How to analyze several targets and report a single SARIF file?

[Lucas-C]

Hi

In my project, I have several requirement files (docs/requirements.txt, test/requirements.txt, test/linters-requirements.txt, contributors/requirements.txt).

How could I use GuardDog to analyze all those files and then upload a single SARIF file?

[sobregosodd]

Hello @Lucas-C ,

Theoretically latest version of guarddog supports pointing the verify command towards a folder, so suppose you have a project called /tmp/your_project, you can: guarddog pypi verify /tmp/sample_project and every requirement file will be treated as an artifact.

e.g.:

> mkdir -p /tmp/sample_project
> mkdir -p /tmp/sample_project/docs
> mkdir -p /tmp/sample_project/test
> mkdir -p /tmp/sample_project/others
> echo "requests" > /tmp/sample_project/docs/requirements.txt
> echo "mypy" > /tmp/sample_project/test/requirements.txt
> echo "black" > /tmp/sample_project/others/requirements.txt
> guarddog pypi verify /tmp/sample_project --output-format=sarif

The only problem is that the file must be called requirements.txt or requirements-dev.txt to be properly identified, that means that test/linters-requirements.txt won't be picked, if you mandatorily need to, you can move all requirements.txt to a temporal folder as i did in the example with a script prior to execute guarddog.

FYI: I'm moving this issue to a discussion for better visibility.

[Lucas-C]

Thank you for your answer @sobregosodd, I will try that approach