Closing/dismissing alerts

[klippx]

Today scan-action automatically creates new alerts in GH Code Scanning Alerts but as packages get auto fixed these alerts stick around.

1. Can scan-action look for alerts it "created" and close them when it can be determined they are fixed (i.e. package 1.2 has an error but the project now uses 1.3 - so dismiss the alert since it is stale/fixed)

According to this 3 years old issue #142 then it's even worse, because dismissing these alerts will not help as scan-action will re-open them. I have yet to confirm this.

2. Can scan-action keep track of alerts it "created" but has been dismissed and not create new ones / reopen them as they should be considered muted ?

Maybe people have moved on to more useful code scanning tools that integrate better with GH? Any tips are welcome!

[spiffcs]

Thanks for the issue @klippx! I don't think the user ever got back to use on #142, but you're right it's been some time since we've updated/investigated the alerts and how scan action integrates with them. I've added this to our needs-discussion for this week with the larger team. We'll talk about the ideal state we want, update this issue, and get a plan going forward on what to update in this project to make it better for the user.

[kzantow]

Hi @klippx, this is a great suggestion! I didn't realize that old security alerts are hanging around, that definitely doesn't seem to be a great user experience. I think we should make the following changes:

• modify this action to upload sarif, so a separate step is not required
  • this may be a simple change to a composite action
• add another step / process to remove old entries as requested here

I don't think having the sarif upload managed separately from something cleaning it up, so I'd probably do both of these together.

[EnturWilhelm]

This is definitely a much needed improvement to the user experience for organizations using the security tab integration.

[vyas-n]

Does anyone have a workaround that they use to get around this issue?

The best that I've come up with is creating new branches + PRs and having the sarif uploaded via the PR to get a clean scan report for a point in time.