> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-solutions-factory/use-hsf/workflows/sast-sca-workflow.md).

# SAST & SCA Workflow

The **Deploy Harness SAST & SCA Templates** workflow provisions a suite of step group, stage, and pipeline templates that give your teams out-of-the-box security scanning capabilities. The goal is day-one operations: teams can start scanning repositories for vulnerabilities immediately, even before a CI pipeline is in place.

Once this workflow completes, it also creates a second workflow in IDP that end users can run to register their own repositories for scanning.

***

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

* **HSF deployed:** HSF is deployed and post-deployment configuration is complete. Go to [Post-deployment configuration](/harness-solutions-factory/new-to-hsf/get-started.md) to complete it.
* **Build farm configured:** Every repository scan needs build infrastructure to run on. Go to [Central Build Farm Workflow](/harness-solutions-factory/use-hsf/workflows/central-build-farm-workflow.md) to configure one first.
* **Group membership:** You have been added to the **HSF Users** or **HSF Admins** group.

***

### Inputs <a href="#inputs" id="inputs"></a>

The workflow form collects the following values:

| Input                     | Description                                            | Notes                                                   |
| ------------------------- | ------------------------------------------------------ | ------------------------------------------------------- |
| Build infrastructure type | The infrastructure scans will run on                   | Must match your configured build farm                   |
| Scanner selection         | Which security scanners to enable for repository scans | Order does not matter, because scanners run in parallel |
| STO config manager repo   | Where to host the config manager configuration         | Bring your own repo or let HSF create one               |

***

### Steps <a href="#steps" id="steps"></a>

Complete the following three steps in the workflow form.

#### Step 1: Choose your build infrastructure <a href="#step-1-choose-your-build-infrastructure" id="step-1-choose-your-build-infrastructure"></a>

Every repository scan needs a build infrastructure to execute on. Select the same infrastructure type you configured in Central Build Farm Setup to ensure consistency across scans.

{% hint style="info" %}
For consistency, create a stage template with a defined build infrastructure for all scans. This prevents individual teams from using different infrastructure configurations for their scans.
{% endhint %}

#### Step 2: Set up the STO config manager <a href="#step-2-set-up-the-sto-config-manager" id="step-2-set-up-the-sto-config-manager"></a>

One of the biggest challenges in security scanning is handling the variation between applications: different scanners, exclusion rules, and overrides needed per repo or team. HSF solves this with a hierarchical config manager approach.

The `harness-sto-config-manager` plugin (available as a public image on DockerHub) lets a central DevSecOps team define scanner configurations and overrides at multiple levels (account, org, project, or repo) and resolves the hierarchy automatically at scan time.

When you set up the config manager, you have two options:

* **Bring your own repo:** point HSF at an existing repository where your config manager configuration lives.
* **Let HSF create a repo:** HSF will create and manage the config repository in Harness Code Repository.

{% hint style="info" %}
`skipped` variables in the `STO_SCA_SAST_PRIMER` workspace are intentional. They act as null placeholders that make future configuration easier, because the workspace knows how to handle them without errors. To make adjustments after provisioning, navigate to the workspace and update the relevant variables.
{% endhint %}

#### Step 3: Choose your scanners <a href="#step-3-choose-your-scanners" id="step-3-choose-your-scanners"></a>

Select which security scanners you want enabled for repository scans. Scanners run in parallel, so the order of selection does not affect execution time or results.

***

### What gets created <a href="#what-gets-created" id="what-gets-created"></a>

The workflow provisions the following resources:

| Resource             | Details                                                                     |
| -------------------- | --------------------------------------------------------------------------- |
| Step group templates | Reusable step groups for security scanning stages                           |
| Stage templates      | Pre-configured scan stages with defined build infrastructure                |
| Pipeline templates   | Full scanning pipelines teams can adopt immediately                         |
| IaCM workspace       | `STO_SCA_SAST_PRIMER` in the Solutions Factory project                      |
| IDP workflow         | A second workflow end users run to register their repositories for scanning |

#### Expected output <a href="#expected-output" id="expected-output"></a>

After the workflow completes, confirm each of the following:

* [ ] Templates are visible in **Account** → **Templates**.
* [ ] The `STO_SCA_SAST_PRIMER` workspace appears in **IaCM** → **Workspaces**.
* [ ] A new **Register Repository for Scanning** workflow appears in **IDP** → **Workflows** for end users.
* [ ] An IDP catalog entry for the workspace is registered automatically.

***

### Update the configuration after provisioning <a href="#update-the-configuration-after-provisioning" id="update-the-configuration-after-provisioning"></a>

To adjust scanner configuration or update the config manager settings after provisioning, navigate to **IaCM** → **Workspaces** → `STO_SCA_SAST_PRIMER`, update the relevant variable, and re-execute the workspace.

***

### Next steps <a href="#next-steps" id="next-steps"></a>

Your teams can now scan repositories using the provisioned templates. Continue with the following:

* [Execute a Workflow](/harness-solutions-factory/use-hsf/workflows/execute-a-workflow.md): Review the end-to-end execution and approval flow for any HSF workflow.
* [How workflows work](/harness-solutions-factory/use-hsf/workflows/overview.md): Review the full list of default HSF workflows.
* [Created resources](/harness-solutions-factory/use-hsf/created-resources.md): Understand what HSF provisions across your account.