Synopsys adds GitHub Action for SAST and SCA

Under the hood, DETECTOR performs a dependency scan, reading package manager files (e.g., pom.xml file for maven) to identify declared and transitive dependencies. A prerequisite to use Detect’s package management scanning is to ensure the build tool is present in the environment. You’ll notice that in the example above, a mvn command is run before the Synopsys Detect command. This satisfies the prerequisite because maven exists in the GitHub Maven Java starter workflow.

Comprehensive SCA

Lightweight SCA provides a fast way to understand all the declared dependencies in your project. However, your project will typically contain more than just dependencies declared in package management files. Plus, some programming languages don’t even use package management. Therefore, these cases might call for a deeper analysis to ensure you are identifying and managing every single open source component in your application. Invoking a full SCA scan involves signature scanning, which compares the SHAs of the scanned files to our Black Duck KnowledgeBase™. Signature scanning is pretty easy because it’s included in the default scan if the “detect.tools” flag is not specified.

Generating Black Duck reports

Wouldn’t it be great to generate an SCA risk summary report after you scan using the Synopsys Detect GitHub Action? Say no more! You can enable this feature with two steps:

1. Add the flag “--detect.risk.report.pdf=true” to the args line in your workflow yaml.
2. Use the upload-artifact GitHub Action to upload the generated PDF. Note: The path attribute will be in the following format: [project _name]_[version_name]_BlackDuck_RiskReport.pdf. If this doesn’t seem to work, you can find the actual name in the Actions run logs in the Synopsys Detect section.

If generating and uploading the risk report was successful, an Artifacts dropdown should appear on the top right side of your Actions run logs, as shown in the screenshot above.

Static analysis

But wait—there’s more!

SCA is only part of the AppSec equation. Now that you have the open source components covered, it’s time to look in the mirror and scan your own code for quality and security issues with Coverity static analysis (SAST). Using the same Synopsys Detect GitHub Action, you can also invoke a Coverity scan through Polaris. You’ll need to use the Polaris properties in Synopsys Detect, and add a yaml file to your repo that Polaris consumes.

You can perform two types of Coverity Polaris SAST scans: build and buildless. As their names suggest, one requires a build and one does not. To invoke a buildless scan, follow the steps in the buildless capture section of our GitHub Action external docs. Or see the steps to invoke a build capture. The screenshot below shows an example GitHub Actions yaml.

CoPilot is powered by Black Duck and the Black Duck KnowledgeBase. It gives you a risk score badge from Black Duck, as well as a reporting interface that looks something like this: