Tutorial with GitHub actions

The following demonstrates how to perform GitHub actions, such as an analysis on a pull request.

In your GitHub repository, configure the API Key, API Secret, and account name.

To configure the variables:

1. In your GitHub repository, go to Settings > Security > Secrets & Variables > Actions.

2. Click the Secrets tab.

3. For each secret (LW_ACCOUNT, LW_API_KEY, and LW_API_SECRET):

   1. Click New repository secret.

   2. In the Name field, enter the name of your variable. For example, LW_ACCOUNT.

   3. In the Secret field, enter the value you retrieved from the .json file for each secret. For example, <account.lacework.net>.

   4. Click Add secret.

   5. Configure a GitHub Action similar to the following example.

Running GitHub actions on pull requests

To run an analysis on GitHub pull requests to highlight new alerts, you must create a .github/workflows/lacework-code-security-pr.yml file. The file should contain the following:

on:
  - pull_request

permissions:
  contents: read
  pull-requests: write

env:
  LW_ACCOUNT_NAME: ${{ secrets.LW_ACCOUNT_NAME }}
  LW_API_KEY: ${{ secrets.LW_API_KEY }}
  LW_API_SECRET: ${{ secrets.LW_API_SECRET }}

name: Lacework Code Security (PR)
jobs:
  run-analysis:
    runs-on: ubuntu-latest
    name: Run analysis
    strategy:
      matrix:
        target: [new, old]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 2
      - name: Checkout old
        if: ${{ matrix.target == 'old' }}
        run: git checkout HEAD^1
      - name: Analyze
        uses: lacework/code-security-action@v1
        with:
          target: ${{ matrix.target }}
  display-results:
    runs-on: ubuntu-latest
    name: Display results
    needs:
      - run-analysis
    steps:
      - name: Results
        id: code-analysis
        uses: lacework/code-security-action@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

Running scheduled GitHub actions on push requests

To run an analysis on GitHub push requests or to run scheduled analyses with the findings uploaded to the FortiCNAPP console, you must create a .github/workflows/lacework-code-security-push.yml file. The file should contain the following:

on:
  push:
    # Run the scan on evey push in main
    branches: [main]
    # Run the scan evey day at 7:00am
    schedule:
      - cron: '0 7 * * *'
    # To manually trigger scans from the GitHub UI
    workflow_dispatch:

env:
  LW_ACCOUNT_NAME: ${{ secrets.LW_ACCOUNT_NAME }}
  LW_API_KEY: ${{ secrets.LW_API_KEY }}
  LW_API_SECRET: ${{ secrets.LW_API_SECRET }}

name: Lacework Code Security (Push)
jobs:
  run-analysis:
    runs-on: ubuntu-latest
    name: Run analysis
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: Analyze
        uses: lacework/code-security-action@v1
        with:
          target: push