checkpoint/spectral-bots repository overview

⁠Spectral Bots

Spectral empowers users to seamlessly monitor, classify, and safeguard their code, assets, and infrastructure against exposed API keys, tokens, credentials, and high-risk security misconfigurations, all with minimal disruption.
This image facilitates the execution of Spectral bot scanners within a container environment.

The same container can be used to process multiple integrations. For example, you can run a single container with configurations for GitHub and GitLab, as long as the container runs with the correct environment variables configuration.

Spectral bots currently supports only GitHub and GitLab bots.

⁠Configurations

To run the image, you must supply some environment variables. Part of them is global for all spectral bots, and part is for a specific bot. Create and add them from the list below to the .env file.

You can find provider specific environment variables in our documentation for each bot: GitHub bot⁠ and GitLab bot⁠.

⁠Global environment variable

SPECTRAL_DSN=https://spu-12345@SPECTRAL_OPS_DOMAIN # Your Spectral DSN, grab it from SpectralOps->Settings->Organization->DSN
CHECK_POLICY=Fail on any issue
STRICT_MODE=false # If set to `true`, check status is based on all issues found in the modified files (even if the issues are old).
LOG_LEVEL=info # Log level, options: trace, debug, info, warn or error.
SHOULD_SKIP_INGEST=false # If set to `true`, findings won't be sent to SpectralOps and won't be seen in your dashboard.
SPECTRAL_TAGS=base,iac # [Optional] Tags list to run Spectral with, separated by commas (eg base,iac,audit).
SPECTRAL_ENGINES=secrets,iac,oss # [Optional] Engines list to run Spectral with, separated by commas (eg secrets,iac,oss). The default is 'secrets'.

• CHECK_POLICY must be one of: Fail on any issue / Fail on warnings and above / Fail on errors only / Always pass

⁠Usage

We recommend using teller⁠ to inject the environment variables from your variables source (vault).

After you have your .env file set - you can run the container: docker run -p 3000:3000 --env-file .env checkpoint/spectral-bots:<tag-name> start

The endpoints you should put in the provider webhook url are:

• For GitHub app webhook url https://my-container-domain/events/github
• For GitLab webhook url https://my-container-domain/events/gitlab