GitHub Actions

GitHub Actions is a continuous integration and continuous delivery (CI/CD) platform that allows you to automate your build, test, and deployment pipeline. You can create workflows that build and test every pull request to your repository, or deploy merged pull requests to production.

This how-to will provide a basic understanding of how add the Relyance Source Code inspector (SCI) into a typical build job.

Prerequisites:

1. A source code repository needs to be available.
2. The relyance.yaml file needs to be in the source code root directory.
3. Grab the command line code from Step 2 of the Relyance Source Code Integration settings from your Relyance instance.

See more info about the SCI commands here.

Steps:

1. Login to your GitHub account.

2. Navigate to the main page of the repository.

3. Ensure your source code repository has the preconfigured relyance.yaml file in the root path of your source code.

4. Create a secret in Github:

   1. Click on the Settings tab in the repo header.
   2. Click on Secrets and variables> Actions.
   3. Create a New repository secret.
   4. In your Step 2 command in Relyance, there is a value right after API_KEY (which looks something like example:abcdefghijklmonpqrstuvwxyz0123456789) - copy the whole value as your API_KEY and store it as your new repository secret.

   

   5. Name the secret RELYANCE_API_KEY. This value will be used in your Github action workflow. If you adjust it here, also adjust the workflow.

5. Navigate to the main page of the repository.

6. In the header tabs, click Actions.

7. Click on the set up a workflow yourself link (or create a new workflow under .github/workflows/).

8. Using the template below, update the workflow:

name: Relyance SCI Scan

on:
  #TODO: Modify the cron job schedule below.
  schedule:
    - cron: "0 20 * * *"
  workflow_dispatch:

jobs:
  #TODO: Modify the job names and the machine below if you would like.
  execute-relyance-sci:
    name: Relyance SCI Job
    runs-on: ubuntu-latest
    env:
      API_KEY: ${{ secrets.RELYANCE_API_KEY }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # TODO: Update the docker pull command in the "run" section below. Recommend setting the ACCESS_TOKEN as an environment variable.
      - name: Pull and run SCI binary
        run: |-
          docker pull gcr.io/relyance-ext/compliance_inspector:release && docker run --rm -v `pwd`:/repo --env "API_KEY=$API_KEY" gcr.io/relyance-ext/compliance_inspector:release

The workflow_dispatch command allows you to manually run the SCI scan, this can be removed. 9. Commit changes. 10. This job will now run according to the scheduled CRON job in GitHub actions.

If you wish to run the action manually and have the workflow_dispatch command in the Action file:

1. Go back to the Actions tab after you've committed the file.
2. In the left-side menu click the Relyance SCI Scan link.
3. Click the Run workflow button and run the workflow.
4. Once complete, you should see:
5. If there are no errors, you should start to see SCI results in your Relyance tenant.

Appendix:

Source Code Integration Step 2 info:

Example Step 2 Command

1. This command pulls the latest version of the Relyance Source Code Inspector.
2. This command initiates the Relyance Source Code Inspector within a local Docker container, establishing a shared folder and providing the necessary tenant API credentials.