Note: Please remember to substitute example variable values with your own desired values such as correct project branches, repository names, application name.
Paste this example and please remember to change the applicable variable values with your own, such as: names of branches, project name, application name.
# example workflow for Polaris scans using the Bridge CLI
name: polaris-bridge-cli
on:
push:
branches: [ main, master, develop, stage, release ]
pull_request:
branches: [ main, master, develop, stage, release ]
workflow_dispatch:
jobs:
polaris:
runs-on: ubuntu-latest
env:
BRIDGE_POLARIS_SERVERURL: ${{ secrets.POLARIS_SERVERURL }}
BRIDGE_POLARIS_ACCESSTOKEN: ${{ secrets.POLARIS_ACCESSTOKEN }}
BRIDGE_POLARIS_ASSESSMENT_TYPES: 'SAST,SCA'
BRIDGE_POLARIS_APPLICATION_NAME: ${{ github.event.repository.name }}
BRIDGE_POLARIS_PROJECT_NAME: ${{ github.event.repository.name }}
BRIDGE_POLARIS_BRANCH_NAME: ${{ github.ref_name }}
steps:
- name: Checkout Source
uses: actions/checkout@v3
- name: Setup Java JDK
uses: actions/setup-java@v3
with:
java-version: 17
distribution: microsoft
cache: maven
- name: Polaris Full Scan
if: ${{ github.event_name != 'pull_request' }}
env:
BRIDGE_POLARIS_FIXPR_ENABLED: true
## External Issues Parameters
#
# Uncomment environment variable below to create an issue for each scan finding
# Defaults to false.
# BRIDGE_POLARIS_EXTERNALISSUES_CREATE: true
#
# Uncomment environment variable below to filter issue creation by severity
# Defaults to Critical,High
# BRIDGE_POLARIS_EXTERNALISSUES_SEVERITIES: 'Critical,High'
#
# Uncomment environment variable below to filter issue creation by assessment type
# BRIDGE_POLARIS_EXTERNALISSUES_TYPES: "SAST,SCA"
#
# Uncomment environment variable below to limit the number of issues created from
# scan findings, Default limit is 10.
# BRIDGE_POLARIS_EXTERNALISSUES_MAXCOUNT: 10
#
# Uncomment environment variable below to group sca issues by vulnerabilities of a
# component version pair. Default is true.
# BRIDGE_POLARIS_EXTERNALISSUES_GROUPSCAISSUES: true
#
##
run: |
curl -fLsS -o bridge.zip ${{ vars.BRIDGECLI_LINUX64 }} && unzip -qo -d ${{runner.temp}} bridge.zip && rm -f bridge.zip
${{runner.temp}}/bridge-cli-bundle-linux64/bridge-cli --stage polaris \
github.user.token=${{ secrets.GITHUB_TOKEN }}
- name: Polaris PR Scan
if: ${{ github.event_name == 'pull_request' }}
run: |
curl -fLsS -o bridge.zip ${{ vars.BRIDGECLI_LINUX64 }} && unzip -qo -d ${{runner.temp}} bridge.zip && rm -f bridge.zip
${{runner.temp}}/bridge-cli-bundle-linux64/bridge-cli --stage polaris \
polaris.prcomment.enabled=true \
polaris.branch.parent.name=${{ github.event.pull_request.base.ref }} \
github.repository.branch.name=${{ github.event.pull_request.head.ref }} \
github.repository.name=${{ github.event.repository.name }} \
github.repository.owner.name=${{ github.repository_owner }} \
github.repository.pull.number=${{ github.event.number }} \
github.user.token=${{ secrets.GITHUB_TOKEN }}
# - name: Save Logs
# if: always()
# uses: actions/upload-artifact@v3
# with:
# name: bridge-logs
# path: ${{ github.workspace }}/.bridge
This workflow automates security scanning for a repository using Polaris SAST and SCA analysis. The workflow runs on pushes and pull requests to specified branches and includes two distinct scan types: full scans for pushes and PR-specific scans with code review comments for pull requests.
Fix pull requests are enabled to raise pull requests to upgrade dependencies for full scans of branches. See
Fix pull requests (Fix PRs) and
Using SCA Fix PRs with Bridge for further information and examples that demonstrate how to:
- Configure order of preference for upgrade guidance
- Raise Fix Pull Requests by severity
- Enforce a maximum limit for the number of Fix Pull Requests created.
The workflow includes optional parameters for external issues, which automatically create GitHub repository issues from scan findings, allowing developers to track and remediate security vulnerabilities directly in an existing GitHub workflow without switching to the Polaris UI.
When enabled, external issues can be configured to filter by severity level and assessment type, group related SCA vulnerabilities, and limit the number of issues created per scan. For detailed instructions on configuring external issues, see Create external issues from Polaris scans.
The following is a list of mandatory Bridge arguments used:
| Variable |
Type |
Description |
Example |
|---|
BRIDGE_POLARIS_APPLICATION_NAME |
Variable |
Name of application in Polaris. If the application doesn't already exist in Polaris, Bridge will try to create it before triggering a CI scan. If you have concurrent subscription / team member enabled, the application creation will be successful. If you have parallel subscription, application creation will fail. |
YOUR_BRANCH_NAME |
BRIDGE_POLARIS_PROJECT_NAME |
Variable |
The specified project is created on Polaris if it doesn't exist. If you don't want the project to be created, set polaris.onboarding to false.
|
YOUR_PROJECT_NAME |
BRIDGE_POLARIS_ASSESSMENT_TYPES |
Variable |
Comma separated values. For DAST configuration requirements, see Using Bridge With Polaris.
|
Accepted values:
|
BRIDGE_POLARIS_BRANCH_NAME |
Variable |
Branch name in the Polaris server. If the branch does not exist, it creates the branch if polaris.onboarding is set to true. If polaris.onboarding is not enabled, the call will error out.
If a branch name is not provided, Bridge will error out and no tests will be created.
|
YOUR_BRANCH_NAME |