Run the Spectral GitHub scanner in a container
6.4K
Spectral helps you monitor, classify and protect your code, assets and infrastructure for exposed API keys, tokens, credentials and high-risk security misconfigurations in a simple way, without noise. This image helps you run the Spectral GitHub scanner in a container.
Before you run this image you should follow the instructions in SpectralOps -> Sources -> Spectral GitHub Bot to create the GitHub app.
To run the image you'll need to supply it with some environment variables. Here's an example .env file:
SPECTRAL_DSN=https://spu-12345@SPECTRAL_OPS_DOMAIN # Your Spectral DSN, grab it from SpectralOps->Settings->Organization->DSN
APP_ID=123456 # The GitHub app id
WEBHOOK_SECRET=123 # The webhook secret you set in the GitHub app Webhook section
PRIVATE_KEY=LS0tLS1CR...S0tLQo= # A base 64 encoded string of a private key file you generated and downloaded from the Github app
CHECK_POLICY=Fail on any issue
STRICT_MODE=false # If set to `true`, check status is based on all issues found in the modified files (even if the issues are old)
LOG_LEVEL=info
SHOULD_SKIP_INGEST=false # If set to `true`, findings won't be sent to SpectralOps and won't be seen in your dashboard
HANDLER_TIMEOUT=270 # timeout (in seconds) of the check. If the limit is reached the check will show an internal error. Must be under 300.
SPECTRAL_TAGS=base,iac # [Optional] Tags list to run Spectral with, separated by commas (eg base,iac,audit).
SPECTRAL_ENGINES=secrets,iac,oss # [Optional] Engines list to run Spectral with, separated by commas (eg secrets,iac,oss). Default is 'secrets'
SHOULD_POST_REVIEW_COMMENTS=true # Should a comment be posted in the pull request if issues are found by Spectral
base64 -i github_app_private_key.pemFail on any issue / Fail on warnings and above / Fail on errors only /
Always passWe recommend using teller to inject the environment variables from your variables source (vault).
After you have your .env file set - you can run the container:
docker run -p 8080:8080 --env-file .env checkpoint/spectral-github-scanner
The endpoint that you should put in the GitHub app webhook is https://my-container-domain/events/github
Content type
Image
Digest
sha256:438fd769d…
Size
115.9 MB
Last updated
about 3 years ago
docker pull checkpoint/spectral-github-scanner