CircleCI

Learn how to integrate Fortify SCA with CircleCI.

CircleCI is supported by using our debricked/debricked-scan Docker image. The CircleCI integration supports the same options as our Bitbucket integration, read more about the options here.

Configure Fortify SCA token

Start by generating an access token. Configure your DEBRICKED_TOKEN variable using the access token, by heading over to your Project Settings -> Environment Variables, and add DEBRICKED_TOKEN, as below.

Configure CircleCI job

Depending on what package manager you are using there are different job setups.

In order for us to analyze all dependencies in your project, their versions, and relations, files containing the resolved dependency trees have to be created prior to scanning. Those depend on the package manager used. Fortify SCA tries to generate the lacking files, which can negatively affect speed and accuracy.

Example 1: If npm is used in your project you will have a "package.json" file, but in order for us to scan all your dependencies, Fortify SCA requires either "package-lock.json" or "yarn.lock" as well.

Example 2: If Maven is used in your project, you will have a pom.xml file, but in order for us to resolve all your dependencies, Fortify SCA requires a second file, as Maven does not offer a lock file system. Instead, "Maven dependency:tree" plugin can be used to create a file called ".debricked-maven-dependencies.tgf".

Add the following template to your .circleci/config.yml file (if the file does not exist, create one):

https://github.com/debricked/cli/blob/main/examples/templates/CircleCI/config.yml

version: 2.1

jobs:
  scan:
    docker:
      - image: cimg/base:current
    steps:
      - checkout
      - run: curl -LsS https://github.com/debricked/cli/releases/download/release-v2/cli_linux_x86_64.tar.gz | tar -xz debricked
      - run: ./debricked scan

workflows:
  debricked-scan:
    jobs:
      - scan

Commit your changes to ".circleci/config.yml" and watch the CI run.