CircleCI

CircleCI is a continuous integration and continuous delivery platform that can be used to implement DevOps practices. It helps development teams release code rapidly by automating build, test, and code deployments.

This how-to will provide a basic understanding of how add the Relyance Source Code inspector (SCI) into a typical build job.

Prerequisites:

1. A source code repository needs to be available and connected to a CircleCI project.
2. The relyance.yaml file needs to be in the source code root directory.
3. Grab the command line code from Step 2 of the Relyance Source Code Integration settings from your Relyance instance.

See more info about the SCI commands here.

Steps:

1. Login to your CircleCI account.
2. Go to the project in question.
3. Select the branch in question (master).
4. If there is no config, setup the project and use the following yaml configuration:

version: 2.1
jobs:
  relyance:
    machine:
      image: ubuntu-2004:202010-01
    steps:
      - checkout
      - run: docker pull gcr.io/relyance-ext/compliance_inspector:release && docker run --rm -v `pwd`:/repo --env 'API_KEY=example:abcdefg0123456789abcdefg0123456789abcdefg' gcr.io/relyance-ext/compliance_inspector:release
workflows:
  version: 2
  example_workflow:
    jobs:
      - relyance

  daily-run-workflow:
    triggers:
      - schedule:
          cron: '0 12 * * *'
          filters:
            branches:
              only:
                - master
    jobs:
      - relyance

Use the command line found in your source code integration Step 2. If there is already a configuration file, integrate the relevant commands into it:

version: 2.1
jobs:  say-hello:    docker:      - image: cimg/base:stable    steps:      - checkout      - run:          name: "Say hello"          command: "echo Hello, World!"  relyance:    machine:      image: ubuntu-2004:202010-01    steps:      - checkout      - run: docker pull gcr.io/relyance-ext/compliance_inspector:release && docker run --rm -v `pwd`:/repo --env 'API_KEY=example:abcdefg0123456789abcdefg0123456789abcdefg' gcr.io/relyance-ext/compliance_inspector:releaseworkflows:  say-hello-workflow:    jobs:    - say-hello  # Use this workflow to run this job ad-hoc  example_workflow:    jobs:      - relyance   # Use this workflow to run this as a scheduled job  daily-run-workflow:    triggers:      - schedule:          cron: '0 0 * * *'          filters:            branches:              only:                - master    jobs:      - relyance

5. Once complete, click Save and Run.
6. Go to your Dashboard to see your pipeline progress.
7. If there are no errors, you should start to see SCI results in your Relyance tenant.

Appendix:

Source Code Integration Step 2 info:

Example Step 2 Command

1. This command pulls the latest version of the Relyance Source Code Inspector.

2. This command initiates the Relyance Source Code Inspector within a local Docker container, establishing a shared folder and providing the necessary tenant API credentials.

   The Authentication step asks for:

   • API Key: required; held as a secret.

Authentication methods and fields

Pick one of these under Authentication Method on the connection wizard's Authentication step. This table is generated from the integration catalog, so it always matches what the form actually asks for.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "circleci" {
  vendor = "circleci"
  name   = "<your connection name>"

  auth = {
    method = "api-key"
    params = {
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      api_key = var.circleci_api_key
    }
    secrets_wo_version = 1
  }

  scans = { "property-inspection" = { enabled = true } }
}