Complete list of Bridge arguments

Bridge CLI Guide
Version
latest
This page lists all the arguments that Bridge CLI supports. Arguments can be passed through environment variables, command line or a JSON file.
Note: We recommend that you pass sensitive information such as access tokens using environment variables.

For a list of arguments that are common to all Black Duck security products, refer to Universal Bridge CLI arguments below.

For product specific arguments, refer to the product specific sections below:
For integrating Bridge with different SCM platforms, refer to the SCM specific sections below:

Universal Bridge CLI arguments

These arguments can be passed on the command line, but not as part of a JSON file.

Command Description Required?
bridge-cli Command to invoke Bridge CLI. Yes
--stage The --stage command specifies the Black Duck security product you are integrating with (such as --stage polaris). Yes
--input The --input command loads a JSON file containing common arguments to run scans Required for inputting a JSON files.
--help Shows the help file for Bridge CLI. No
--json-log Outputs JSON format logs. See Logging and Diagnostics. No
--json-log-file Outputs JSON format logs in the bridge.log file in the Bridge CLI home directory. See Logging and Diagnostics. No
--home Sets the directory where Bridge CLI writes logs and adapter output (default is .bridge). No
--version Returns the version of Bridge CLI executable. No
--schema Specifies a schema to load No
--verbose Turns on verbose logging. No
--diagnostics Enables debug logs under the Bridge CLI home directory. Creates a diagnostics.json file containing the final state data inside the Bridge CLI home directory, but masking sensitive information like tokens and passwords. See Logging and Diagnostics. No
--out <outFile> Creates an output file with the file name and location provided by the user. This file will contain the final state data with masked sensitive information. To include sensitive information in the file, use --include-sensitive-information with --out. No
--list <name> Show a list of tools and workflows. No

Networking

Argument Input mode Required Notes
  Command line argument Environment variable JSON field    
Air Gap mode network.airgap BRIDGE_NETWORK_AIRGAP network.airgap No

Default: false

This option is not applicable to Coverity, or Polaris users.

For Black Duck® SCA users, Bridge CLI downloads Detect from Black Duck artifactory on the Internet by default. If network.airgap is set to true, Bridge CLI does not download tools from the public Black Duck artifactory. You must make sure an airgap version of Detect exists locally.
Note: Air gap only curtails access to the public Internet. Bridge CLI still needs access to your Black Duck® SCA Hub server even when this option is set to true.
Note: SCM API URL is required if you are using the PR comment or Create Fix Pull request features. If not set, Bridge returns an error.
  • github.host.url for GitHub
  • gitlab.api.url for GitLab
  • azure.api.url for Azure DevOps.
Self-Signed Certificate File network.ssl.cert.file BRIDGE_NETWORK_SSL_CERT_FILE network.ssl.cert.file No

Accepts a string: you may pass the Certificate file path.

  • Available for Coverity Connect only.

  • If this option is used, then Bridge will trust the self-signed certificate file passed.
Trust All Certificates network.ssl.trustAll BRIDGE_NETWORK_SSL_TRUSTALL network.ssl.trustAll No

Default: false

  • Available for Coverity Connect and Black Duck SCA only.

  • When this option is set to true, Bridge will trust all certificates.

Client scan tool parameters

The table below describes the parameters for configuring Bridge to integrate with client scanning tools that are run locally during builds.

Tool

Argument

Input mode

Required

Notes
Command line argument Environment variable Json field
Coverity Build Command coverity.build.command BRIDGE_COVERITY_BUILD_COMMAND coverity.build.command No

Build command for the project to be passed to Coverity.
Clean Command coverity.clean.command BRIDGE_COVERITY_CLEAN_COMMAND coverity.clean.command No

Clean command for the project to be passed to Coverity
Coverity Config File Location coverity.config.path BRIDGE_COVERITY_CONFIG_PATH coverity.config.path No

Path to coverity.yml file to be passed to Coverity

Generic Arguments

 coverity.args BRIDGE_COVERITY_ARGS coverity.args No

Pass generic arguments to Coverity CLI

If you are a Coverity user, you can see the list of arguments you can use. Reference: Black Duck Documentation Portal

Note: Check options compatibility with your platform before using them.

Black Duck® SCA Detect

 Detect Search Depth detect.search.depth BRIDGE_DETECT_SEARCH_DEPTH detect.search.depth No

Search Depth to be passed to Black Duck-Detect
Detect Config File Location detect.config.path BRIDGE_DETECT_CONFIG_PATH detect.config.path No

Path to configuration file - to be passed to Detect
Generic Arguments detect.args BRIDGE_DETECT_ARGS detect.args No

Pass any argument to Detect.

If you are a Black Duck® SCA Detect user, you can see the list of arguments you can use.Reference: Black Duck Documentation Portal

Note:

Check options compatibility with your platform before using them.

Polaris

Arguments to pass
Note: If the application doesn't already exist in Polaris, Bridge will try and create it before triggering a CI scan. If you have concurrent subscription / team member enabled, the application creation will be successful. If you have parallel subscription, application creation will fail.
Argument Input mode Required Notes
  Command line argument Environment variable JSON field    
Access token polaris.accesstoken BRIDGE_POLARIS_ACCESSTOKEN polaris.accesstoken Yes For security reasons, it is recommended that you pass this as an environment variable.
Server URL polaris.serverurl BRIDGE_POLARIS_SERVERURL polaris.serverurl Yes Polaris server URL
Application Name polaris.application.name BRIDGE_POLARIS_APPLICATION_NAME polaris.application.name Yes Application must exist on Polaris, and have right entitlements. If the application doesn't already exist in Polaris, Bridge will try to create it before triggering a CI scan. If you have concurrent subscription / team member enabled, the application creation will be successful. If you have parallel subscription, application creation will fail.
Project Name polaris.project.name BRIDGE_POLARIS_PROJECT_NAME polaris.project.name Yes. The specified project is created on Polaris if it doesn’t exist.

If you don’t want the project to be created, set polaris.onboarding to false.

Assessment Type polaris.assessment.types BRIDGE_POLARIS_ASSESSMENT_TYPES polaris.assessment.types Yes
Comma separated values. Accepted values:
  • SAST
  • SCA
  • DAST
  • SAST, SCA

Further configuration requirements for SAST, SCA, and DAST scans are found here: Using Bridge CLI with Polaris.
Tool Install Directory tool.install.directory BRIDGE_TOOL_INSTALL_DIRECTORY tool.install.directory No Directory to which Bridge downloads the underlying scan tools. Defaults to <User>/.blackduck/bridge/tools.
Auto Create Projects polaris.onboarding BRIDGE_POLARIS_ONBOARDING polaris.onboarding No If set to true, Bridge will attempt to create the project on Polaris if it does not exist. Default is true.
Polaris Project branch name polaris.branch.name BRIDGE_POLARIS_BRANCH_NAME polaris.branch.name Yes

Branch name in the Polaris server. If the branch does not exit, it creates the branch if polaris.onboarding is set to true.

If polaris.onboarding is not enabled, the call will error out.

If a branch name is not provided, Bridge will error out and no tests will be created.
Enable PR Comments polaris.prcomment.enabled BRIDGE_POLARIS_PRCOMMENT_ENABLED polaris.prcomment.enabled No Boolean. Enables and disables the PR Comment feature. Defaults is false.
Enable Fix PRs polaris.fixPR.enabled BRIDGE_POLARIS_FIXPRR_ENABLED polaris.fixPR.enabled No Enables or disables the Polaris Fix PR workflow.

Default: false
Use upgraded guidance for Fix PRs polaris.fixPR.useUpgradeGuidance BRIDGE_POLARIS_FIXPR_UPGRADEGUIDANCE polaris.fixPR.useUpgradeGuidance No Specifies whether to use only short term guidance, only long term guidance, or an ordered preference that allows both for SCA Fix PRs. Bridge tries the guidance values in the order provided.
Values:
  • SHORT_TERM
  • LONG_TERM
  • SHORT_TERM,LONG_TERM
  • LONG_TERM,SHORT_TERM

Default:SHORT_TERM,LONG_TERM
Configure when Fix PRs are raised polaris.fixPR.filter.severities BRIDGE_POLARIS_FIXPR_FILTER_SEVERITIES polaris.fixPR.filter.severities No

Bridge creates Fix PRs only for issues with a severity matching a filter. This applies to both SAST and SCA if both assessment types are enabled.

Values: One or more of the following, separated by commas:
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW

Default: CRITICAL,HIGH
Configure max number of fix PRs that are created on a branch polaris.fixPR.maxCount BRIDGE_POLARIS_FIX_PR_MAXCOUNT polaris.fixPR.maxCount No Max number of fix PRs created on a branch across both SAST and SCA scans, with SAST evaluated first. Dismissed issues are excluded, then the polaris.fixPR.filter.severities allow list is applied. Issues are sorted by severity (descending) and first-detected date (ascending, with undated issues last), and only the first maxCount results are selected.

Default: 5
Polaris parent branch name polaris.branch.parent.name BRIDGE_POLARIS_BRANCH_PARENT_NAME polaris.branch.parent.name No Parent Branch name in the Polaris server. Applicable only if PR Comments is enabled. For GitHub users only, Bridge reads parent branch name from github.branch.parent.name. All other users must specify parent branch name using this option.
Severities for which the PR Comments should be created. polaris.prcomment.severities BRIDGE_POLARIS_PRCOMMENT_SEVERITIES polaris.prcomment.severities No Defaults to ["high", "critical"].
Enable/disable SARIF report generation polaris.reports.sarif.create BRIDGE_POLARIS_REPORTS_SARIF_CREATE polaris.reports.sarif.create No

Set to "true" to generate a SARIF report.

Default: false
File path where the SARIF file will be created. polaris.reports.sarif.file.path BRIDGE_POLARIS_REPORTS_SARIF_FILE_PATH polaris.reports.sarif.file.path No

Defines where the SARIF file will be created. (A file name must be included.)

Default: <BRIDGE_HOME>/Polaris SARIF Generator/report.sarif.json
List of severities to match. for SARIF file report polaris.reports.sarif.severities BRIDGE_POLARIS_REPORTS_SARIF_SEVERITIES polaris.reports.sarif.severities No

Only issues that match one of the indicated severities will be included in the SARIF file report. (Severities are case-insensitive.)

For example, ["high", "critical"]

No validations shall be done.

If this is not configured, by default all severities are considered.
Indicate which assessment issues type to include in SARIF file report polaris.reports.sarif.issue.types BRIDGE_POLARIS_SARIF_ISSUE_TYPES polaris.reports.sarif.issue.types No Value of "assessment.types" resource
Flag to enable/disable Component-Version grouping for SCA Issues in SARIF report rules section. polaris.reports.sarif.groupSCAIssues BRIDGE_POLARIS_REPORTS_SARIF_GROUPSCAISSUES polaris.reports.sarif.groupSCAIssues No

Set to "true" to enable grouping of SCA issues by component.

Default: true
The test mode type for this scan. polaris.assessment.mode BRIDGE_POLARIS_ASSESSMENT_MODE polaris.assessment.mode No Default: CI, to scan source code at the CI platform.

Note: polaris.assessment.mode=SOURCE_UPLOAD is scheduled for deprecation. Please use polaris.test.sast.location and/or polaris.sca.test.location instead. A deprecation warning message is logged if polaris.assessment.mode=SOURCE_UPLOAD is used.
Configure location for where source code should be scanned for an SCA assessment type. polaris.test.sca.location BRIDGE_POLARIS_TEST_SCA_LOCATION polaris.test.sca.location No. Required for Source Code Upload for SCA assessment type.

Valid values are hybrid or remote.

Default: hybrid, is the default mode. In this mode, Bridge would download the tools to run capture locally and upload the captured artifacts (bdio) to run analysis on the cloud.

Setting this property to a value of remote would result in Bridge uploading the source code to the Polaris platform for SCA scanning and analysis, instead of downloading tools and scanning the source code locally or on the CI platform.
Configure location for where source code should be captured and built for a SAST assessment type. polaris.test.sast.location BRIDGE_POLARIS_TEST_SAST_LOCATION polaris.test.sast.location No. Required for Source Code Upload for SAST assessment type.

Valid values are hybrid, local or remote.

Default: hybrid, is the default mode. In this mode, Bridge would download the tools to run capture locally and upload the captured artifacts (idir) to run analysis on the cloud.

Setting this property to a value of remote would result in Bridge uploading the source code to the Polaris platform for scanning and analysis, instead of downloading tools and scanning the source code locally or on the CI platform

Setting this property to a value of local would result in Bridge downloading the tools to run capture and analysis locally and upload the results to the cloud.
Note: When SAST Fix PRs are enabled, valid values are hybrid or remote. If local is specified, SAST Fix PRs will be skipped and a warning will be logged.

The project source directory.

 project.directory BRIDGE_PROJECT_DIRECTORY project.directory No

String that specifies the project directory to upload. The project.directory should be a valid file path for the file system you are in.

If it is empty, Bridge will use the current working directory (pwd).

Note:
  • Works for both CI and SOURCE_UPLOAD

The zipped source file path.

 project.source.archive BRIDGE_PROJECT_SOURCE_ARCHIVE project.source.archive No

The file must be a zip format file.

If it is not empty, Bridge will not create a zip archive from project directory

If user sets the project.source.archive Bridge will upload it to Polaris and run the scan.

If user does not set project.source.archive ,Bridge will archive the project directory and upload it to Polaris.

Comma-separated list of git ignore pattern strings used to exclude files and directories from the source archive created by Bridge for Polaris source upload scans when polaris.test.sast.location=remote.

 project.source.excludes BRIDGE_PROJECT_SOURCE_EXCLUDES project.source.excludes No

Example: "generated/**,node_modules/**"

Default: ""

Logs an info message if Bridge is using the default.

The .bridge and .git directories are automatically excluded from the generated source archive, even when project.source.excludes is configured.

The value specified for resource project.source.excludes should be a gitignore pattern, not file paths. See gitignore documentation: https://git-scm.com/docs/gitignore
Project Symlinks project.source.preserveSymlinks BRIDGE_PROJECT_SOURCE_PRESERVESYMLINKS project.source.preserveSymlinks No

Default:false. Bridge will save the copy of the target file to the zip archive. If the symlink is a directory, Bridge will copy the files in the target directory recursively to the zip archive.

When project.source.preserveSymlinksis set as true, Bridge will preserve the links to the zip file.

Note: If project.source.preserveSymlinksis set as true and there are symlinks to locations outside of the project (or absolute path links) this will cause issues when uploading to Polaris since the analysis environment won’t have those files or directories needed to satisfy the symlink.
SCA Test Type polaris.test.sca.type BRIDGE_POLARIS_TEST_SCA_TYPE polaris.test.sca.type No

Allows you to run a Package Manager scan, a Signature scan, an SCA binary scan or an SCA container scan.

Only Package Manager and Signature scans can run together in the same pipeline; in that case, Bridge creates two tests in Polaris.

When polaris.test.sca.type is set to SCA_BINARY, configure the binary artifact path using polaris.artifactToUpload.

When polaris.test.sca.type is set to SCA_CONTAINER, configure the container image .tar artifact using polaris.artifactToUpload.

For more detailed information about SCA functionality, see Documentation for Black Duck SCA Detectors.

Default: SCA-PACKAGE

Accepted values:
  • SCA-PACKAGE
  • SCA-SIGNATURE
  • SCA-PACKAGE,SCA-SIGNATURE
  • SCA_BINARY
  • SCA_CONTAINER
Note: Pull Request Comment workflow is ignored when triggered with a Signature scan.

GitHub Issues, SARIF report and GitLab report generation are not supported for SCA Container scans.
SAST Test Type polaris.test.sast.type BRIDGE_POLARIS_TEST_SAST_TYPE polaris.test.sast.type No This parameter allows you to run a full SAST scan, or a rapid SAST scan. If this parameter is not set, the default value will be used.

Default value: SAST-FULL

Acceptable values:
  • SAST-FULL
  • SAST-RAPID

Important: A full SAST scan of the project must be completed before using SAST-RAPID. If you attempt to run a rapid scan on a project before you run a full scan, Bridge starts a full SAST scan automatically.
SCA artifact path for binary or container scans polaris.artifactToUpload BRIDGE_POLARIS_ARTIFACTTOUPLOAD polaris.artifactToUpload No. Required when polaris.test.sca.type is set to SCA_BINARY or SCA_CONTAINER

Path to the file to upload for SCA scanning. Required when polaris.test.sca.type is SCA_BINARY (binary or archive file) or SCA_CONTAINER (container image .tar, .tgz, .gz or .zip archive).

Supports absolute and relative paths; relative paths are resolved against the current working directory.

Directory paths are not supported.
SCA container resource name polaris.container.name BRIDGE_POLARIS_CONTAINER_NAME polaris.container.name No. Required when polaris.test.sca.type is set to SCA_CONTAINER Name of the container resource to associate with the scan target. The container name will be listed in the containers section of the project in Polaris web UI and can also be used as a filter.
Note: polaris.branch.name is not validated for SCA Container scans.
Enable/disable waitforscan polaris.waitforscan BRIDGE_POLARIS_WAIT_FOR_SCAN polaris.waitforscan No

Indicates if the workflow should wait for the analysis to complete or not.

Default:true

Note: When run with waitforscan set to false - Bridge would show an INFO message, will exit after queuing the tests on cloud, and not do any post analysis operations (i.e. break build, pr comments / sarif)
JSON Input
Here is a sample input.json file that can be used with Polaris.
{
    "data": {
        "polaris": {
            "application": {
                "name": "<Application Name>"
            },
            "project": {
                "name": "<Project Name>"
            },         
            "branch": {
                "name": "<Branch Name>"
            },
            "assessment": {
                "types":  ["SCA", "SAST"]
 
            },
            "serverurl": "<Polaris URL>"
        }
    }
}
Here are the commands to run. 
export BRIDGE_POLARIS_ACCESSTOKEN=<POLARIS_ACCESSTOKEN>
bridge-cli --stage Polaris --input input.json

Arguments to pass for generating GitLab Reports with Polaris

Argument Input mode Required Notes
  Command line argument Environment variables JSON field    
Enable/disable GitLab report generation polaris.reports.gitlab.create BRIDGE_POLARIS_REPORTS_GITLAB_CREATE polaris.reports.gitlab.create No

Set this to true to generate Polaris SCA/SAST report.

Note: GitLab reports can be generated for any configured branch; however, report generation is not supported in a merge request context.

Default: false
Directory path where the GitLab report will be created polaris.reports.gitlab.dir.path BRIDGE_POLARIS_REPORTS_GITLAB_DIR_PATH polaris.reports.gitlab.dir.path No

Directory path (excluding file name) where GitLab report is created.

Note: GitLab is only able to package artifacts found in the $CI_PROJECT_DIR directory. If BRIDGE_POLARIS_REPORTS_GITLAB_DIR_PATH is set outside $CI_PROJECT_DIR, Gitlab report will not be uploaded.
Default:
  • $CI_PROJECT_DIR/.blackduck/integrations/polaris/gitlab_report/sca.json
  • $CI_PROJECT_DIR/.blackduck/integrations/polaris/gitlab_report/sast.json
List assessment issues to create in GitLab reports polaris.reports.gitlab.issue.types BRIDGE_POLARIS_REPORTS_GITLAB_ISSUE_TYPES polaris.reports.gitlab.issue.types No

Lists which assessment issue types to create in GitLab file reports.

Example: 'SCA,SAST'
List severities to include in GitLab report polaris.reports.gitlab.severities BRIDGE_POLARIS_REPORTS_GITLAB_SEVERITIES polaris.reports.gitlab.severities No

Comma-separated list of SAST/SCA issue severities to include in GitLab file report. Valid severities are Critical, High, Medium, Low, and Informational.

Default: All severities are included.
Enable/disable grouping SCA issues by component polaris.reports.gitlab.groupscaissues BRIDGE_POLARIS_REPORTS_GITLAB_GROUPSCAISSUES polaris.reports.gitlab.groupscaissues No

When set to true, SCA issues are grouped by component. Set this to false to list SCA issues by vulnerability.

Default: true

Arguments to pass for selecting Coverity version

Argument Input Mode Required Notes
  Command Line Argument Environment Variables JSON Field    
Select Coverity version coverity.version BRIDGE_COVERITY_VERSION coverity.version No
Use with SAST local and SAST hybrid scans (full and rapid)
Important: SAST remote scans use default version from Polaris Web UI

Default: Bridge uses the version configured on Polaris Web UI for the application, project or branch being scanned.

Acceptable Values: Versions of Coverity that are supported on Polaris (including deprecated versions).

Example: 2025.6.2

For further details please refer to Polaris multi version SAST tool support with Bridge

Arguments to pass for generating GitHub Issues with Polaris

Argument input Mode Required Notes
  Command line argument Environment variable JSON field    
Enable/disable creation of GitHub issues polaris.externalIssues.create BRIDGE_POLARIS_EXTERNALISSUES_CREATE polaris.externalIssues.create Yes
  • Set to true to enable creation of GitHub issues from scan findings.
  • Default: false.
  • When false, no external issues are created.
Severities for which GitHub issues are created polaris.externalIssues.severities BRIDGE_POLARIS_EXTERNALISSUES_SEVERITIES polaris.externalIssues.severities No
  • List of severities for which GitHub Issues issues should be created.
  • Default: ["Critical", "High"].
polaris.externalIssues.types polaris.externalIssues.types BRIDGE_POLARIS_EXTERNALISSUES_TYPES polaris.externalIssues.types  
  • List of Polaris issue types for which GitHub issues should be created. Accepted values: SAST, SCA (case‑insensitive).
Group SCA issues by component-version pair polaris.externalIssues.groupSCAIssues BRIDGE_POLARIS_EXTERNALISSUES_GROUPSCAISSUES polaris.externalIssues.groupSCAIssues No
  • Set to true to group SCA issues by vulnerabilities of a component-version pair when creating external issues.
  • Default: true.
Maximum number of GitHub issues to create polaris.externalIssues.maxCount BRIDGE_POLARIS_EXTERNALISSUES_MAXCOUNT polaris.externalIssues.maxCount No
  • Maximum number of GitHub issues to create at any given time per assessment/workflow.
  • Default: 10 for SAST/SCA issues if not configured.

Polaris Secure Tunnel

Polaris Secure Tunnel lets you securely connect to internal web applications and APIs for the purpose of running dynamic tests (DAST) using Polaris fAST Dynamic. Run Polaris Secure Tunnel to establish a secure TLS connection between Polaris and an internal target in a private network. Run Polaris Secure Tunnel locally, on a virtual machine, or other runner, and leave it running until your DAST testing is complete.

Important: The location from where Polaris Secure Tunnel runs must be able to communicate with both your internal DAST target and Polaris (via port 443).
Command line argument Required Notes
polaris.serverUrl Yes The Polaris server URL, either https://polaris.blackduck.com, https://poc.polaris.blackduck.com, https://ksa.polaris.blackduck.com or https://eu.polaris.blackduck.com.
polaris.application.name Yes, if not using polaris.tunnel.name The name of the application that contains a DAST project to scan. The application must already exist inPolaris and have the right entitlements.
polaris.project.name Yes, if not using polaris.tunnel.name The name of the DAST project you wish to scan. The project must already exist in Polaris, and the Entry Point URL is in a private network option must be enabled (in the project's settings).
polaris.tunnel.name Yes, if not using polaris.application.name and polaris.project.name Name of the tunnel to fetch as defined in Polaris in Organizations > Secure Tunnel. When provided, Bridge CLI fetches the tunnel configuration using the tunnel name instead of deriving it from the application/project. Can be used independently without polaris.application.name and polaris.project.name for the polaris-secure-tunnel workflow.
Note: In the DAST project settings, if the Entry Point URL is in a private network option is enabled the name of the secure tunnel should be assigned.
Here is an example command using polaris.application.name and polaris.project.name: 
bridge-cli --stage polaris-secure-tunnel polaris.application.name="My Application" polaris.project.name="Internal DAST target" polaris.serverUrl="https://polaris.blackduck.com"
Here is an example command that uses polaris.tunnel.name:
bridge-cli --stage polaris-secure-tunnel polaris.tunnel.name ="My-Secure-Tunnel" polaris.serverUrl="https://polaris.blackduck.com"
Note: See Connect to an internal DAST target from Bridge CLI for more information.

Black Duck® SCA

The base command to run the scan.
bridge-cli --stage blackducksca

For more detailed information about SCA functionality, see Documentation for Black Duck SCA Detectors.

Arguments to pass
Argument Input mode Required Notes
  Command line argument Environment variable JSON field    
URL blackducksca.url BRIDGE_BLACKDUCKSCA_URL blackducksca.url Yes Black Duck® SCA URL
Token blackducksca.token BRIDGE_BLACKDUCKSCA_TOKEN blackducksca.token Yes Black Duck® SCA access token
Full scan blackducksca.scan.full BRIDGE_BLACKDUCKSCA_SCAN_FULL blackducksca.scan.full No

Performs a full/intelligent scan when set to true. Required and used for scanning based on SCM push events.

Performs a rapid scan when set to false . Required for SCM pull request events.

true or false. (Default: false).
Install Directory detect.install.directory BRIDGE_DETECT_INSTALL_DIRECTORY detect.install.directory No

Path to directory where detect.jar resides.

Default: <$HOME>/.bridge/tools/detect
Failure severities blackducksca.scan.failure.severities BRIDGE_BLACKDUCKSCA_SCAN_FAILURE_SEVERITIES blackducksca.scan.failure.severities No

Used by Bridge to determine whether to break the build or not.

If provided, Bridge will break the build and returns exit code.
Add comments to pull requests blackducksca.automation.prcomment BRIDGE_BLACKDUCKSCA_AUTOMATION_PRCOMMENT blackducksca.automation.prcomment No

If set to true , Bridge adds comments to pull requests for new issues introduced in the pull request.

Note: Requires Rapid Scan to be run on pull require events. This argument is ignored if full scan is run.

Note: Requires SCM information including token as documented in section SCM Information needed for "Adding Comments to Pull Requests" feature below.

Detect Download URL

 detect.download.url BRIDGE_DETECT_DOWNLOAD_URL detect.download.url No

Use this to download Detect from the specified URL. If not specified Detect is downloaded from repo.blackduck.com.

Black Duck® SCA Fix PR capability

 blackducksca.fixpr.enabled BRIDGE_BLACKDUCKSCA_FIXPR_ENABLED blackducksca.fixpr.enabled No Set this to true to enable creation of fix pull requests.

Default: false

Maximum number of fix PRs that can be created

 blackducksca.fixpr.maxcount BRIDGE_BLACKDUCKSCA_FIXPR_MAXCOUNT blackducksca.fixpr.maxcount No Set this to a positive integer value to limit the number outstanding fix pull requests created.

Default: unlimited
Severities used to decide whether the fix PR is created blackducksca.fixpr.severities BRIDGE_BLACKDUCKSCA_FIXPR_SEVERITIES blackducksca.fixpr.severities No Set this to a list of severities for which fix pull requests should be created for.

Default: CRITICAL,HIGH
Upgrade guidance blackducksca.fixpr.useupgradeguidance BRIDGE_BLACKDUCKSCA_USEUPGRADEGUIDANCE blackducksca.fixpr.useupgradeguidance No

Set this to one of the following values to let Bridge know which type of upgrade guidance to be used. If multiple values are specified, the first available guidance is used. If no upgrade guidance is available, fix pull request is not created.

Accepted values:
  • SHORT_TERM
  • LONG_TERM
  • SHORT_TERM, LONG_TERM
  • LONG_TERM, SHORT_TERM
Default: SHORT_TERM, LONG_TERM
Enable/disable SARIF report generation blackducksca.reports.sarif.create BRIDGE_BLACKDUCKSCA_REPORTS_SARIF_CREATE blackducksca.reports.sarif.create No Set to "true" to generate a SARIF report.

Default: false
File path where the SARIF file will be created. blackducksca.reports.sarif.file.path BRIDGE_BLACKDUCKSCA_REPORTS_SARIF_FILE_PATH blackducksca.reports.sarif.file.path No Defines where the SARIF file will be created. (A file name must be included.)

Default: <BRIDGE_HOME>/<SARIF_GENERATOR_ADAPTER_NAME>/report.sarif.json
List of severities to match. blackducksca.reports.sarif.severities BRIDGE_BLACKDUCKSCA_REPORTS_SARIF_SEVERITIES blackducksca.reports.sarif.severities No Only issues that match one of the indicated severities will be included in the SARIF file report. (Severities are case-insensitive.)

For example, ["high", "critical"]

Default:[]
Enable/disable grouping of SCA issues by component. blackducksca.reports.sarif.groupSCAIssues BRIDGE_BLACKDUCKSCA_REPORTS_SARIF_GROUPSCAISSUES blackducksca.reports.sarif.groupSCAIssues No Set to "true" to enable grouping of SCA issues by component.

Default: true
Enable/disable waitforscan blackducksca.waitforscan BRIDGE_WAIT_FOR_SCAN blackducksca.waitforscan No

Indicates if the workflow should wait for the analysis to complete or not.

Default: true

Note: For Black Duck Rapid Scan - this setting will be ignored.
Note: When run with waitforscan set to false - Bridge would show an INFO message, will exit after queuing the tests on cloud, and not do any post analysis operations (i.e. break build, fix pr / pr comments / sarif)

JSON input

Here is a sample input.json file that can be used with Black Duck® SCA.
{
    "data": {
        "blackducksca": {
            "url": <BlackDuckSCA url>,
            "scan": {
                "full": true,
                "failure": {
                    "severities": ["CRITICAL"]
                }
            }
        }
    }
}
Here are the commands to run.
export BRIDGE_BLACKDUCKSCA_TOKEN=<BLACKDUCKSCA_TOKEN>
bridge-cli --stage blackducksca --input input.json

Arguments to pass for generating GitHub Issues with Black Duck® SCA

Argument Input mode Required Notes
  Command line argument Environment variable JSON field    
Enable/disable creation of GitHub issues blackducksca.externalIssues.create BRIDGE_BLACKDUCKSCA_EXTERNALISSUES_CREATE blackducksca.externalIssues.create Yes
  • Set to true to enable creation of GitHub issues from Black Duck SCA scan findings.
  • Default: false.
  • When false, no GitHub issues are created.
Severities for which GitHub issues are created blackducksca.externalIssues.severities BRIDGE_BLACKDUCKSCA_EXTERNALISSUES_SEVERITIES blackducksca.externalIssues.severities No
  • List of severities for which GitHub issues should be created from Black Duck SCA findings.
  • Default: ["Critical", "High"].
Group SCA issues by component-version pair blackducksca.externalIssues.groupSCAIssues BRIDGE_BLACKDUCKSCA_EXTERNALISSUES_GROUPSCAISSUES blackducksca.externalIssues.groupSCAIssues No
  • Set to true to group SCA issues by vulnerabilities of a component-version pair when creating GitHub issues.
  • Default: true.
Maximum number of GitHub issues to create blackducksca.externalIssues.maxCount BRIDGE_BLACKDUCKSCA_EXTERNALISSUES_MAXCOUNT blackducksca.externalIssues.maxCount No
  • Maximum number of GitHub issues to create at any given time per assessment/workflow.
  • Default: 10 if not configured.

Arguments to pass for generating GitLab Reports with Black Duck SCA

Argument Input mode Required Notes
  Command line argument Environment variables JSON field    
Enable/disable GitLab report generation blackducksca.reports.gitlab.create BRIDGE_BLACKDUCKSCA_REPORTS_GITLAB_CREATE blackducksca.reports.gitlab.create No

Set this to true to generate Black Duck SCA report.

Note: Gitlab reports can be generated for any configured branch; however, report generation is not supported in a merge request context.

Default: false
Directory path where the GitLab report will be created blackducksca.reports.gitlab.dir.path BRIDGE_BLACKDUCKSCA_REPORTS_GITLAB_DIR_PATH blackducksca.reports.gitlab.dir.path No

Directory path (excluding file name) where Gitlab report is created.

Note: GitLab is only able to package artifacts found in the $CI_PROJECT_DIR directory. If BRIDGE_BLACKDUCKSCA_REPORTS_GITLAB_DIR_PATH is set outside $CI_PROJECT_DIR, Gitlab report will not be uploaded.

Default: $CI_PROJECT_DIR/.blackduck/integrations/blackducksca/gitlab_report/sca.json
List severities to include in GitLab report blackducksca.reports.gitlab.severities BRIDGE_BLACKDUCKSCA_REPORTS_GITLAB_SEVERITIES blackducksca.reports.gitlab.severities No

Comma-separated list of SCA issue severities to include in Gitlab file report. Valid severities are Critical, High, Medium, Low, and Informational.

Default: All severities are included.
Enable/disable grouping SCA issues by component (missing?) blackducksca.reports.gitlab.groupscaissues BRIDGE_BLACKDUCKSCA_REPORTS_GITLAB_GROUPSCAISSUES blackducksca.reports.gitlab.groupscaissues No When set to true, SCA issues are grouped by component. Set this to false to list SCA issues by vulnerability.

Default:true

Coverity Connect

Argument Input mode Required Notes
  Command line argument Environment variable JSON field    
Coverity URL coverity.connect.url BRIDGE_COVERITY_CONNECT_URL coverity.connect.url Yes Coverity Connect URL
User Name coverity.connect.user.name BRIDGE_COVERITY_CONNECT_USER_NAME coverity.connect.user.name Yes For security reasons it is recommended to pass this as an environmental variable.
Password coverity.connect.user.password BRIDGE_COVERITY_CONNECT_USER_PASSWORD coverity.connect.user.password Yes For security reasons it is recommended to pass this as an environmental variable.
Project Name coverity.connect.project.name BRIDGE_COVERITY_CONNECT_PROJECT_NAME coverity.connect.project.name Yes Project will be created if it doesn't exit.
Stream Name coverity.connect.stream.name BRIDGE_COVERITY_CONNECT_STREAM_NAME coverity.connect.stream.name Yes Stream will be created if it doesn't exit.
View coverity.connect.policy.view BRIDGE_COVERITY_CONNECT_POLICY_VIEW coverity.connect.policy.view No

Coverity platform's view name/ID.

Bridge will break the build if issues are found in the view provided by user and returns exit code .
Add comments to pull requests coverity.automation.prcomment BRIDGE_COVERITY_AUTOMATION_PRCOMMENT coverity.automation.prcomment No

Note: Scheduled for deprecation. Please use coverity.prComment.enable instead.
coverity.prcomment.enabled BRIDGE_COVERITY_PRCOMMENT_ENABLED coverity.prcomment.enabled No

If set to true, Bridge adds comments to pull requests for new issues introduced in the Pull Request filtered by coverity.prComment.impacts. Detected issues are uploaded to Coverity and will break the build.

Requires Rapid Scan to be run on pull request events. This argument is ignored if full scan is run.

Note: Requires SCM information including token as documented in section SCM Information needed for “Adding Comments to Pull Requests” feature.

coverity.prcomment.impacts BRIDGE_COVERITY_PRCOMMENT_IMPACTS coverity.prcomment.impacts No

List of impacts that will cause pull request scans to fail.

Issues matching any listed impact level will be uploaded to Coverity, added as pull request comments and trigger build failure.

Default: [High].

Valid values: [High, Medium, Low, Audit]
Install directory coverity.install.directory BRIDGE_COVERITY_INSTALL_DIRECTORY coverity.install.directory No
Path to directory where coverity resides. Defaults:
  • <$HOME>/.bridge/tools/cov-analysis for on-prem Coverity Connect users.
  • <$HOME>/.bridge/tools/cov-thin-client for Coverity cloud users.
Version coverity.version BRIDGE_COVERITY_VERSION coverity.version No For Coverity Cloud Deployment 2023.6 and newer:
  • If you do not pass version, Bridge uses the default version on the Coverity cloud server.
  • If you pass version, Bridge uses the provided version. Bridge errors out if the version is unsupported.
version is ignored for older Coverity Cloud Deployment versions.
local analysis coverity.local BRIDGE_COVERITY_LOCAL coverity.local No

To use Bridge CLI with on-prem Coverity Connect, set this to true. When set to true, Bridge will download full analysis kit and will perform capture and analysis locally.

With Coverity cloud deployments, Black Duck uses Thin Client and this option should be set to false.

Default: false.

Enable/disable waitforscan coverity.waitforscan BRIDGE_COVERITY_WAIT_FOR_SCAN coverity.waitforscan No

Indicates if the workflow should wait for the analysis to complete or not.

Default: true

Note: This will be applicable only to tests running on clouds.
Note: For local analysis (Coverity local) - this setting will be ignored.
Note: When run with waitforscan set to false - Bridge would show an INFO message, will exit after queuing the tests on cloud, and not do any post analysis operations (i.e. break build, pr comments)

Here is a sample input.json file that can be used with Coverity Cloud.

{
    "data": {
        "coverity": {
            "connect": {
                "url": "<Connect URL>",
                "project": {
                    "name": "<PROJECT_NAME>"
                },
                "stream": {
                    "name": "<STREAM_NAME>"
                },
                "policy": {
                    "view": "<View Name / Id>"
                }
            },
            "prcomment": {
                "enabled": false
            }
        }
    }
}
Note: To use Bridge CLI with on-prem Coverity Connect, you must set the coverity.local to true as described above.
Here is a sample input.json file that can be used with on-prem Coverity Connect:
{
    "data": {
        "coverity": {
            "connect": {
                "url": "<Connect URL>",
                "project": {
                    "name": "<PROJECT_NAME>"
                },
                "stream": {
                    "name": "<STREAM_NAME>"
                },
                "policy": {
                    "view": "<View Name / Id>"
                }
            },
            "prcomment": {
                "enabled": false
            },
            "local": true
        }
    }
}
Here are the commands to run:
export BRIDGE_COVERITY_CONNECT_USER_NAME=<COV_USER>
export BRIDGE_COVERITY_CONNECT_USER_PASSWORD=<COVERITY_PASSPHRASE>
bridge-cli --stage connect --input input.json

Coverity Cloud Deployment 2023.6 and newer - Multi Version Support

Coverity Cloud Deployment 2023.6 and newer supports multiple versions of Coverity Thin Client. Pass a non-default version of Thin Client to use as input to Bridge via coverity.version.

  • If you don't pass version, Bridge uses the default version set up on the platform.
  • If you pass a supported version, Bridge uses that version.
  • If you pass an unsupported version, Bridge errors out with a message.

Software Risk Manager (SRM)

Argument Input mode Required Notes
  Command line argument Environment variable JSON field    
URL srm.url BRIDGE_SRM_URL srm.url Yes SRM Server URL
API key srm.apikey BRIDGE_SRM_APIKEY srm.apikey Yes API Key. Note:Personal Access Tokens (PATs) are not supported when using Bridge.
Project Name srm.project.name BRIDGE_SRM_PROJECT_NAME srm.project.name Yes SRM project name. Bridge creates the project if it does not exist. If the project already exists, user may pass project ID.
Project ID srm.project.id BRIDGE_SRM_PROJECT_ID srm.project.id No

SRM project ID. You can use srm.project.name instead.
Branch Name srm.branch.name BRIDGE_SRM_BRANCH_NAME srm.branch.name No

SRM branch name. If Bridge creates the project, user may pass a branch name. In that case, Bridge will create the user provided branch as the default branch. However, if a default branch already exists, Bridge will only create the user provided branch if the parent branch is specified using srm.branch.parent.
Parent Branch Name srm.branch.parent BRIDGE_SRM_BRANCH_PARENT srm.branch.parent No Used to create a new branch if it does not exist already.
Assessment Types srm.assessment.types BRIDGE_SRM_ASSESSMENT_TYPES srm.assessment.types Yes

Comma separated values. Accepted values: SAST or SCA or SAST, SCA.
Path to Coverity coverity.execution.path BRIDGE_COVERITY_EXECUTION_PATH coverity.execution.path No
Path to Coverity CLI.
Note: If the version is not supported, Bridge errors out.
Detect Execution Path detect.execution.path BRIDGE_DETECT_EXECUTION_PATH detect.execution.path No Path to the Detect Detect jar file to use.
Source Upload Flag srm.analysis.source.upload BRIDGE_SRM_ANALYSIS_SOURCE_UPLOAD srm.analysis.source.upload No Option to set for source code archive to be created and uploaded. Default is true.
Enable/disable waitforscan srm.waitforscan BRIDGE_SRM_WAIT_FOR_SCAN srm.waitforscan No

Indicates if the workflow should wait for the analysis to complete or not.

Default: true

Note: This will be applicable only to tests running on clouds.
Note: When run with waitforscan set to false - Bridge would show an INFO message, will exit after queuing the tests on cloud, and not do any post analysis operations.
Here's an example of an SRM input.json file:
{
    "data": {
      "srm": {
        "url": "<SRM URL>",
        "project": {
          "name": "SRM_PROJECT"
        },
        "assessment": {
          "types": [
             "sast",
             "sca"
          ]
        }
         
      },
      "coverity": {
        "execution": {
          "path": "/Users/johndoe/bridge-install-dir/srm-coverity/cov-thin-client-macosx-2023.6.1/bin/coverity"
        }
      }
    }
  }

Azure

The following table shows the Bridge CLI parameters available for Azure DevOps integration.

Argument Input mode
  Command line argument Environment variable JSON field
Azure DevOps API URL azure.api.url BRIDGE_AZURE_API_URL azure.api.url
User Token azure.user.token BRIDGE_AZURE_USER_TOKEN azure.user.token
Organization Name azure.organization.name BRIDGE_AZURE_ORGANIZATION_NAME azure.organization.name
Project Name azure.project.name BRIDGE_AZURE_PROJECT_NAME azure.project.name
Repository Name azure.repository.name BRIDGE_AZURE_REPOSITORY_NAME azure.repository.name
Branch Name azure.repository.branch.name BRIDGE_AZURE_REPOSITORY_BRANCH_NAME azure.repository.branch.name
Pull Request Number azure.repository.pull.number BRIDGE_AZURE_REPOSITORY_PULL_NUMBER azure.repository.pull.number
Important: The azure.repository.pull.number parameter is not required for Black Duck SCA Fix Pull Requests as this feature should only be run from protected branches (e.g. main, develop).

Bitbucket

The table below shows the Bridge CLI parameters available for Bitbucket integration.

Argument Input mode
  Command line argument Environment variable JSON field
Bitbucket API URL bitbucket.api.url BRIDGE_BITBUCKET_API_URL bitbucket.api.url
User Token bitbucket.user.token BRIDGE_BITBUCKET_USER_TOKEN bitbucket.user.token
Repository Name bitbucket.project.repository.name BRIDGE_BITBUCKET_REPOSITORY_NAME bitbucket.project.repository.name
Branch Name bitbucket.project.repository.branch.name BRIDGE_BITBUCKET_REPOSITORY_BRANCH_NAME bitbucket.project.repository.branch.name
Bitbucket User Name bitbucket.user.name BRIDGE_BITBUCKET_USER_NAME bitbucket.user.name
Bitbucket Project Key bitbucket.project.key BRIDGE_BITBUCKET_PROJECT_KEY bitbucket.project.key
Pull Request Number bitbucket.project.repository.pull.number BRIDGE_BITBUCKET_REPOSITORY_PULL_NUMBER bitbucket.project.repository.pull.number
Important: The bitbucket.project.repository.pull.number parameter is not required for Black Duck SCA Fix Pull Requests as this feature should only be run from protected branches (e.g. main, develop).

GitHub

The table below shows the Bridge CLI parameters available for GitHub integration.

Argument Input mode
  Command line argument Environment variable JSON field
GitHub Enterprise host URL (Do not use with standard GitHub.) github.host.url BRIDGE_GITHUB_HOST_URL github.host.url
User Token github.user.token BRIDGE_GITHUB_USER_TOKEN github.user.token
Repository Name github.repository.name BRIDGE_GITHUB_REPOSITORY_NAME github.repository.name
Branch Name github.repository.branch.name BRIDGE_GITHUB_REPOSITORY_BRANCH_NAME github.repository.branch.name
Repository Owner github.repository.owner.name BRIDGE_GITHUB_REPOSITORY_OWNER_NAME github.repository.owner.name
Pull Request Number github.repository.pull.number BRIDGE_GITHUB_REPOSITORY_PULL_NUMBER github.repository.pull.number
Important: The github.repository.pull.number parameter is not required for Black Duck SCA Fix Pull Requests as this feature should only be run from protected branches (e.g. main, develop).

GitLab

The table below shows the Bridge CLI parameters available for GitLab integration.

For GitLab reports Bridge CLI parameters:
Argument Input mode
  Command line argument Environment variable JSON field
GitLab API URL gitlab.api.url BRIDGE_GITLAB_API_URL gitlab.api.url
User Token gitlab.user.token BRIDGE_GITLAB_USER_TOKEN gitlab.user.token
Repository Name gitlab.repository.name BRIDGE_GITLAB_REPOSITORY_NAME gitlab.repository.name
Branch Name gitlab.repository.branch.name BRIDGE_GITLAB_REPOSITORY_BRANCH_NAME gitlab.repository.branch.name
Merge Request Number gitlab.repository.pull.number BRIDGE_GITLAB_REPOSITORY_PULL_NUMBER gitlab.repository.pull.number
Important: The gitlab.repository.pull.number parameter is not required for Black Duck SCA Fix Pull Requests as this feature should only be run from protected branches (e.g. main, develop).