Github Advanced Security

Frogbot integrates with GitHub's security features to surface scan results directly in the GitHub UI. It performs both full repository scans and pull request (PR) scans so developers can review findings in their native GitHub workflow.

PR Decorations

When Frogbot runs a PR scan, it posts comments directly on the pull request with details about new security issues introduced by the change. Each comment includes:

• The CVE or finding identifier
• Severity level
• Affected component and version
• Fix version (if available)
• Contextual analysis status (applicable, not applicable, etc.)

Configuring PR Decorations

With centralized configuration, PR decoration behavior is managed from the JFrog Platform:

• Show all security finding types — When enabled, PR comments include both vulnerabilities and policy violations. When disabled (default), only new vulnerabilities are shown.
• Skip comments on pull requests with no security issues — When enabled, Frogbot does not post a comment on clean PRs. This reduces noise for teams with many pull requests.

These settings can be configured in the Platform UI under the PR Decorations tab, or via the frogbot-config.yml file.

Scan Results in GitHub Security

Frogbot uploads results to GitHub's Code Scanning feature using SARIF format. Results appear in the Security > Code scanning alerts tab of your repository.

Before You Begin

• Enable GitHub code scanning for the repositories you wish to scan.
• Full repository scans (commit scans) automatically appear in GitHub Security.
• PR scan results must be enabled manually (see below).

Enable PR Security Results

By default, PR scan results are not uploaded to GitHub Code Scanning. To upload them, set:

JF_UPLOAD_PR_SECURITY_RESULTS_TO_VCS=true

This option is available from Frogbot v3.4.

Viewing Results

1. In your GitHub repository, go to the Security tab.
2. In the left pane, select Code scanning alerts.
   • Full repository scan results appear under the scanned branch and are filtered by branch:<branch-name>.
   • PR scan results appear under the scanned PR and are filtered by pr:<pr-number>.
3. (Optional) Use the Tool filter to view results from specific scanners:
   • JFrog Xray scanner — SCA findings (vulnerabilities in dependencies)
   • JFrog SAST — Static analysis findings in first-party code
   • JFrog Secrets scanner — Detected secrets and credentials
   • JFrog Terraform scanner — IaC misconfiguration findings
4. Click an issue to view its details.

GitHub Dependency Graph (SBOM)

Frogbot generates an SBOM for each scanned repository and publishes it to the repository’s Dependency graph in GitHub. This lets developers review direct and transitive dependencies within their native GitHub workflow.

Before You Begin

• Requires a JFrog Advanced Security license
• Enable GitHub Dependency Graph for the repositories you wish to publish SBOMs to
• JF_UPLOAD_SBOM_TO_VCS must be true (default). To disable automatic SBOM upload, set it to false. See Advanced Management and Configuration.

SBOM upload occurs during commit scans (repository scans), not PR scans.

Viewing the SBOM

1. In your GitHub repository, go to Insights > Dependency graph.
2. Open the SBOM view (if available) to see the latest SBOM uploaded by Frogbot, or review the dependency list populated from the SBOM.
3. Click a dependency to view details such as version, relationships, and metadata.