CloudBees action: Scan with Mend SCA

Use this action to scan a Git repository with the Mend software composition analysis (SCA) scanner. Mend SCA can detect security vulnerabilities in open-source dependencies. The Mend scanner identifies the library license type used in your project, vulnerabilities in the dependencies, and possible fixes.

The Mend SCA scan task executes within the platform infra, so the only use of the Mend URL and credentials is to fetch the scanning rules and threshold. CloudBees does not upload anything else (no source code or images) from the customer.

Before the scan, the Mend action connects with the Mend server to get the rules and define some properties, including asset destination path, output path, project, and log level.

If you publish a Docker image in your workflow, this action runs a Mend container scan on the image, and generates a JSON-formatted report, available in the Security insights section of the platform analytics.

All CloudBees action repositories are listed at CloudBees, Inc. on GitHub.

Inputs

Table 1. Input details
Input name	Data type	Required?	Description
`server-url`	String	Yes	The Mend server URL.
`username`	String	Yes	The Mend username.
`token`	String	Yes	The Mend client secret.
`language`	String	No	The language of your Git repository code base. Refer to Supported languages.

Supported languages

Table 2. Supported languages with inputs
Supported language	Input format
Go	`LANGUAGE_GO`
Java	`LANGUAGE_JAVA`
JavaScript	`LANGUAGE_JS`
PHP	`LANGUAGE_PHP`
Ruby	`LANGUAGE_RUBY`

Usage example

In your YAML file, add:

      - name: Scan with Mend SCA
        uses: cloudbees-io/mend-sca-scan-dependency@v1
        with:
          server-url: ${{ vars.MEND_SERVER_URL }}
          username: ${{ secrets.MEND_USERNAME }}
          token: ${{ secrets.MEND_SECRET }}
          language: "LANGUAGE_JAVA"▼