How can we get SAST point using sonarcloud ?

[sbernard31]

I activated sonarcloud on my project.

And I still get 0 point concerning SAST score.

Currently, I have only 1 PR merged which was analyze by sonar.
And I read at documentation :

SonarCloud in the recent (~30) merged PRs

So maybe :

1. I have no point because I haven't enough PR.
2. but also I didn't setup sonarcloud in the expected way by scorecard.

Could you give me some hint about that ?
Maybe 1 PR should give me at least 1 point so I see that something changed ?

[spencerschrock]

It may just be a matter of Sonar changing their GitHub app slug (ID).

If I make this change, I see it score your most recent 3 PRs:

diff --git a/checks/raw/sast.go b/checks/raw/sast.go
index 0d654c2c..20d70389 100644
--- a/checks/raw/sast.go
+++ b/checks/raw/sast.go
@@ -42,6 +42,7 @@ var sastTools = map[string]bool{
        "github-code-scanning":     true,
        "lgtm-com":                 true,
        "sonarcloud":               true,
+       "sonarqubecloud":           true,
 }

      "details": [
       "Debug: tool detected: sonarqubecloud",
       "Debug: tool detected: sonarqubecloud",
       "Debug: tool detected: sonarqubecloud",
       "Warn: 3 commits out of 23 are checked with a SAST tool"
     ],
     "score": 1,
     "reason": "SAST tool is not run on all commits -- score normalized to 1",
     "name": "SAST",

[spencerschrock]

On the order of month. While it may be merged this week or next, we're trying to target a 2 month release cadence.

[sbernard31]

@spencerschrock do you know if a release is plan for soon ?

[spencerschrock]

on my list of things to do this week, was planned for last week, but we had an issue with our weekly scan infrastructure that took priority.

[spencerschrock]

@sbernard31 https://github.com/ossf/scorecard-action/releases/tag/v2.4.2

[sbernard31]

@spencerschrock I upgraded and now get some point for SAST Tooling 👍

See : https://scorecard.dev/viewer/?uri=github.com/eclipse-leshan/leshan

Thx 🙏

If you need help on issues I opened, do not hesitate to ask.