Argo workflows

Learn how to integrate OpenText Core SCA with Argo Workflows.

Argo Workflows is supported by using our "debricked/debricked-scan Docker" image.

Our Argo workflows integration support the same options as our Bitbucket integration, read more about the options here https://bitbucket.org/debricked/debricked-scan

Configure OpenText Core SCA token

Start by generating an access token. Copy the token so that you can use it in the next step.

Configure Argo workflow

Depending on what package manager you are using there are different step setups.

In order to analyze all dependencies in your project, their versions, and relations, files containing the resolved dependency trees should be created prior to scanning. The file creation depends on the package manager used. OpenText Core SCA tries to generate the lacking files, which can negatively affect speed and accuracy.

Example 1: If npm is used in your project, you will have a "package.json" file, but in order to scan all your dependencies, OpenText Core SCA requires either "package-lock.json" or "yarn.lock" as well.

Example 2: If Maven is used in your project, you will have a "pom.xml" file, but in order to resolve all your dependencies, OpenText Core SCA requires a second file, as Maven does not offer a lock file system. Instead, "Maven dependency:tree "plugin can be used to create a file called ".debricked-maven-dependencies.tgf".

1. Add the template to your ".circleci/config.yml" file (if the file does not exist, create one):

https://github.com/debricked/cli/blob/main/examples/templates/Argo/argo.yml

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: debricked-
spec:
  entrypoint: debricked
  arguments:
    parameters:
      - name: git-url # For example: https://github.com/debricked/go-templates.git
      - name: debricked-token # Consider using kubernetes secrets instead. For more details, see: https://github.com/argoproj/argo-workflows/blob/master/examples/secrets.yaml

  templates:
    - name: debricked
      inputs:
        parameters:
          - name: git-url
          - name: debricked-token
        artifacts:
          - name: repository
            path: /repository
            git: # For more details, see: https://github.com/argoproj/argo-workflows/blob/master/examples/input-artifact-git.yaml
              repo: "{{inputs.parameters.git-url}}"
      container:
        name: 'debricked-scan'
        image: debricked/cli:2-resolution-debian
        workingDir: /repository
        command:
          - debricked scan
        env:
          - name: DEBRICKED_TOKEN
            value: "{{inputs.parameters.debricked-token}}"
          - name: DEBRICKED_GIT_URL
            value: "{{inputs.parameters.git-url}}"

Consider using kubernetes secrets instead of parameter binding with -p.

• argo submit -n {namespace} --watch {template} \
  -p debricked-token={debricked-token} \
  -p git-url={git-url}