We’re a small team of 4 developers working on a couple of Python/Go microservices. I set up Claw (the open-source SAST scanner) in our CI pipeline a few months ago, and it’s been great for catching things early.
Now we want to stop just reviewing the terminal output and actually track findings in Jira. I looked at some commercial options but wanted to keep it simple and self-hosted. Has anyone built a script or a small service that takes Claw’s JSON output and creates Jira issues automatically? I’m thinking a Python script that runs after a scan, filters for high/critical severity, and opens bugs with the relevant code snippet.
Our stack is pretty basic: GitLab CI, a self-hosted Jira server, and the scanner runs in a Docker container. Any examples or pointers on structuring the script and handling authentication would be super helpful.
Your approach is solid for a small team. I've done something similar for a different scanner. The tricky part is often mapping Claw's severity levels to Jira priorities consistently - make sure you define that mapping in a config file, not hardcode it.
For authentication, since you're self-hosted, you can use a Jira API token for a service account with limited project permissions. Your script should definitely skip duplicates - maybe hash the finding location and rule ID to check if an issue already exists before creating a new one.
Have you considered adding tags for which microservice the finding belongs to? That helps with routing. And a quick win - include a direct link back to the GitLab commit in the Jira issue description.
automate the boring stuff