Tutorial with GitHub actions

The following tutorial will guide you in how to deploy SCA and SAST with GitHub Action. It is important to note that both are run by using the SCA component from the FortiCNAPP CLI. Ultimately, there’s a lot of flexibility in using the SCA CLI which you can reference in the CLI Reference guide.

In your GitHub repository, configure the API Key, API Secret, and account name.

To configure the variables:

1. In your GitHub repository, go to Settings > Security > Secrets & Variables > Actions.

2. Click the Secrets tab.

3. For each secret (LW_ACCOUNT, LW_API_KEY, and LW_API_SECRET):

   1. Click New repository secret.

   2. In the Name field, enter the name of your variable. For example, LW_ACCOUNT.

   3. In the Secret field, enter the value you retrieved from the .json file for each secret. For example, <account.lacework.net>.

   4. Click Add secret.

   5. Configure a GitHub Action similar to the following example.

Running GitHub actions on pull requests

To run an analysis on GitHub pull requests to highlight new alerts, you must create a .github/workflows/lacework-code-security-pr.yml file. The file should contain the following:

on:
  - pull_request

permissions:
  contents: read
  pull-requests: write

env:
  LW_ACCOUNT_NAME: ${{ secrets.LW_ACCOUNT_NAME }}
  LW_API_KEY: ${{ secrets.LW_API_KEY }}
  LW_API_SECRET: ${{ secrets.LW_API_SECRET }}

name: Lacework Code Security (PR)
jobs:
  run-analysis:
    runs-on: ubuntu-latest
    name: Run analysis
    strategy:
      matrix:
        target: [new, old]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 2
      - name: Checkout old
        if: ${{ matrix.target == 'old' }}
        run: git checkout HEAD^1
      - name: Analyze
        uses: lacework/code-security-action@v1
        with:
          target: ${{ matrix.target }}
  display-results:
    runs-on: ubuntu-latest
    name: Display results
    needs:
      - run-analysis
    steps:
      - name: Results
        id: code-analysis
        uses: lacework/code-security-action@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

Running scheduled GitHub actions or on push requests

To run an analysis on GitHub push requests or to run scheduled analyses with the findings uploaded to the FortiCNAPP console, you must create a .github/workflows/lacework-code-security-push.yml file. The file should contain the following:

on:
  push:
    # Run the scan on evey push in main
    branches: [main]
    # Run the scan evey day at 7:00am
    schedule:
      - cron: '0 7 * * *'
    # To manually trigger scans from the GitHub UI
    workflow_dispatch:

env:
  LW_ACCOUNT_NAME: ${{ secrets.LW_ACCOUNT_NAME }}
  LW_API_KEY: ${{ secrets.LW_API_KEY }}
  LW_API_SECRET: ${{ secrets.LW_API_SECRET }}

name: Lacework Code Security (Push)
jobs:
  run-analysis:
    runs-on: ubuntu-latest
    name: Run analysis
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: Analyze
        uses: lacework/code-security-action@v1
        with:
          target: push

Tutorial 1: Running SCA and SAST scans as part of a pull request workflow

The following example is a GitHub Action workflow that triggers when a pull request is opened and new commits are made on any of the branches. It installs and runs the CLI to scan code from both the source and target branch. It compares the results of the scans from the source and target branch and uploads a SARIF file to generate alerts in GitHub for the developer. By comparing the results of the source and target branch, the scanner is returning results that surface new vulnerabilities introduced by the developer.

To run SCA and SAST scans as part of a pull request workflow:

name: Lacework SCA/SAST Pull Request 

on: 
  pull_request: 
    branches: 
      - main  # Specify the target branch for the pull request trigger 

jobs: 
  build: 
    runs-on: ubuntu-latest  # The job runs on the latest Ubuntu environment 

    steps: 
      # Step 1: Install the Lacework CLI and SCA component 
      - name: Install Lacework CLI 
        run: | 
          # Download and install the Lacework CLI using a shell script 
          curl https://raw.githubusercontent.com/lacework/go-sdk/main/cli/install.sh | bash 
          # Configure the Lacework CLI with account, API key, and secret from GitHub secrets 
          lacework configure -a ${{ secrets.LW_ACCOUNT }}.lacework.net -k ${{ secrets.LW_API_KEY }} -s ${{ secrets.LW_API_SECRET }} --noninteractive 
          # Install the Software Composition Analysis (SCA) component 
          lacework component install sca 

      # Step 2: Check out the source branch (head of the pull request) 
      - name: Checkout source branch 
        uses: actions/checkout@v3  # Use the checkout action to pull the source branch code 
        with: 
          ref: ${{ github.event.pull_request.head.ref }}  # Reference the source branch of the pull request 
          token: ${{ secrets.GITHUB_TOKEN }}  # Use the GitHub token for authentication 

      # Step 3: Run the Lacework SCA scan on the source branch and save the output 
      - name: Run Lacework SCA Scan on Source Branch 
        run: lacework sca scan ./ -f sarif -o /tmp/lacework-scan-source.json 
        # Scan the source branch code, output in SARIF format, and save to /tmp/lacework-scan-source.json 

      # Step 4: Check out the target branch of the pull request 
      - name: Checkout target branch 
        uses: actions/checkout@v3  # Use the checkout action to pull the target branch code 
        with: 
          ref: ${{ github.event.pull_request.base.ref }}  # Reference the target branch of the pull request 
          token: ${{ secrets.GITHUB_TOKEN }}  # Use the GitHub token for authentication 

      # Step 5: Run the Lacework SCA scan on the target branch and save the output 
      - name: Run Lacework SCA Scan on Target Branch 
        run: lacework sca scan ./ -f sarif -o /tmp/lacework-scan-target.json 
        # Scan the target branch code, output in SARIF format, and save to /tmp/lacework-scan-target.json 

      # Step 6: Compare results from the two scans and generate SARIF output 
      - name: Compare JSON Files and Generate SARIF 
        run: lacework sca compare --new /tmp/lacework-scan-source.json --old /tmp/lacework-scan-target.json --formats sarif -o /tmp/lacework-comparison.sarif 
        # Compare the JSON outputs from the source and target branches 
        # Generate the comparison result in SARIF format and save to /tmp/lacework-comparison.sarif 

      # Step 7: Upload the SARIF file for analysis or further use 
      - name: Upload SARIF File 
        uses: actions/upload-artifact@v3  # Use the upload artifact action to save the SARIF file 
        with: 
          name: lacework-comparison-report  # Name of the uploaded artifact 
          path: /tmp/lacework-comparison.sarif  # Path to the SARIF file

Tutorial 2: Running SCA and SAST scans daily on the default branch

The following example is a GitHub Action workflow that triggers every 24 hours. It installs and runs the CLI to scan code on the default branch and uploads a SARIF file to generate alerts in GitHub for the developer. By comparing the results of the source and target branch, the scanner is returning results that surface new vulnerabilities introduced by the developer.

To run SCA and SAST scans daily on the default branch:

name: Daily SCA Scan on Main Branch 

# Schedule the workflow to run every 24 hours 
on: 
  schedule: 
    - cron: '0 0 * * *'  # Runs every day at midnight UTC 

  # Also allow manual triggering of the workflow 
  workflow_dispatch: 

permissions: 
  security-events: write  # Grant permission to upload SARIF files for Code Scanning 
  contents: read  # Grant permission to read the contents of the repository 

jobs: 
  daily_scan: 
    runs-on: ubuntu-latest  # The job runs on the latest Ubuntu environment 

    steps: 
      # Step 1: Install the Lacework CLI and SCA component 
      - name: Install Lacework CLI 
        run: | 
          # Download and install the Lacework CLI using a shell script 

          curl https://raw.githubusercontent.com/lacework/go-sdk/main/cli/install.sh | bash 
          # Configure the Lacework CLI with account, API key, and secret from GitHub secrets 
          lacework configure -a ${{ secrets.LW_ACCOUNT }}.lacework.net -k ${{ secrets.LW_API_KEY }} -s ${{ secrets.LW_API_SECRET }} --noninteractive 
          # Install the Software Composition Analysis (SCA) component 
          lacework component install sca 

      # Step 2: Check out the main branch 
      - name: Checkout main branch 
        uses: actions/checkout@v3  # Use the checkout action to pull the main branch code 
        with: 
          ref: main  # Specify the main branch 
          token: ${{ secrets.GITHUB_TOKEN }}  # Use the GitHub token for authentication 

      # Step 3: Run the Lacework SCA scan on the main branch and generate SARIF output 
      - name: Run Lacework SCA Scan on Main Branch 
        run: lacework sca scan ./ -f sarif -o lacework-scan.sarif 
        # Scan the main branch code, output in SARIF format, and save to lacework-scan.sarif 

      # Step 4: Upload the SARIF file to GitHub Code Scanning 
      - name: Upload SARIF to GitHub Code Scanning 
        uses: github/codeql-action/upload-sarif@v2  # Use the GitHub action to upload SARIF 
        with: 
          sarif_file: lacework-scan.sarif  # Path to the SARIF file