CloudBees action: Scan with Mend SCA

1 minute read

Use this action to scan a Git repository with the Mend software composition analysis (SCA) scanner. Mend SCA can detect security vulnerabilities in open-source dependencies. The Mend scanner identifies the library license type used in your project, vulnerabilities in the dependencies, and possible fixes.

The Mend SCA scan task executes within the platform infra, so the only use of the Mend URL and credentials is to fetch the scanning rules and threshold. CloudBees does not upload anything else (no source code or images) from the customer.

Before the scan, the Mend action connects with the Mend server to get the rules and define some properties, including asset destination path, output path, project, and log level.

If you publish a Docker image in your workflow, this action runs a Mend container scan on the image, and generates a JSON-formatted report, available in the Security insights section of the platform analytics.

All CloudBees action repositories are listed at CloudBees, Inc. on GitHub.

Inputs

Table 1. Input details
Input name Data type Required? Description

server-url

String

Yes

The Mend server URL.

username

String

Yes

The Mend username.

token

String

Yes

The Mend client secret.

language

String

No

The language of your Git repository code base. Refer to Supported languages.

Supported languages

Table 2. Supported languages with inputs
Supported language Input format

Go

LANGUAGE_GO

Java

LANGUAGE_JAVA

JavaScript

LANGUAGE_JS

PHP

LANGUAGE_PHP

Ruby

LANGUAGE_RUBY

Usage example

In your YAML file, add:

      - name: Scan with Mend SCA
        uses: cloudbees-io/mend-sca-scan-dependency@v1
        with:
          server-url: ${{ vars.MEND_SERVER_URL }}
          username: ${{ secrets.MEND_USERNAME }}
          token: ${{ secrets.MEND_SECRET }}
          language: "LANGUAGE_JAVA"