Use the scanners in CI/CD

Integrating any Fluid Attacks scanner into your CI/CD pipeline enables automated security testing throughout your software development lifecycle (SDLC).

Below are examples of how to configure the SAST scanner on popular CI/CD providers. Replace the container URI and command with the ones from the specific scanner.

Run on GitHub Actions


# .github/workflows/dev.ymlname: Standalone CLIon: [push, pull_request]jobs:   machineStandalone:      runs-on: ubuntu-latest      steps:         - uses: actions/checkout@f095bcc56b7c2baf48f3ac70d6d6782f4f553222         - uses: docker://docker.io/fluidattacks/sast:latest           name: sastStandalone           with:             args: sast scan /dir/to/scan

Here is an example of running the DAST scanner instead of the SAST one, so it analyzes your web application endpoint:


# .github/workflows/dev.ymlname: DAST Analysison: [push, pull_request]jobs:   machineStandalone:      runs-on: ubuntu-latest      steps:         - uses: actions/checkout@f095bcc56b7c2baf48f3ac70d6d6782f4f553222         - uses: docker://docker.io/fluidattacks/probes:latest           name: dastStandaloneAnalysis           with:             args: probes scan https://myapp.com

Run on GitLab CI


# .gitlab-ci.ymlmachineStandalone:image: docker.io/fluidattacks/sast:latestscript:   - sast scan /dir/to/scan

Run on Travis CI


# .travis.ymlservices:    - dockerbefore_install:    - docker pull fluidattacks/sast:latest    - docker run fluidattacks/sast:latest /bin/bash -c "cd /dir/to/scan"script:    - sast scan .

Other providers

For any other provider, please refer to the documentation relevant for each case. The scanners can be executed on any CI/CD provider that supports Docker images. In some cases, you need to use Docker in Docker (DinD) to be able to use the scanners. For example, for Bitbucket Pipelines.

Bitbucket Pipelines


# bitbucket-pipelines.yml


pipelines:


  default:


    - step:


      name: Fluid-Attacks-SAST-Scanner


      services:        - docker      script:


        - docker pull fluidattacks/sast:latest        - docker run -v $pwd:src fluidattacks/sast:latest sast scan ./src/config.yaml

General recommendations

Break the build: To halt your CI/CD pipeline when vulnerabilities are detected, utilize the strict option in your configuration file. See the configuration documentation for details.
Handling false positives: During development, if the scanner reports what you consider a false positive, employ the exclusions as code feature to prevent it from being reported in future scans.

Troubleshooting

For solutions to common errors and issues encountered during the scanning process, consult the scanner FAQ .

Tip

Free trial Search for vulnerabilities in your apps for free with Fluid Attacks’ automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan . If you prefer the Advanced plan, which includes the expertise of Fluid Attacks’ hacking team, fill out this contact form .