Skip to main content

Integrate the Portal with CI/CD tools

Continuous integration and continuous delivery (CI/CD) are essential to the modern software development lifecycle. To help you build and deliver secure software, ReversingLabs provides official CI/CD integrations for the Spectra Assure Portal that you can use in new and existing software development projects.

More specifically, the Portal can integrate with popular CI/CD services to scan your build artifacts (compiled software packages) for security issues. The artifacts are uploaded to your Portal instance, scanned, and added to a project and package of your choice as a new package version (or as a reproducible build artifact of an existing version).

All successfully scanned artifacts are visible in the Portal interface, and accessible by you and any other Portal users who can access your projects. You can then view the analysis report and manage the artifact like any other package version on the Portal. By default, artifacts uploaded to the Portal through the official integrations have their release status set to "Unreleased" in the project and package they're added to.

Based on the scan results, you can configure the build to fail if major issues are detected, and prevent potentially compromised software from reaching the release stage. You can also download the analysis results in any of the supported report formats, and depending on the integration, display the results directly in the interface of your CI/CD service.

Supported integrations​

This section lists the official Portal integrations currently provided by ReversingLabs. All integrations come with usage instructions and examples.

In general, the CI/CD integrations rely on the rl-scanner-cloud Docker image to connect to a Portal instance from the container and upload the artifact to the Portal for scanning.

An active Portal account with a Personal Access Token is required to use the integrations.

GitHub Action: rl-scanner-cloud-only
Uses the rl-scanner-cloud Docker image to upload and scan a build artifact on the Portal, and displays the analysis status as a check in the GitHub interface. Optionally downloads and saves analysis reports.
GitHub Action: rl-scanner-cloud-composite
Extends 'rl-scanner-cloud-only' to automatically upload reports to GitHub, update the commit status and return the exit status. Optionally downloads and saves analysis reports.
Icon-devops-261
Azure DevOps Template
A template for integrating the Portal in Azure DevOps Pipelines using the rl-scanner-cloud Docker image.
Icon-devops-261
Azure DevOps Extension
An Azure DevOps Marketplace extension for integrating the Portal in Azure DevOps Pipelines.
GitLab CI
A GitLab CI configuration that can be remotely included in pipelines to integrate with the Portal using the rl-scanner-cloud Docker image.

Examples​

This section lists ready-to-use, realistic examples for Portal integrations. These examples are convenient for quickly testing each integration before you add it to your CI/CD pipelines.

In all the examples, we're using the source code and Maven build instructions for the Struts2 showcase web app, which came with Apache Struts v2.5.28. The examples illustrate a common CI/CD use-case with:

  • the build stage, where the artifact is created
  • the test stage, where the artifact is uploaded to the Portal and scanned
  • the publish stage, where analysis reports are generated in the Portal and optionally stored in a specific location or displayed in the CI/CD service interface

All examples are hosted in public GitHub repositories maintained by ReversingLabs. To try out an example, you can fork or clone its repository. Then, follow the instructions in the repository and use the resources linked in the supported integrations section on this page to modify the configuration if necessary.

All examples require an active Portal account with a Personal Access Token.

GitHub Action: struts2showcase
Multiple examples that show how to use the rl-scanner-cloud Docker image with GitHub Actions.
Icon-devops-261
Azure DevOps: struts2showcase
An example Azure DevOps pipeline script for scanning a build artifact with the rl-scanner-cloud Docker image.
Jenkins: struts2showcase
Examples of Jenkins pipeline scripts for scanning a build artifact with the rl-scanner-cloud Docker image.
GitLab CI: struts2showcase
Example of a GitLab CI pipeline with an included remote configuration that builds an artifact and scans it using the rl-scanner-cloud Docker image.

Spectra Assure Portal SDK​

ReversingLabs provides an official SDK (software development kit) for Python that can be used to integrate the Spectra Assure Portal and interact with it in your own applications. The SDK provides access to operations supported by the Spectra Assure APIs.

The SDK library can be installed directly from PyPi as spectra-assure-sdk.

For usage instructions and examples, refer to the documentation in the SDK GitHub repository.