CloudBees action: Scan with Mend SCA

Use this action to scan a Git repository with the Mend software composition analysis (SCA) scanner. Mend SCA can detect security vulnerabilities in open-source dependencies. The Mend scanner identifies the library license type used in your project, vulnerabilities in the dependencies, and possible fixes.

The Mend SCA scan task executes within the platform infra, so the only use of the Mend URL and credentials is to fetch the scanning rules and threshold. CloudBees does not upload anything else (no source code or images) from the customer.

Before the scan, the Mend action connects with the Mend server to get the rules and define some properties, including asset destination path, output path, project, and log level.

If you publish a Docker image in your workflow, this action runs a Mend container scan on the image, and generates a JSON-formatted report, available in the Security insights section of the platform analytics.

Inputs

Table 1. Input details

Input name	Data type	Required?	Description
server-url	String	Yes	The Mend server URL.
username	String	Yes	The Mend username.
token	String	Yes	The Mend client secret.
language	String	No	The language of your Git repository code base. Refer to the supported languages below.

Supported languages

Table 2. Supported languages with inputs

Supported language	Input format
Go	LANGUAGE_GO
Java	LANGUAGE_JAVA
JavaScript	LANGUAGE_JS
PHP	LANGUAGE_PHP
Ruby	LANGUAGE_RUBY

Usage example

In your YAML file, add:

      - name: Scan with Mend SCA
        uses: cloudbees-io/mend-sca-scan-dependency@v1
        with:
          server-url: ${{ vars.MEND_SERVER_URL }}
          username: ${{ secrets.MEND_USERNAME }}
          token: ${{ secrets.MEND_SECRET }}
          language: "LANGUAGE_JAVA"

License

This code is made available under the MIT license.

References

• Learn more about using actions in CloudBees workflows.

• Learn about the CloudBees platform.