Skip to content

Commit 37172d5

Browse files
tdrueztdruez
authored
[CRAVEX] Generic CI/CD integration (#1944)
Signed-off-by: tdruez <[email protected]>
1 parent 9881575 commit 37172d5

File tree

2 files changed

+147
-28
lines changed

2 files changed

+147
-28
lines changed

‎docs/automation.rst‎

Lines changed: 124 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,131 @@
33
Automation
44
==========
55

6-
To **automate ScanCode.io scans and schedule** them for regular execution or in
7-
response to **specific events**, such as commits or releases, you can explore
8-
various available options:
6+
**Automate ScanCode.io scans** by integrating them into your CI/CD pipelines or
7+
scheduling them to run on specific events such as commits, pull requests, or releases.
98

10-
1. Utilize an external ScanCode.io server (REST API)
9+
CI/CD Integrations
10+
------------------
11+
12+
Seamlessly integrate ScanCode.io into your development workflow to automatically scan
13+
code for licenses, vulnerabilities, and compliance issues.
14+
15+
GitHub Actions
16+
^^^^^^^^^^^^^^
17+
18+
Use the official `scancode-action <https://github.com/aboutcode-org/scancode-action>`_
19+
to integrate ScanCode.io into your GitHub workflows.
20+
21+
**Features:**
22+
23+
- Run ScanCode.io pipelines automatically
24+
- Check for compliance issues and policy violations
25+
- Detect security vulnerabilities
26+
- Generate SBOMs in multiple formats (SPDX, CycloneDX)
27+
- Export results in JSON and XLSX formats
28+
29+
**Example usage:**
30+
31+
.. code-block:: yaml
32+
33+
runs-on: ubuntu-latest
34+
steps:
35+
- uses: actions/checkout@v4
36+
with:
37+
path: scancode-inputs
38+
- uses: aboutcode-org/scancode-action@main
39+
with:
40+
pipelines: "scan_codebase"
41+
output-formats: "json xlsx spdx cyclonedx"
42+
43+
44+
**Documentation:**
45+
https://github.com/aboutcode-org/scancode-action
46+
47+
Jenkins
48+
^^^^^^^
49+
50+
Integrate ScanCode.io into your Jenkins pipelines with a simple Jenkinsfile.
51+
52+
**Quick example:**
53+
54+
.. code-block:: groovy
55+
56+
pipeline {
57+
agent any
58+
59+
stages {
60+
stage('Scan') {
61+
steps {
62+
sh '''
63+
docker run --rm \
64+
-v "${WORKSPACE}":/codedrop \
65+
ghcr.io/aboutcode-org/scancode.io:latest \
66+
run scan_codebase /codedrop \
67+
> scancode_results.json
68+
'''
69+
archiveArtifacts 'scancode_results.json'
70+
}
71+
}
72+
}
73+
}
74+
75+
**Full documentation:**
76+
https://github.com/aboutcode-org/scancode-action/blob/main/jenkins/README.md
77+
78+
GitLab
79+
^^^^^^
80+
81+
Run ScanCode.io scans in your GitLab pipelines.
82+
83+
**Full documentation:**
84+
https://github.com/aboutcode-org/scancode-action/blob/main/gitlab/README.md
85+
86+
Azure Pipelines
87+
^^^^^^^^^^^^^^^
88+
89+
Run ScanCode.io scans in Azure DevOps pipelines.
90+
91+
**Full documentation:**
92+
https://github.com/aboutcode-org/scancode-action/blob/main/azure-pipelines/README.md
93+
94+
Other CI/CD Systems
95+
^^^^^^^^^^^^^^^^^^^
96+
97+
ScanCode.io can be integrated into **any CI/CD system** that supports Docker using the
98+
:ref:`RUN command <cli_run>`.
99+
100+
**Requirements:**
101+
102+
- Docker must be installed and available in your CI/CD environment
103+
- Sufficient disk space for Docker images and scan results
104+
105+
**Basic command:**
106+
107+
.. code-block:: bash
108+
109+
docker run --rm \
110+
-v "$(pwd)":/codedrop \
111+
ghcr.io/aboutcode-org/scancode.io:latest \
112+
run [PIPELINE] [INPUTS] \
113+
> scancode_results.json
114+
115+
Replace ``[PIPELINE]`` with your desired pipeline (e.g., ``scan_codebase``,
116+
``scan_single_package``) and ``[INPUTS]`` with the path to scan.
117+
118+
See :ref:`available pipelines <built_in_pipelines>` for more options.
119+
120+
**Example with specific pipeline:**
121+
122+
.. code-block:: bash
123+
124+
docker run --rm \
125+
-v "$(pwd)":/codedrop \
126+
ghcr.io/aboutcode-org/scancode.io:latest \
127+
run scan_codebase /codedrop \
128+
> scancode_results.json
129+
130+
2. Utilize an external ScanCode.io server (REST API)
11131
----------------------------------------------------
12132

13133
If you have access to an external ScanCode.io server, you can interact with it
@@ -73,18 +193,6 @@ automation methods such as a cron job or a git hook::
73193
By providing the required environment variables in this manner, you can execute the
74194
script with the appropriate configurations and credentials.
75195

76-
2. Integrating ScanCode.io with GitHub Workflows
77-
------------------------------------------------
78-
79-
Seamlessly integrate ScanCode.io into your GitHub Workflows to enable automated scans
80-
as an integral part of your development process.
81-
82-
Visit the `scancode-action repository <https://github.com/aboutcode-org/scancode-action>`_
83-
to explore and learn more about the GitHub Action for ScanCode.io.
84-
The repository provides detailed information, usage instructions,
85-
and configuration options to help you incorporate code scanning effortlessly into your
86-
workflows.
87-
88196
3. Run a Local ScanCode.io app on your machine (management commands)
89197
--------------------------------------------------------------------
90198

‎docs/quickstart.rst‎

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -183,22 +183,31 @@ See the :ref:`installation` chapter for the full list of installation options.
183183
Integrate with Your Workflows
184184
-----------------------------
185185

186-
ScanCode.io can be part of your CI/CD workflow.
186+
ScanCode.io integrates seamlessly into CI/CD pipelines, enabling automated scans on
187+
commits, pull requests, releases, and scheduled events.
188+
189+
**Supported platforms:**
190+
191+
- **GitHub Actions** - Official action with built-in compliance checks
192+
- **GitLab** - Docker-based pipeline integration
193+
- **Jenkins** - Jenkinsfile integration with artifact archiving
194+
- **Azure Pipelines** - Azure DevOps pipeline support
195+
- **Any CI/CD system** - Direct Docker command integration
187196

188197
GitHub Actions
189198
^^^^^^^^^^^^^^
190199

191200
Use the official `scancode-action <https://github.com/aboutcode-org/scancode-action>`_
192-
to integrate **ScanCode.io into your GitHub workflows** with ease.
201+
to integrate ScanCode.io into your GitHub workflows.
193202

194-
This action lets you:
203+
**Features:**
195204

196-
- **Run pipelines**
197-
- **Check for compliance issues**
198-
- **Detect vulnerabilities**
199-
- **Generate SBOMs and scan results**
205+
- Run pipelines automatically on repository events
206+
- Check for compliance issues and policy violations
207+
- Detect security vulnerabilities
208+
- Generate SBOMs in multiple formats (SPDX, CycloneDX)
200209

201-
Example usage:
210+
**Example usage:**
202211

203212
.. code-block:: yaml
204213
@@ -212,8 +221,10 @@ Example usage:
212221
pipelines: "scan_codebase"
213222
output-formats: "json xlsx spdx cyclonedx"
214223
215-
Full details available at:
216-
https://github.com/aboutcode-org/scancode-action
224+
**Learn more:** https://github.com/aboutcode-org/scancode-action
217225

218-
.. tip::
219-
Learn more about automation options in the :ref:`automation` section.
226+
Other CI/CD Platforms
227+
^^^^^^^^^^^^^^^^^^^^^
228+
229+
For setup instructions and examples for other platforms, see the :ref:`automation`
230+
section.

0 commit comments

Comments
 (0)