Using SAST Fix PRs with Bridge

Bridge can create SAST Fix Pull Requests (Fix PRs) from Polaris SAST scan results in CI workflows. Each Fix PR contains an AI-generated code fix for one static analysis vulnerability detected by a full baseline SAST scan on a monitored branch, such as main, develop, staging, or release.

1. Make the Polaris access token available as an environment variable or secret.

   export BRIDGE_POLARIS_ACCESSTOKEN=<POLARIS_ACCESS_TOKEN>

2. Make a source code repository access token available as an environment variable or secret.

   export BRIDGE_GITHUB_USER_TOKEN=<GITHUB_ACCESS_TOKEN>

3. Use Bridge CLI to run a SAST scan with Fix PRs enabled.
   Note: Bridge can integrate with a variety of Source Code Management (SCM) systems, such as GitHub, GitLab, and others. The examples demonstrate how to integrate with a GitHub repository to raise Fix PRs. Consult Complete list of Bridge arguments to discover the equivalent Bridge commands to use for the Source Code Management system in use by your organization.

   JSON

   Save the following text to a JSON file and give the file an appropriate name, such as input.json.

   {
     "data": {
       "polaris": {
         "serverUrl": "https://polaris.example.com",
         "application": {
           "name": "sample-polaris-application"
         },
         "project": {
           "name": "sample-polaris-project"
         },
         "branch": {
           "name": "main"
         },
         "assessment": {
           "types": [
             "SAST"
           ]
         },
         "test": {
           "sast": {
             "location": "HYBRID"
           }
         },
         "fixPR": {
           "enabled": true,
           "filter": {
             "severities": "CRITICAL,HIGH"
           },
           "maxCount": 3
         }
       },
       "github": {
         "repository": {
           "name": "sample-repository",
           "owner": {
             "name": "<userid_or_orgid>"
           },
           "branch": {
             "name": "main"
           }
         }
       }
     }
   }

   Run Bridge CLI:

   export BRIDGE_POLARIS_ACCESSTOKEN="<POLARIS_ACCESS_TOKEN>"
   export BRIDGE_GITHUB_USER_TOKEN="<GITHUB_ACCESS_TOKEN>"
   
   bridge-cli --stage polaris --input input.json

   Environment variables

   export BRIDGE_POLARIS_SERVERURL="https://polaris.example.com"
   export BRIDGE_POLARIS_ACCESSTOKEN="<POLARIS_ACCESS_TOKEN>"
   export BRIDGE_POLARIS_APPLICATION_NAME="sample-polaris-application"
   export BRIDGE_POLARIS_PROJECT_NAME="sample-polaris-project"
   export BRIDGE_POLARIS_BRANCH_NAME="main"
   export BRIDGE_POLARIS_ASSESSMENT_TYPES="SAST"
   export BRIDGE_POLARIS_TEST_SAST_LOCATION="HYBRID"
   export BRIDGE_POLARIS_FIXPR_ENABLED="true"
   export BRIDGE_POLARIS_FIXPR_FILTER_SEVERITIES="CRITICAL,HIGH"
   export BRIDGE_POLARIS_FIXPR_MAXCOUNT="3"
   export BRIDGE_GITHUB_REPOSITORY_NAME="sample-repository"
   export BRIDGE_GITHUB_REPOSITORY_OWNER_NAME="userid_or_orgid"
   export BRIDGE_GITHUB_REPOSITORY_BRANCH_NAME="main"
   export BRIDGE_GITHUB_USER_TOKEN="<GITHUB_ACCESS_TOKEN>"

   Run Bridge CLI:

   bridge-cli --stage polaris

   Command line

   export BRIDGE_POLARIS_ACCESSTOKEN="<POLARIS_ACCESS_TOKEN>"
   export BRIDGE_GITHUB_USER_TOKEN="<GITHUB_ACCESS_TOKEN>"
   
   bridge-cli \
     --stage polaris \
     polaris.serverUrl="https://polaris.example.com" \
     polaris.application.name="sample-polaris-application" \
     polaris.project.name="sample-polaris-project" \
     polaris.branch.name="main" \
     polaris.assessment.types="SAST" \
     polaris.test.sast.location="HYBRID" \
     polaris.fixPR.enabled=true \
     polaris.fixPR.filter.severities="CRITICAL,HIGH" \
     polaris.fixPR.maxCount=3 \
     github.repository.name="sample-repository" \
     github.repository.owner.name="userid_or_orgid" \
     github.repository.branch.name="main"

   The examples above use Bridge CLI to enable SAST Fix PRs with the following settings:

   • Fix PRs are raised for CRITICAL and HIGH severity SAST issues.
   • A maximum of three Fix PRs will be raised.
   • Each Fix PR contains an AI-generated code fix targeting a single SAST vulnerability.
4. Review Bridge logs.
   Bridge logs information about Fix PR creation, including the number of Fix PRs created and any issues that could not be fixed.
5. Verify that new Fix PRs were created for the configured branch.