CloudBees action: Scan with GitHub Advanced Security

Use this action to scan a public GitHub repository with the GitHub Advanced Security tool. GitHub Advanced Security can detect security vulnerabilities and coding errors in your code.

Scanning of private GitHub repositories is not supported.

All CloudBees action repositories are listed at CloudBees, Inc. on GitHub.

Prerequisites

A Personal Access Token (PAT) with read-only permission is required to read security alerts (which must be enabled) from the public repository. This token is used in the YAML file, which pushes the alerts to CloudBees platform.

Enable security alerts

Refer to the following GitHub documentation for information on enabling these alerts for your repository:

Refer to the following GitHub documentation for information on setting code scanning (CodeQL analysis) to default:

Configuring the default setup for code scanning

Create a PAT

CloudBees requires a fine-grained GitHub PAT to read the security alerts from your repository.

To create a fine-grained PAT, refer to the GitHub documentation.

CloudBees recommends the following configuration:

The fine-grained PAT has read-only access to the Dependabot, Code scanning, and Secret scanning alerts.
The repository for which the token is created has read-only access.

Use the fine-grained PAT in the YAML file to invoke the action.

Inputs

Table 1. Input details
Input name	Data type	Required?	Description
`token`	String	Yes	The GitHub client secret.
`language`	String	No	The language of your Git repository code base. Refer to Supported languages.
`github-url`	String	No	The GitHub URL of the repository to be scanned.
`branch-name`	String	No	The branch in your repository to be scanned.

Supported languages

Table 2. Supported languages with inputs
Supported language	Input format
Go	`LANGUAGE_GO`
Java	`LANGUAGE_JAVA`

Usage example

In your YAML file, add:

      - name: Scan with GitHub Advanced Security
        uses: cloudbees-io/github-security-sast-scan-code@v1
        with:
          token: ${{ secrets.GITHUB_SECRET }}
          language: "LANGUAGE_JAVA"▼