Grype scan and publish to CloudBees Unify

Use this action to perform static application security testing (SAST) on a binary TAR file using the Grype scanner, and view comprehensive security results in CloudBees Unify.

Prerequisites

Set up CloudBees Unify and GHA to work together, providing key features of CloudBees Unify to GHA workflows. For more information, refer to Set up GitHub Actions integration.

Inputs

Input name Data type Required? Description

binary-tar-path

String

Yes

The path of the binary to be scanned.

The binary file must be in the TAR format.

cloudbees-pat

String

Yes

The CloudBees Unify personal access token.

cloudbees-url

String

The CloudBees Unify URL. The default value is https://api.cloudbees.io.

Usage examples

Basic example

The following is a basic example of using this action:

      - name: Scan with Grype
        uses: cloudbees-io-gha/grype-scan-publish@v1
        with:
          binary-tar-path: example-tar-path.tar
          cloudbees-pat: ${{ secrets.CloudBees-platform-PAT }}▼

Full workflow example

The following GHA workflow example scans a repository with Grype.

name: Grype scan workflow

on:
  push:
    branches:
    - main

jobs:
  grype-codescan:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
        uses: actions/checkout@v3

      - name: Grype scan
        uses: cloudbees-io-gha/grype-scan-publish@v1
        with:
          binary-tar-path: path/to/my.tar
          cloudbees-pat: ${{ secrets.CLOUDBEES_PAT }}▼

After the GHA run has completed, the security findings are collected and displayed in the CloudBees Unify Component security center for the component containing the workflow.