Page Comparison

displayMode

String

How to display Mend security information for a scan performed on a non-base branch:

• When set to diff - Only the diff of detected vulnerabilities between the current commit and its base branch commit will be displayed. NOTE: This value is only supported when using the baseBranches configuration.

• When set to baseline - A summary of all detected vulnerabilities in the full repository inventory will be displayed.

No

diff

vulnerableCommitStatus

String

Customizable commit status settings.

• FAILED - If the Mend scan detects vulnerabilities in a repository, the commit status will show a "failure" indicating that vulnerabilities were detected.
  If no vulnerabilities were detected, the commit status shows a "success" indicator. (default option)

• SUCCESS - The commit status will show a success indicator at the end of the scan regardless of whether the scan detected vulnerabilities in the repository.

• NONE - The commit status will not be updated by Mend under any circumstances, not even to a "running" indicator while the scan is in progress.

No

FAILED

licenseCommitStatus

String

Customizable commit status settings.

NOTE: The license check is dependent on the vulnerabilities check and will not be triggered if vulnerableCommitStatus is set to none.

• FAILED - If the Mend scan detects license policy violations in a repository, the commit status will show a "failure" indicating that license policy violations were detected.
  If no license policy violations were detected, the commit status shows a "success" indicator. (default option)

• SUCCESS - The commit status will show a success indicator at the end of the scan regardless of whether the scan detected license policy violations in the repository.

• NONE - The commit status will not be updated by Mend under any circumstances, not even to a "running" indicator while the scan is in progress.

No

FAILED

iacCommitStatus

String

Customizable commit status settings.

• FAILED - If the Mend scan detects iac vulnerabilities in a repository, the commit status will show a "failure" indicating that iac vulnerabilities were detected.
  If no iac vulnerabilities were detected, the commit status shows a "success" indicator. (default option)

• SUCCESS - The commit status will show a success indicator at the end of the scan regardless of whether the scan detected vulnerabilities in the repository.

• NONE - The commit status will not be updated by Mend under any circumstances, not even to a "running" indicator while the scan is in progress.

No

FAILED

showWsInfo

Boolean

Whether to show additional Mend information such as the project token inside the Mend Commit Status (after the scan token).

Mend information is only displayed if the commit originated from a base branch.
If the commit exists in multiple branches, the Mend information displayed will only represent the origin base branch (i.e. where the baseBranches parameter was defined).

The following hidden JSON object will also be added inside the Commit Status when this parameter is enabled:

<!-- <INFO>{"projectToken":"1cd2d2a8651145c087609e0a43f783e95f7008cb908541498348fed529572e01"}</INFO> -->

NOTE: Additional Mend data may be added inside the JSON object in the future.

No

false

useMendStatusNames

Boolean

If set to true names of all Checks (Security, License, SAST, IaC) will be named after Mend (e.g. “Mend Security Check”). If set to false all Checks will have word “WhiteSource” instead of “Mend”.

Note: When .whitesource is created the value of useMendCheckNames is true.

No

false