We are using Fortify SCA in our Gitlab CI/CD pipeline and we are having issues with suppressions. Currently, we create a branch, work in that branch and scans are run, the devs suppress known findings and when we merge back to main, the suppressions do not get stored. Are we missing a tool. I read somewhere that the SSC tool is what stores and manages that data.

Please forgive my limited knowledge, I am just trying to figure out why fortify is not integrating well with gitlab when its supposed to be fully supported.

End result is to suppress findings in the branch for known findings, we then fix whatever other findings are there, and merge back to main. When we are done, main retains those suppressions and we dont have to do all that again to successfully pass scans.

Thanks in advance,

Derek