Skip to main content

Jfrog Xray step configuration



You can ingest scan results for your container images from JFrog Xray.

Workflow descriptions​

This workflow applies to scanner integrations that support Ingestion mode.

  1. Add a Build or Security stage to your pipeline.

  2. Add a Run step and set it up to save your scan results to a shared folder.

    For more information, go to Run an ingestion scan in an STO Pipeline.

  3. Add a Custom Scan step.

  4. Review the Important notes for Custom Scan steps for additional requirements and relevant information.

  5. Add the relevant key:value pairs to Settings.

Required settings​

YAML step example 
- step:
    type: Security
    name: custom_scan_xray
    identifier: custom_scan_xray
    spec:
      privileged: true
      settings:
        policy_type: ingestionOnly
        scan_type: containerImage
        product_name: xray
        product_config_name: default
        target_name: YOUR_REPO/YOUR_IMAGE
        target_variant: YOUR_TAG
        ingestion_file: /shared/scan_results/xray2.json

Custom Scan step settings for JFrog XRay​

Scanner settings​

These settings are required.

Product name​

Key​
product_name
Value​
xray

Scan type​

Key​
scan_type
Value​
containerImage

Policy type​

Key​
policy_type
Value​
ingestionOnly

Product config​

Key​
product_config_name
Value​
default

Target and variant​

Every Custom Scan step needs a target and baseline.

Target name​

Key​
target_name
Value​

A user-defined label for the code repository, container, application, or configuration to scan. Specify a unique, descriptive name. This makes it much easier to navigate your scan results in the STO UI.

Target variant​

Key​
target_variant
Value​

A user-defined label for the branch, tag, or other target variant to scan.

Ingestion file​

This setting applies to Custom Scan steps when the policy_type is ingestionOnly.

Key​
ingestion_file
Value​

The path to your scan results when running an Ingestion scan, for example /shared/scan_results/myscan.latest.sarif.

  • The data file must be in a supported format for the scanner.

  • The data file must be accessible to the scan step. It's good practice to save your scan results to a shared path in your stage. In the visual editor, go to the stage where you're running the scan. Then go to Overview > Shared Paths. You can also add the path to the YAML stage definition like this:

        - stage:
          spec:
            sharedPaths:
              - /shared/scan_results

Fail on severity​

If the scan finds any vulnerability with the specified severity level or higher, the pipeline fails automatically. NONE means do not fail on severity.

For more information, go to:

Key​
fail_on_severity
Value​
CRITICAL
MEDIUM
LOW
INFO
NONE

YAML pipeline example​

The following pipeline example shows a simple ingestion workflow. The Run step downloads a results file to /shared/scan_results/xray2.json. The Custom Scan step then ingests the file.

For information about running scans using XRay, go to the JFrog documentation.


pipeline:
  name: xray_ingest_example
  identifier: xray_ingest_example
  projectIdentifier: default
  orgIdentifier: default
  tags: {}
  properties:
    ci:
      codebase:
        connectorRef: stoplugins
        build: <+input>
  stages:
    - stage:
        name: xray_scan_stage
        identifier: xray_scan_stage
        description: ""
        type: SecurityTests
        spec:
          cloneCodebase: true
          caching:
            enabled: true
            paths: []
          platform:
            os: Linux
            arch: Amd64
          runtime:
            type: Cloud
            spec: {}
          execution:
            steps:
              - step:
                  type: Run
                  name: pull_from_s3
                  identifier: pull_from_s3
                  spec:
                    connectorRef: YOUR_IMAGE_REGISTRY_CONNECTOR_ID
                    image: amazon/aws-cli
                    shell: Sh
                    command: aws s3api get-object --bucket my-xray-scan-results --key YOUR_RESULTS_FILE /shared/scan_results/YOUR_RESULTS_FILE
                    envVariables:
                      AWS_ACCESS_KEY_ID: <+secrets.getValue("YOUR_AWS_ACCESS_KEY")>
                      AWS_SECRET_ACCESS_KEY: <+secrets.getValue("YOUR_SECRET_ACCESS_KEY")>
                      AWS_DEFAULT_REGION: us-east-1
                  when:
                    stageStatus: Success
              - step:
                  type: Security
                  name: custom_scan_xray
                  identifier: custom_scan_xray
                  spec:
                    privileged: true
                    settings:
                      policy_type: ingestionOnly
                      scan_type: containerImage
                      product_name: xray
                      product_config_name: default
                      target_name: YOUR_REPO/YOUR_IMAGE
                      target_variant: YOUR_TAG
                      ingestion_file: /shared/scan_results/YOUR_RESULTS_FILE
          sharedPaths:
            - /shared/scan_results/