to infrastructure, testing, CI/CD, pipelines, etc. label Mar 10, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add .whitesource and config files to activate whitesource integration #165

Add .whitesource and config files to activate whitesource integration #165

zelinh commented Dec 30, 2021 •

edited

Loading

codecov-commenter commented Dec 30, 2021 •

edited

Loading

ylwu-amzn Jan 7, 2022

zelinh Jan 7, 2022

ylwu-amzn Jan 7, 2022

zelinh Jan 7, 2022

ylwu-amzn left a comment

ohltyler commented Jan 10, 2022

zelinh commented Jan 10, 2022

ohltyler commented Jan 10, 2022

Add .whitesource and config files to activate whitesource integration #165

Add .whitesource and config files to activate whitesource integration #165

Conversation

zelinh commented Dec 30, 2021 • edited Loading

Description

Issues Resolved

Check List

codecov-commenter commented Dec 30, 2021 • edited Loading

Codecov Report

ylwu-amzn Jan 7, 2022

Choose a reason for hiding this comment

zelinh Jan 7, 2022

Choose a reason for hiding this comment

ylwu-amzn Jan 7, 2022

Choose a reason for hiding this comment

zelinh Jan 7, 2022

Choose a reason for hiding this comment

ylwu-amzn left a comment

Choose a reason for hiding this comment

ohltyler commented Jan 10, 2022

zelinh commented Jan 10, 2022

ohltyler commented Jan 10, 2022

zelinh commented Dec 30, 2021 •

edited

Loading

codecov-commenter commented Dec 30, 2021 •

edited

Loading