Jfrog Xray step configuration

Scan container images with Jfrog Xray.

You can ingest scan results for your container images from JFrog Xray.

Workflow descriptions

This workflow applies to scanner integrations that support Ingestion mode.

1. Add a Build or Security stage to your pipeline.

2. Add a Run step and set it up to save your scan results to a shared folder.

   For more information, go to Run an ingestion scan in an STO Pipeline.

3. Add a Custom Scan step.

4. Review the Important notes for Custom Scan steps for additional requirements and relevant information.

5. Add the relevant key:value pairs to Settings.

Required settings

• Product name

• Scan type

• Policy type

• Product config name

• Target and variant

• Ingestion file

• Fail on severity

YAML step example

- step:
    type: Security
    name: custom_scan_xray
    identifier: custom_scan_xray
    spec:
      privileged: true
      settings:
        policy_type: ingestionOnly
        scan_type: containerImage
        product_name: xray
        product_config_name: default
        target_name: YOUR_REPO/YOUR_IMAGE
        target_variant: YOUR_TAG
        ingestion_file: /shared/scan_results/xray2.json

Custom Scan step settings for JFrog XRay

Scanner settings

These settings are required.

Product name

Key

product_name

Value

xray

Scan type

Key

scan_type

Value

containerImage

Policy type

Key

policy_type

Value

ingestionOnly

Product config

Key

product_config_name

Value

default

Target and variant

Every Custom Scan step needs a target and baseline.

• Target name

• Target variant

Target name

Key

target_name

Value

A user-defined label for the code repository, container, application, or configuration to scan. Specify a unique, descriptive name. This makes it much easier to navigate your scan results in the STO UI.

Target variant

Key

target_variant

Value

A user-defined label for the branch, tag, or other target variant to scan.

Ingestion file

This setting applies to Custom Scan steps when the policy_type is ingestionOnly.

Key

ingestion_file

Value

The path to your scan results when running an Ingestion scan, for example /shared/scan_results/myscan.latest.sarif.

• The data file must be in a supported format for the scanner.

• The data file must be accessible to the scan step. It's good practice to save your scan results to a shared path in your stage. In the visual editor, go to the stage where you're running the scan. Then go to Overview > Shared Paths. You can also add the path to the YAML stage definition like this:

      - stage:
        spec:
          sharedPaths:
            - /shared/scan_results

Fail on severity

If the scan finds any vulnerability with the specified severity level or higher, the pipeline fails automatically. NONE means do not fail on severity.

For more information, go to:

• STO workflows for blocking builds and PRs.

• Exemptions to override Fail on Severity thresholds for specific issues in STO

Key

fail_on_severity

Value

CRITICAL

MEDIUM

LOW

INFO

NONE

YAML pipeline example

The following pipeline example shows a simple ingestion workflow. The Run step downloads a results file to /shared/scan_results/xray2.json. The Custom Scan step then ingests the file.

For information about running scans using XRay, go to the JFrog documentation.

pipeline:
  name: xray_ingest_example
  identifier: xray_ingest_example
  projectIdentifier: default
  orgIdentifier: default
  tags: {}
  properties:
    ci:
      codebase:
        connectorRef: stoplugins
        build: <+input>
  stages:
    - stage:
        name: xray_scan_stage
        identifier: xray_scan_stage
        description: ""
        type: SecurityTests
        spec:
          cloneCodebase: true
          caching:
            enabled: true
            paths: []
          platform:
            os: Linux
            arch: Amd64
          runtime:
            type: Cloud
            spec: {}
          execution:
            steps:
              - step:
                  type: Run
                  name: pull_from_s3
                  identifier: pull_from_s3
                  spec:
                    connectorRef: YOUR_IMAGE_REGISTRY_CONNECTOR_ID
                    image: amazon/aws-cli
                    shell: Sh
                    command: aws s3api get-object --bucket my-xray-scan-results --key YOUR_RESULTS_FILE /shared/scan_results/YOUR_RESULTS_FILE
                    envVariables:
                      AWS_ACCESS_KEY_ID: <+secrets.getValue("YOUR_AWS_ACCESS_KEY")>
                      AWS_SECRET_ACCESS_KEY: <+secrets.getValue("YOUR_SECRET_ACCESS_KEY")>
                      AWS_DEFAULT_REGION: us-east-1
                  when:
                    stageStatus: Success
              - step:
                  type: Security
                  name: custom_scan_xray
                  identifier: custom_scan_xray
                  spec:
                    privileged: true
                    settings:
                      policy_type: ingestionOnly
                      scan_type: containerImage
                      product_name: xray
                      product_config_name: default
                      target_name: YOUR_REPO/YOUR_IMAGE
                      target_variant: YOUR_TAG
                      ingestion_file: /shared/scan_results/YOUR_RESULTS_FILE
          sharedPaths:
            - /shared/scan_results/