Discussing Default Branch Baseline Feature for DefectDojo to Improve Findings Management Across Branches
Hey, I was thinking of a “bigger” change to DefectDojo so likely good to discuss here to decide whether it goes as upstream-compatible or just for the fork 😄 In SonarQube there’s the notion of “default branch” mapping to the actual VCS default branch. This allows SonarQube to baseline findings and only present “new findings” when looking at a non-default branch scan. In Dojo, we can already leverage the “branch” import field to achieve something similiar but:
If finding was flagged in main first, it will be duplicate in dev, so not shown (when filtering for active in dev)
But if dev is merged to mainwith valid findings (mitigated or still open), the findings in main will be the duplicated ones
if there’s a new branch bugfix and we scan it, active in bugfix will still work (as bugfix != dev as well)
But if we want findings active in main only it won’t, as the ones from dev branch won’t show even though they are in main too
Let alone the fact that this relies on branches having unique names always instead of comparing them specifically to a baseline
Did this make sense? Has this been discussed before?
