GCP Code Build

Overview

This Code Build step integrates Sec1 to conduct vulnerability scans on your GitHub projects. Sec1 is a powerful tool that helps identify security vulnerabilities within your codebase.

Example Workflow

Below is an example of using the Sec1 Security step in your Code Build pipeline. This will run Sec1 Security scan on each execution of the pipeline.

In your repository, create cloudbuild.yaml. Copy below code in cloudbuild.yaml file to add Sec1 Security.

steps:
  - name: 'gcr.io/cloud-builders/docker'
    entrypoint: 'bash'
    args:
    - '-c'
    - |
      echo "GCP Cloud Build - Sec1 Security ${REPO_FULL_NAME}"
      docker run -v /workspace:/app/gcp-scan-directory -e INPUT_APIKEY=$$SEC1_API_KEY sec1security/sec1-foss-security:v1
    secretEnv: ['SEC1_API_KEY']
availableSecrets:
  secretManager:
  - versionName: projects/$PROJECT_ID/secrets/SEC1_API_KEY/versions/latest
    env: 'SEC1_API_KEY'

Customizing Scan Thresholds

Sec1 scan supports setting up threshold values. If the scan reports vulnerabilities exceeding the specified thresholds, Sec1 Security will mark the build as failed. You can set threshold values for different severities such as critical, high, medium, and low.

steps:
  - name: 'gcr.io/cloud-builders/docker'
    entrypoint: 'bash'
    args:
    - '-c'
    - |
      echo "GCP Cloud Build - Sec1 Security ${REPO_FULL_NAME}"
      docker run -v /workspace:/app/gcp-scan-directory -e INPUT_APIKEY=$$SEC1_API_KEY -e INPUT_SCANTHRESHOLD='critical=0 high=10' sec1security/sec1-foss-security:v1
    secretEnv: ['SEC1_API_KEY']
availableSecrets:
  secretManager:
  - versionName: projects/$PROJECT_ID/secrets/SEC1_API_KEY/versions/latest
    env: 'SEC1_API_KEY'

Obtaining your Sec1 API Key

To use Sec1 in your workflow, you need to obtain an API key. Follow these steps:

1. Navigate to Sec1 Website:

   • Visit Sec1 portal and log in using your GitHub credentials.
2. Generate API Key:

   • In the "Settings" section, locate the "API key" and click on "Generate API key."

3. Copy the API Token:

   • Copy the generated API token.

4. Add API Key to GCP Secret Manager:

   • Add the copied API key to your GCP's secret manager. Refer to Secret Manager documentation for creating secrets.
   • Remember the name of the Secret created in above step. This name will be used against INPUT_APIKEY in docker command.

   • Make sure you give accessor permission to the account which is triggering code build pipeline. Refer to Access control with IAM to give accessor

   📷 Show Preview

   

5. Set API Key Variable in cloudbuild.yaml:

   • In your Cloud Build config file (e.g., cloudbuild.yml), use availableSecrets to access the secret you created:

     availableSecrets:
       secretManager:
       - versionName: projects/$PROJECT_ID/secrets/SEC1_API_KEY/versions/latest
         env: 'SEC1_API_KEY'

Now, your GCP Code Build pipeline is set up to leverage Sec1 for continuous security checks in your projects.