Merge branch 'dev' of https://github.com/jfrog/frogbot into security-tab

jfrog · omerzi · Aug 22, 2022 · Jun 28, 2022 · Jun 29, 2022 · Jul 5, 2022
commit c479882fb2c46f4b8c834f3f199a12194ab37518
diff --git a/README.md b/README.md
@@ -98,8 +98,24 @@ If new vulnerabilities are found, Frogbot adds them as a comment on the pull req
 | ![](https://raw.githubusercontent.com/jfrog/frogbot/master/resources/mediumSeverity.png) Medium | github.com/nats-io/nats-streaming-server | v0.21.0 | [0.24.3]       | github.com/nats-io/nats-streaming-server |      v0.21.0      | CVE-2022-26652 |
 
 ## Pull requests opening
-Frogbot scans your Git repository and automatically opens pull requests for upgrading vulnerable dependencies to a version with a fix.
-Frogbot uses [JFrog Xray](https://jfrog.com/xray/) for the scanning. The scanning is triggered following commits that are pushed to the repository. For pull requests opening, please note that GitHub and GitLab are currently supported and Bitbucket will be supported soon. Projects that use one of the following tools to download their dependencies are currently supported.
+
+Frogbot scans your Git repository and automatically opens pull requests for upgrading vulnerable dependencies to a
+version with a fix.
+Frogbot uses [JFrog Xray](https://jfrog.com/xray/) for the scanning.
+
+Frogbot uploads the scanning results under the 'Code scanning alerts' section of the repository's Security tab:
+
+![img.png](img.png)
+
+You can see all the vulnerable packages that Frogbot identified here:
+
+![img_1.png](img_1.png)
+
+**NOTE that the code scanning alerts must be enabled.**
+
+The scanning is triggered following commits that are pushed to the repository. For pull requests opening, please note
+that GitHub and GitLab are currently supported and Bitbucket will be supported soon. Projects that use one of the
+following tools to download their dependencies are currently supported.
 
 - npm
 - Maven
@@ -108,16 +124,22 @@ Frogbot uses [JFrog Xray](https://jfrog.com/xray/) for the scanning. The scannin
 <div id="installing-and-using-frogbot"></div>
 
 ## 🖥️ Installing and using Frogbot
+
 ### General
-1. Frogbot requires a JFrog environment to scan pull requests. Don't have a JFrog environment? No problem - [Set Up a FREE JFrog Environment in the Cloud](#set-up-a-free-jfrog-environment-in-the-cloud). You'll later save the connection details (URL, username, and password) as secrets in Git.
+
+1. Frogbot requires a JFrog environment to scan pull requests. Don't have a JFrog environment? No problem
+   - [Set Up a FREE JFrog Environment in the Cloud](#set-up-a-free-jfrog-environment-in-the-cloud). You'll later save
+     the connection details (URL, username, and password) as secrets in Git.
 2. [Setting up Frogbot on GitHub repositories](#setting-up-frogbot-on-github-repositories)
 3. [Setting up Frogbot on GitLab repositories](#setting-up-frogbot-on-gitlab-repositories)
 4. [Setting up Frogbot on Bitbucket Server repositories](#setting-up-frogbot-on-bitbucket-server-repositories)
 
 ### Set up a FREE JFrog Environment in the cloud
+
 Need a FREE JFrog environment in the cloud, so Frogbot can scan your pull requests?
 
-Just run one of the following commands in your terminal, to set up an environment in less than a minute. The commands will do the following:
+Just run one of the following commands in your terminal, to set up an environment in less than a minute. The commands
+will do the following:
 
 1. Install [JFrog CLI](https://www.jfrog.com/confluence/display/CLI/JFrog+CLI) on your machine.
 2. Create a FREE JFrog environment in the cloud for you.

diff --git a/commands/createfixpullrequests.go b/commands/createfixpullrequests.go
@@ -21,13 +21,13 @@ type CreateFixPullRequestsCmd struct {
 }
 
 func (cfp CreateFixPullRequestsCmd) Run(params *utils.FrogbotParams, client vcsclient.VcsClient) error {
-	//Scan the current Branch
+	// Scan the current Branch
 	scanResults, err := cfp.scan(params)
 	if err != nil {
 		return err
 	}
 
-	//Upload scan results to the relevant Git provider code scanning UI
+	// Upload scan results to the relevant Git provider code scanning UI
 	err = utils.UploadScanToGitProvider(scanResults, params, client)
 	if err != nil {
 		return err

diff --git a/img.png b/img.png
diff --git a/img_1.png b/img_1.png