Full project scan and send results to Polaris

Prerequisites:

• A Polaris instance

• An Application established in Polaris to receive results of your scan.
• An External Analysis subscription on Polaris

• A Polaris token to be used by Signal

• API Key for the LLM that will be used by Signal

Quickstart

Signal uses AI scans to secure code, including code generated by agentic workflows. This page explains how to set up AI scans that run wherever you use Bridge CLI and the related plugins.

Running an AI scan with Bridge CLI for the first time

1. Download the latest version of Bridge, if you haven't already installed it. Navigate to this URL:

   https://repo.blackduck.com/bds-integrations-release/com/blackduck/integration/bridge/binaries

   Important: Choose bridge-cli-bundle, which also installs Signal.

2. Add Bridge to your $PATH variable.

3. Set the following environment variables.

   export BRIDGE_POLARIS_SERVERURL=Insert_Your_Polaris_server_URL
   export BRIDGE_POLARIS_ACCESSTOKEN=Insert_Your_Polaris_Token
   export BRIDGE_SIGNAL_LLM_KEY=Insert_your_LLM_key

   Insert your Polaris URL and tokens where there are placeholders in the example. These are required when uploading results to Polaris.

   Note: It's safer to store your access tokens as environment variables, as opposed to providing them in the command line or in your config file.

4. From the root level of the project, run the following.

   bridge-cli --stage signal \
     signal.mode=PROJECT \
     signal.exclude=".\\examples" \
     signal.reportFile="C:\\MyReports\testProject.json" \
     signal.args="--oversight true --log-level debug" \
     signal.platform="polaris" \
     polaris.application.name=Insert_your_application_name \ 
     polaris.project.name=Insert_your_project_name \ 
     polaris.branch.name=$(git branch --show-current) 

   About this example:
   • Replace the placeholders with the names of your Polaris Application, Project, and Branch; all three are required when signal.platform is set to polaris. If they don’t exist, the Project and Branch will be created with the provided names.
   • Issues will appear in Polaris once execution is complete. They will also be available in a SARIF report at the location specified in signal.reportfile.

Troubleshooting

If the scan fails check the following.

• Have you provided a valid LLM API key.
• Are the other prerequisites met?