GitHub Action

Avvia una scansione Vulnara da un workflow GitHub e fai fallire il job quando un finding raggiunge la gravità che hai scelto.

Crea il tuo workflow

Scegli le opzioni e copia il file in .github/workflows/. Le credenziali restano nei secret e nelle variabili di GitHub.

.github/workflows/vulnara.yml

name: Vulnara Scan
on:
  push:
    branches: [main]
  pull_request:

jobs:
  vulnara:
    runs-on: ubuntu-latest
    steps:
      - uses: theorigamicorporation/vulnara-action@v1
        id: vulnara
        with:
          service-account: ${{ vars.VULNARA_SERVICE_ACCOUNT }}
          token: ${{ secrets.VULNARA_TOKEN }}
          tenant: ${{ vars.VULNARA_TENANT }}
          scan-tools: '11111111-2222-3333-4444-555555555555'
          fail-on: critical
      - run: echo "Highest severity ${{ steps.vulnara.outputs.highest-severity }}"
        if: always()

Nelle impostazioni del repository aggiungi VULNARA_TOKEN come secret, e VULNARA_SERVICE_ACCOUNT e VULNARA_TENANT come variabili.

Input

Nome	Descrizione
service-accountObbligatorio	Vulnara service account username.
tokenObbligatorio	Vulnara service account token (password). Store it as a GitHub secret.
tenantObbligatorio	Vulnara tenant (workspace) id the service account belongs to.
scan-tools	Comma-separated scan tool ids to run on the repository. Names are not accepted. List the ids with `vulnara docker_scan_tools` (vulnara-cli) or the GraphQL query `dockerScanTools { id categories }`. Required unless web-target-id or web-url is set.
branch	Branch to scan. Defaults to the branch that triggered the workflow.
repository	owner/name of the repository to scan in Vulnara. Defaults to the current GitHub repository.
git-token-id	Vulnara git token id to use for cloning (required for private repositories).
fail-on	Fail the job if a finding at or above this severity is found: none \| low \| medium \| high \| critical.Predefinito: `critical`
fail-on-exploited	Also fail the job on actively exploited findings in this run: none \| kev (CVE in the CISA Known Exploited Vulnerabilities catalogue) \| likely (KEV, or an EPSS score at or above epss-threshold). Findings with a recorded triage decision are skipped.Predefinito: `none`
epss-threshold	EPSS probability (0 to 1) at or above which fail-on-exploited: likely fails the job.Predefinito: `0.1`
create-issue	Create an issue in the repository for findings.Predefinito: `false`
auto-remediate	Open a fix pull request for findings (requires create-issue).Predefinito: `false`
wait-timeout	Max seconds to wait for each scan (repository or web application) to finish before failing.Predefinito: `1800`
poll-interval	Seconds between scan status checks.Predefinito: `15`
web-target-id	Id of an existing Vulnara web target to run a web application scan on, e.g. after deploying a preview. Its findings feed the same fail-on gate. Mutually exclusive with web-url.
web-url	Base URL of a web application to scan. The web target registered for it is reused, or the URL is registered as a new web target. Requires web-ownership-consent: true. Mutually exclusive with web-target-id.
web-ownership-consent	Set to exactly "true" to confirm you own the application at web-url or are authorised to scan it. Required for web-url; registering a target records this attestation.Predefinito: `false`
app-url	Vulnara web app base URL, used to build links to scans in the platform.Predefinito: `https://vulnara.rso.dev`
gateway-url	Vulnara GraphQL API URL.Predefinito: `https://vulnara-gw.rso.dev/graphql`
token-url	OAuth token endpoint.Predefinito: `https://auth.theorigamicorporation.com/application/o/token/`
oauth-client-id	OAuth client id used for the service-account token exchange.Predefinito: `hl04e6MSMRY60LdpGh5rdMRQjkPxvldAYoqXdzo4`

Output

Nome	Descrizione
scan-result-ids	Space-separated ids of the scan results that were started.
highest-severity	The highest finding severity discovered across the scans (or "none").
passed	"true" if the scans passed the fail-on and fail-on-exploited gates, "false" otherwise.
exploited-count	Actively exploited findings in this run that fail-on-exploited counts (0 when it is none).
kev-count	How many of those are in the CISA KEV catalogue.
web-target-id	Id of the web target that was scanned, when a web application scan ran.
web-scan-result-id	Id of the web application scan result, when one ran.