Connect a repository
Connect GitHub, GitLab or Bitbucket repositories to Code Security, choose the scanners, branches and gate, and start the first scan in a few steps.
Connecting a repository gives Infraista read access to its code and permission to report a status check on commits and pull requests. Scans start from your Git provider's events, so nothing needs to change in the repository.
Who can do this: owners and admins, or a role that can manage Code Security.
Connect
- Open Code Security and select Connect repository.
- Repositories: pick your Git connection (or connect GitHub, GitLab or Bitbucket here), then select one or more repositories. Repositories that are already scanned are marked.
- What to scan: turn on the scanners you want. At least one must be on.
- When: choose what's scanned.
- Scan on push: each repository's default branch is always scanned. Add other branches or
patterns, like
developorrelease/*. - Pull requests: scan every pull request and report the result on it. Only findings the pull request adds can fail the check.
- Nightly scan: rescans the default branch every night at the time you choose (UTC), so advisories published after your last push still show up.
- Scan on push: each repository's default branch is always scanned. Add other branches or
patterns, like
- Gate & alerts: your organization's policy decides when the check fails. Optionally make it stricter for these repositories, and pick the notification channels for each alert.
- Select Connect and scan.
The first scan of each repository starts right away. You can leave the page while it runs.
Block merges when the gate fails
Each scan reports the infraista/security status check. To stop risky changes from being merged, make
it a required status check in your repository's branch protection rules. The check name can be
changed in the repository's Settings; if you rename it, update branch protection too.
On GitHub, each scan also adds a check run named Infraista Code Security, which shows the scan's new findings on their lines in the pull request's Files tab.
Alerts
Pick notification channels for each event (the same channels Pipelines and Monitoring use):
| Event | When |
|---|---|
| Gate failed | Any scan whose gate fails, on a branch or a pull request |
| New Critical or High on the default branch | A scan of the default branch finds new Critical or High findings |
| Secret found | Right away, whatever the gate says |
| Weekly digest | Mondays 08:00 UTC: open findings, the week's new and fixed findings and scans, and anything past its fix-by date |
Related
Code Security
Scan every push and pull request for vulnerable dependencies, leaked secrets, risky configuration and license issues, with a check that blocks risky changes.
Scans and the gate
How Code Security scans a commit, compares it with the branch it targets, decides whether the gate passes or fails, and grades each repository from A to F.