Security Center:Install the CI/CD plug-in for GitHub Actions

Prerequisites

Before you begin, make sure you have:

• A GitHub repository with an existing Actions workflow

• A CI/CD plug-in token from Security Center. See Obtain a token of the CI/CD plug-in. Store this token as a GitHub encrypted secret (SAS_TOKEN).

• An AccessKey ID and AccessKey secret for a RAM user. Store both values as GitHub encrypted secrets (ACCESSKEYID and ACCESSKEYSECRET)

Add the image scanning step to your workflow

1. Log on to GitHub.

2. Click your profile picture in the upper-right corner and select Your repositories from the drop-down list.

3. On the Repositories tab, click the repository you want to configure.

4. Click the Actions tab.

5. In the All workflows section, find the target pipeline file and click the icon in the Actor column.

6. Select View workflow file.

7. In the Workflow file for this run section, add the scanning step based on the following example:

   name: Docker build and scan security issue by sas-image-scanner
   
   on:
     push:
       branches: [ main ]
     pull_request:
       branches: [ main ]
   
   env:
     REPO_TAG: your_docker_image_repo:your_docker_image_tag
   
   jobs:
   
     build:
   
       runs-on: ubuntu-latest
   
       steps:
       - uses: actions/checkout@v2
       - name: Build the Docker image
         run: docker build . --file Dockerfile --tag ${{ env.REPO_TAG }}
       - name: Scan image by sas-image-scanner
         run: >
             docker run --rm -v /var/run/docker.sock:/var/run/docker.sock --network=host
             sas-image-scanner-registry.cn-hangzhou.cr.aliyuncs.com/sas_public/sas-image-scanner:latest
             --accessKeyId=${{ secrets.ACCESSKEYID }} --accessKeySecret=${{ secrets.ACCESSKEYSECRET }}
             --token=${{ secrets.SAS_TOKEN }} --imageId=${{ env.REPO_TAG }}

   The following table describes the parameters.

   Parameter	Required	Default	Description
   accessKeyId	Yes	—	AccessKey ID of your RAM user
   accessKeySecret	Yes	—	AccessKey secret of your RAM user
   token	Yes	—	Token of the CI/CD plug-in
   imageId	Yes	—	Image ID or image repository tag. By default, images are scanned locally. To scan a remote image, set this to the image repository tag and also configure registryUrl, registryUsername, and registryPwd.
   domain	No	(none)	Endpoint of Security Center. Set to tds.ap-southeast-1.aliyuncs.com.
   registryUrl	No	(none)	URL of the remote image repository. Required when scanning remote images.
   registryUsername	No	(none)	Username for the remote image repository. Required when scanning remote images.
   registryPwd	No	(none)	Password for the remote image repository. Required when scanning remote images.

After you complete the configurations, Security Center scans images in the project for risks when you build the project.

What's next

View scan results on the Container tab of the Assets page in the Security Center console. See View image scan results.