Fossa step configuration

Scan code repositories with Fossa.

You can ingest scan results from Fossa. For a description of the high-level workflow, go to Run an ingestion scan in an STO Pipeline.

Fossa step settings for STO scans

The recommended workflow is to add a Fossa step to a Security Tests or CI Build stage and then configure it as described below.

Scan

Scan Mode

Scan Configuration

Target

Type

Target and Variant Detection

Name

Variant

Workspace (repository)

Ingestion File

The Fossa JSON results file to ingest.

Log Level

Fail on Severity

Additional Configuration

Advanced settings

Proxy settings

YAML pipeline example

This pipeline pulls a Fossa JSON data file from a GitHub repo and then ingests it.

pipeline:
  name: smp-fossa
  identifier: fossastp
  projectIdentifier: STO
  orgIdentifier: default
  tags: {}
  stages:
    - stage:
        name: fossa-test
        identifier: fossatest
        type: SecurityTests
        spec:
          cloneCodebase: false
          execution:
            steps:
              - step:
                  type: Run
                  name: Pull File
                  identifier: Pull_File
                  spec:
                    connectorRef: CONTAINER_IMAGE_REGISTRY_CONNECTOR
                    image: alpine/curl
                    shell: Sh
                    command: |-
                      curl https://github.com/myorg/fossa-scans/latest.json > /harness/latest.json
                      cat /harness/latest.json
              - step:
                  type: Fossa
                  name: Fossa_1
                  identifier: Fossa_1
                  spec:
                    imagePullPolicy: Always
                    mode: ingestion
                    config: default
                    target:
                      type: repository
                      name: test
                      variant: test
                    ingestion:
                      file: /harness/latest.json
          infrastructure:
            type: KubernetesDirect
            spec:
              connectorRef: K8S_DELEGATE_CONNECTOR
              namespace: harness-delegate-ng
              automountServiceAccountToken: true
              nodeSelector: {}
              os: Linux