Skip to content

Commit 7f21cfd

Browse files
asafcjfrogasafcjfrog
authored
Update frogbot-scan-pull-request.yml
1 parent 71a147c commit 7f21cfd

File tree

1 file changed

+5
-154
lines changed

1 file changed

+5
-154
lines changed

‎jfrog-applications/frogbot/templates/github-actions/frogbot-scan-pull-request.yml

+5-154
Original file line numberDiff line numberDiff line change
@@ -1,155 +1,6 @@
1-
name: "Frogbot Scan Pull Request"
2-
on:
3-
pull_request_target:
4-
types: [opened, synchronize]
5-
permissions:
6-
pull-requests: write
7-
contents: read
8-
# [Mandatory If using OIDC authentication protocol instead of JF_ACCESS_TOKEN]
9-
# id-token: write
10-
jobs:
11-
scan-pull-request:
12-
runs-on: ubuntu-latest
13-
# A pull request needs to be approved before Frogbot scans it. Any GitHub user who is associated with the
14-
# "frogbot" GitHub environment can approve the pull request to be scanned.
15-
environment: frogbot
16-
steps:
17-
- uses: jfrog/frogbot@v2
18-
env:
19-
# [Mandatory]
20-
# JFrog platform URL
21-
JF_URL: ${{ vars.JF_URL }}
1+
**The JFrog Security documentation has a new home!**\
2+
You can now find it [here](https://jfrog.com/help/p/security-home), including sections on:
223

23-
# [Mandatory if JF_USER and JF_PASSWORD are not provided]
24-
# JFrog access token with 'read' permissions on Xray service
25-
JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}
26-
27-
# [Mandatory if JF_ACCESS_TOKEN is not provided]
28-
# JFrog username with 'read' permissions for Xray. Must be provided with JF_PASSWORD
29-
# JF_USER: ${{ secrets.JF_USER }}
30-
31-
# [Mandatory if JF_ACCESS_TOKEN is not provided]
32-
# JFrog password. Must be provided with JF_USER
33-
# JF_PASSWORD: ${{ secrets.JF_PASSWORD }}
34-
35-
# [Mandatory]
36-
# The GitHub token is automatically generated for the job
37-
JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38-
39-
# [Optional, default: https://api.github.com]
40-
# API endpoint to GitHub
41-
# JF_GIT_API_ENDPOINT: https://github.example.com
42-
43-
# [Optional]
44-
# By default, the Frogbot workflows download the Frogbot executable as well as other tools
45-
# needed from https://releases.jfrog.io
46-
# If the machine that runs Frogbot has no access to the internet, follow these steps to allow the
47-
# executable to be downloaded from an Artifactory instance, which the machine has access to:
48-
#
49-
# 1. Login to the Artifactory UI, with a user who has admin credentials.
50-
# 2. Create a Remote Repository with the following properties set.
51-
# Under the 'Basic' tab:
52-
# Package Type: Generic
53-
# URL: https://releases.jfrog.io
54-
# Under the 'Advanced' tab:
55-
# Uncheck the 'Store Artifacts Locally' option
56-
# 3. Set the value of the 'JF_RELEASES_REPO' variable with the Repository Key you created.
57-
# JF_RELEASES_REPO: ""
58-
59-
# [Optional]
60-
# Configure the SMTP server to enable Frogbot to send emails with detected secrets in pull request scans.
61-
# SMTP server URL including should the relevant port: (Example: smtp.server.com:8080)
62-
# JF_SMTP_SERVER: ""
63-
64-
# [Mandatory if JF_SMTP_SERVER is set]
65-
# The username required for authenticating with the SMTP server.
66-
# JF_SMTP_USER: ""
67-
68-
# [Mandatory if JF_SMTP_SERVER is set]
69-
# The password associated with the username required for authentication with the SMTP server.
70-
# JF_SMTP_PASSWORD: ""
71-
72-
##########################################################################
73-
## If your project uses a 'frogbot-config.yml' file, you can define ##
74-
## the following variables inside the file, instead of here. ##
75-
##########################################################################
76-
77-
# [Mandatory if the two conditions below are met]
78-
# 1. The project uses yarn 2, NuGet or .NET Core to download its dependencies
79-
# 2. The `installCommand` variable isn't set in your frogbot-config.yml file.
80-
#
81-
# The command that installs the project dependencies (e.g "nuget restore")
82-
# JF_INSTALL_DEPS_CMD: ""
83-
84-
# [Optional, default: "."]
85-
# Relative path to the root of the project in the Git repository. If left empty (without providing "." yourself as default), a recursive scan is triggered from the root directory of the project.
86-
# JF_WORKING_DIR: path/to/project/dir
87-
88-
# [Default: "*git*;*node_modules*;*target*;*venv*;*test*"]
89-
# List of exclusion patterns (utilizing wildcards) for excluding paths in the source code of the Git repository during SCA scans.
90-
# JF_PATH_EXCLUSIONS: "*git*;*node_modules*;*target*;*venv*;*test*"
91-
92-
# [Optional]
93-
# Xray Watches. Learn more about them here: https://www.jfrog.com/confluence/display/JFROG/Configuring+Xray+Watches
94-
# JF_WATCHES: <watch-1>,<watch-2>...<watch-n>
95-
96-
# [Optional]
97-
# JFrog project. Learn more about it here: https://www.jfrog.com/confluence/display/JFROG/Projects
98-
# JF_PROJECT: <project-key>
99-
100-
# [Optional, default: "FALSE"]
101-
# Displays all existing vulnerabilities, including the ones that were added by the pull request.
102-
# JF_INCLUDE_ALL_VULNERABILITIES: "TRUE"
103-
104-
# [Optional, default: "FALSE"]
105-
# When adding new comments on pull requests, keep old comments that were added by previous scans.
106-
# JF_AVOID_PREVIOUS_PR_COMMENTS_DELETION: "TRUE"
107-
108-
# [Optional, default: "TRUE"]
109-
# Fails the Frogbot task if any security issue is found.
110-
# JF_FAIL: "FALSE"
111-
112-
# [Optional]
113-
# Frogbot will download the project dependencies if they're not cached locally. To download the
114-
# dependencies from a virtual repository in Artifactory, set the name of the repository. There's no
115-
# need to set this value, if it is set in the frogbot-config.yml file.
116-
# JF_DEPS_REPO: ""
117-
118-
# [Optional, Default: "FALSE"]
119-
# If TRUE, Frogbot creates a single pull request with all the fixes.
120-
# If false, Frogbot creates a separate pull request for each fix.
121-
# JF_GIT_AGGREGATE_FIXES: "FALSE"
122-
123-
# [Optional, Default: "FALSE"]
124-
# Handle vulnerabilities with fix versions only
125-
# JF_FIXABLE_ONLY: "TRUE"
126-
127-
# [Optional]
128-
# Set the minimum severity for vulnerabilities that should be fixed and commented on in pull requests
129-
# The following values are accepted: Low, Medium, High or Critical
130-
# JF_MIN_SEVERITY: ""
131-
132-
# [Optional]
133-
# List of comma-separated(,) email addresses to receive email notifications about secrets
134-
# detected during pull request scanning. The notification is also sent to the email set
135-
# in the committer git profile regardless of whether this variable is set or not.
136-
# JF_EMAIL_RECEIVERS: ""
137-
138-
# [Optional]
139-
# Set the list of allowed licenses
140-
# The full list of licenses can be found in:
141-
# https://github.com/jfrog/frogbot/blob/master/docs/licenses.md
142-
# JF_ALLOWED_LICENSES: "MIT, Apache-2.0"
143-
144-
# [Optional]
145-
# Avoid adding extra info to pull request comments. that isn't related to the scan findings.
146-
# JF_AVOID_EXTRA_MESSAGES: "TRUE"
147-
148-
# [Optional]
149-
# Add a title to pull request comments generated by Frogbot.
150-
# JF_PR_COMMENT_TITLE: ""
151-
152-
# [Mandatory if using OIDC authentication protocol instead of JF_ACCESS_TOKEN]
153-
# Insert to oidc-provider-name the 'Provider Name' defined in the OIDC integration configured in the JPD
154-
# with:
155-
# oidc-provider-name: ""
4+
* [CLI](https://jfrog.com/help/r/jfrog-security-user-guide/developers/cli)
5+
* [Frogbot](https://jfrog.com/help/r/jfrog-security-user-guide/developers/frogbot)
6+
* [IDEs](https://jfrog.com/help/r/jfrog-security-user-guide/developers/ides)

0 commit comments

Comments
 (0)