> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/harness-security-scanners/shared/custom-scan/workflow-repo.md).

# Workflow Repo

1. Add a Build or Security stage to your pipeline.
2. If you're setting up an [`orchestratedScan`](/security-testing-orchestration/new-to-sto/key-concepts/run-an-orchestrated-scan-in-sto.md) or a [`dataLoad`](/security-testing-orchestration/new-to-sto/key-concepts/extraction-scans.md) scan of a code repository, set up your [codebase](/continuous-integration/use-harness-ci/use-harness-ci/codebase-configuration/create-and-configure-a-codebase.md).
3. If you're setting up an [`ingestionOnly`](/security-testing-orchestration/new-to-sto/key-concepts/ingest-scan-results-into-an-sto-pipeline.md) scan, add a Run step and set it up to save your scan results to a shared folder.

   The step might run the scan locally, download results from an external source, or copy results from another location in the workspace into the shared folder.
4. Add a [Custom Scan](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) step.
5. Review the [Important notes for Custom Scan steps](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md#important-notes-for-custom-scan-steps) for additional requirements and relevant information.

   If you're running an orchestrated or extraction scan on a Kubernetes or Docker build infrastructure, you need to add a [Docker-in-Docker background step](/security-testing-orchestration/use-sto/sto-scanner-configuration/security-step-settings-reference.md#configuring-docker-in-docker-dind-for-your-pipeline) to the stage.
6. Add the following `key:value` pairs to **Settings**.