CI Integration Policy
Last updated
Last updated
Before we jump into how to build the policy, let's review the main use-cases that are currently available:
View a scan report - each PR/commit scan creates a new event on the relevant asset with a link to the scan report. The event appears in the events tab in the assets' tab
Be notified on critical findings - the policy includes the Email/Slack action that sends a notification when certain findings match a predefined filter (such as critical findings on a class A asset)
The CI integration policy is composed of few steps. The trigger step and at least one action step are mandatory, however the other steps are optional.
A common CI integration policy will include the following steps:
Trigger - to initiate the policy execution on certain PR’s/commits
Run Scan Action - to scan the PR/commit’s code with built-in scanners
Filter - select which findings are critical and should get immediate attention
Send notification action - send email or Slack to notify when certain critical findings has been discovered. Notice that a notification will be sent only when new findings were discovered (any existing defects will be ignored). When using the Send Email action the policy rule will also notify the committer automatically (as long as the committer has a public email address available).
It is also optional to add a filter step right after the trigger. This is useful when the policy should proceed only with a certain criteria of assets (based on Enso's data), like certain assets class, tags, etc.
The policy starts with a trigger step that defines when to trigger the policy itself. Fields to configure:
Choose Source Control Manager - pick the relevant SCM from the list
Personal Access Token - add a PAT with adequate permissions
Choose Event - select on what type of events the policy should be triggered
Where - define filtering criteria based on SCM related data, such as the commit message, project name, etc.
See the token permissions that are quired per SCM to execute the CI integration policy
Required permissions:
repo
admin:repo_hook
