SCA & SBOM Workflow Configuration Guide

This guide will walk you through the process of setting up workflows for your SCA scans and SBOM generation for your code repositories. It involves four steps which are as follows:

Choosing your Source Code Hosting Provider:

• In this step you need to select the platform on which your code is hosted.
  
  
  
  
• The available options are as follows:
  • Github
  • Bitbucket
  • Azure Repos

Choosing the Repositories:

• In this step you need to select the repositories on which you want to continuously run an SCA scan as well as generate a Software Bill of Materials.
• Depending on the platform you have chosen in the previous step, you will be provided with a dropdown to choose your credentials using which repositories can be accessed.
  
  
  
  
• After selecting the credentials, all the repositories associated with the selected credentials will be listed out and by default all the repositories will be selected.
  
  
  
  
• If you need to create configurations for all the repositories then you can proceed to the next step, otherwise you can unselect the repositories that you do not need to create configurations for and then proceed to the next step.
  
  

Choosing the Target Branch:

• In this step, you will have to enter the target branch on which the configurations will be run. By default, the branch name will be 'default'.
  
  
  
  

Choosing the Frequency:

• In this step you need to select the schedule frequency at which the configurations will be run.
  
  
• There are three available options as follows:
  • Daily
  • Weekly
  • Monthly

The following are the instructions to add Github/Bitbucket Credentials

Configuring Github Credential Manager

In order to grant access to your Github Organization, you will have to create an OAuth app under 'Developer Settings' under 'Settings' from your account.

Usage Flow Instructions

• Navigate to 'Credential Manager' under 'Settings' in the Strobes dashboard. 
  
  
  
  
• Click on 'Add Credential' and select the connector as 'Github'. A 'Redirect URL' will be generated for you.
  
  
  
  
• Now navigate to 'Settings' in your Github account and click on 'Developer Settings'.
• Create a 'New OAuth App'.
• Enter a 'Name', for your 'Homepage URL' enter your Strobes Instance URL. In this case the url is 'https://test-org.strobes.co'
• In the 'Authorization callback URL', enter the 'Redirect URL' which is generated in 'Step 2'.
  
  
  
  
• Click on 'Register application' and a 'Client ID' will be generated for you.
• Click on 'Update application' and now click on 'Generate a new client secret'. A secret will now be generated for you.
  
  
  
  
• Navigate back to Strobes, give a name for your credential configuration, and enter the Client ID and Client Secret which you have generated on Github and click on 'Save'.
  
  
  
  
• Now you will be prompted to login into your Github account.
  
  
  
  
• Login into your account and click on 'Grant' to provide access to your Github organization and click on 'Authorize'.
  
  
  
  
• Your Github credentials have been successfully configured with Strobes.

Configuring Bitbucket Credential Manager

In order to grant access to your Bitbucket workspace you will have to create an 'OAuth consumer' under 'Settings' from the workspace which you have selected.

Usage Flow Instructions

• Navigate to 'Credential Manager' under 'Settings' in the Strobes dashboard. 
  
  
  
  
• Click on 'Add Credential' and select the connector as 'Bitbucket'. A 'Redirect URL' will be generated for you.
  
  
  
  
• Now login into your Bitbucket account and select the workspace which you want to connect with Strobes.
• Click on 'Settings' and click on 'OAuth consumers'.
  
  
  
  
• Click on 'Add Consumer' and you will be prompted to enter the details regarding the consumer.
• Enter the 'Name' and in the 'Callback URL' enter the 'Redirect URL' which is generated in 'Step 2', provide 'Read' access to projects and click on 'Save'.
• A consumer will now be created for you and under that you will find your 'Key' and 'Secret'.
  
  
  
  
• Add they value of 'Key' in the 'Client ID' field and 'Secret' in the 'Client Secret' field on the Strobes platform and click on 'Save'.
• You will now be prompted to grant access to your Bitbucket workspace.
  
  
  
  
• Click on 'Grant access'.
• Your Bitbucket credentials have been successfully configured.