CloudBees action: Scan with GitHub Advanced Security

Use this action to scan a public GitHub repository with the GitHub Advanced Security tool. GitHub Advanced Security can detect security vulnerabilities and coding errors in your code.

Note	Scanning of private GitHub repositories is not supported.

Prerequisites

A Personal Access Token (PAT) with read-only permission is required to read security alerts (which must be enabled) from the public repository. This token is used in the YAML file, which pushes the alerts to {PRODUCT}.

Enable security alerts

Refer to the following GitHub documentation for information on enabling these alerts for your repository:

• Configuring dependabot alerts

• Enabling secret scanning for your repository

Refer to the following GitHub documentation for information on setting code scanning (CodeQL analysis) to default:

• Configuring the default setup for code scanning

Create a PAT

CloudBees requires a fine-grained GitHub PAT to read the security alerts from your repository.

To create a fine-grained PAT, refer to the GitHub documentation.

Note	CloudBees recommends the following configuration: The fine-grained PAT has read-only access to the Dependabot, Code scanning, and Secret scanning alerts. The repository for which the token is created has read-only access.

Use the fine-grained PAT in the YAML file to invoke the action.

Inputs

Table 1. Input details

Input name	Data type	Required?	Description
token	String	Yes	The GitHub client secret.
language	String	No	The language of your Git repository code base. Refer to the supported languages below.
github-url	String	No	The GitHub URL of the repository to be scanned.
branch-name	String	No	The branch in your repository to be scanned.

Supported languages

Table 2. Supported languages with inputs

Supported language	Input format
Go	LANGUAGE_GO
Java	LANGUAGE_JAVA

Usage example

In your YAML file, add:

      - name: Scan with GitHub Advanced Security
        uses: cloudbees-io/github-security-sast-scan-code@v1
        with:
          token: ${{ secrets.GITHUB_SECRET }}
          language: "LANGUAGE_JAVA"

License

This code is made available under the MIT license.

References

• Learn more about using actions in CloudBees workflows.

• Learn about the CloudBees platform.