Grype scan and publish to the CloudBees platform

Use this action to perform static application security testing (SAST) on a binary TAR file with the Grype scanner, and then view comprehensive security results in the CloudBees platform.

Prerequisites

Set up the CloudBees platform and GHA to work together, providing key features of the platform to GHA workflows. Refer to Getting started for more information.

Inputs

Input name Data type Required? Description

binary-tar-path

String

Yes

The path of the binary to be scanned.

The binary file must be in the TAR format.

cloudbees-pat

String

Yes

The CloudBees platform personal access token.

cloudbees-url

String

The CloudBees platform URL. The default value is https://api.cloudbees.io.

Usage examples

Basic example

The following is a basic example of using this action:

      - name: Scan with Grype
        uses: cloudbees-io-gha/grype-scan-publish@v1
        with:
          binary-tar-path: example-tar-path.tar
          cloudbees-pat: ${{ secrets.CloudBees-platform-PAT }}▼

Full workflow example

The following GHA workflow example scans a repository with Grype.

name: Grype scan workflow

on:
  push:
    branches:
    - main

jobs:
  grype-codescan:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
        uses: actions/checkout@v3

      - name: Grype scan
        uses: cloudbees-io-gha/grype-scan-publish@v1
        with:
          binary-tar-path: path/to/my.tar
          cloudbees-pat: ${{ secrets.CLOUDBEES_PAT }}▼

After the GHA run has completed, the security findings are collected and displayed in the CloudBees platform Security center of the component containing the workflow.