github.com/jfrog/frogbot/v2@v2.21.0/docs/templates/jfrog-pipelines/pipelines-dotnet.yml (about) 1 resources: 2 - name: cron_trigger 3 type: CronTrigger 4 configuration: 5 interval: "0 * * * *" # Run once per hour 6 7 - name: frogbotGitRepo 8 type: GitRepo 9 configuration: 10 gitProvider: gitIntegration 11 path: "{{.jfrog-pipelines.sourceRepository}}" 12 branches: 13 include: ^{{gitBranch}}$ 14 cloneProtocol: https 15 16 pipelines: 17 - name: Frogbot 18 steps: 19 - name: Frogbot_Scan 20 type: Bash # For Windows runner: PowerShell 21 configuration: 22 integrations: 23 - name: jfrogPlatform 24 - name: gitIntegration 25 inputResources: 26 - name: cron_trigger 27 - name: frogbotGitRepo 28 runtime: 29 type: image 30 image: 31 auto: 32 language: dotnet 33 version: 6 34 environmentVariables: 35 # [Mandatory] 36 # JFrog platform URL 37 JF_URL: $int_jfrogPlatform_url 38 39 # [Mandatory if JF_USER and JF_PASSWORD are not provided] 40 # JFrog access token with 'read' permissions for Xray 41 JF_ACCESS_TOKEN: $int_jfrogPlatform_accessToken 42 43 # [Mandatory for Bitbucket] 44 # Username of the git provider account 45 JF_GIT_USERNAME: "" 46 47 # [Mandatory] 48 # Git provider access token with minimal permissions according to the relevant integration type. 49 # Read more - https://www.jfrog.com/confluence/display/JFROG/Pipelines+Integrations 50 JF_GIT_TOKEN: $int_gitIntegration_token 51 52 # [Mandatory] 53 # Name of your git provider: "bitbucketServer" or "github". 54 JF_GIT_PROVIDER: "" 55 56 # [Mandatory] 57 # API endpoint to your git provider 58 JF_GIT_API_ENDPOINT: $int_gitIntegration_url 59 60 # [Mandatory] 61 # Git provider project owner. 62 JF_GIT_OWNER: "" 63 64 # [Optional] 65 # By default, the Frogbot workflows download the Frogbot executable as well as other tools 66 # needed from https://releases.jfrog.io 67 # If the machine that runs Frogbot has no access to the internet, follow these steps to allow the 68 # executable to be downloaded from an Artifactory instance, which the machine has access to: 69 # 70 # 1. Login to the Artifactory UI, with a user which has admin credentials. 71 # 2. Create a Remote Repository with the following properties set. 72 # Under the 'Basic' tab: 73 # Package Type: Generic 74 # URL: https://releases.jfrog.io 75 # Under the 'Advanced' tab: 76 # Uncheck the 'Store Artifacts Locally' option 77 # 3. Set the value of the 'JF_RELEASES_REPO' variable with the Repository Key you created. 78 # JF_RELEASES_REPO: "" 79 80 # [Optional] 81 # Configure the SMTP server to enable Frogbot to send emails with detected secrets in pull request scans. 82 # SMTP server URL including should the relevant port: (Example: smtp.server.com:8080) 83 # JF_SMTP_SERVER: "" 84 85 # [Mandatory if JF_SMTP_SERVER is set] 86 # The username required for authenticating with the SMTP server. 87 # JF_SMTP_USER: "" 88 89 # [Mandatory if JF_SMTP_SERVER is set] 90 # The password associated with the username required for authentication with the SMTP server. 91 # JF_SMTP_PASSWORD: "" 92 93 # [Optional] 94 # Avoid adding extra info to pull request comments. that isn't related to the scan findings. 95 # JF_AVOID_EXTRA_MESSAGES: "TRUE" 96 97 ########################################################################### 98 ## If your project uses a 'frogbot-config.yml' file, you should define ## 99 ## the following variables inside the file, instead of here. ## 100 ########################################################################### 101 102 # [Mandatory] 103 # Git repository name 104 JF_GIT_REPO: "" 105 106 # [Mandatory] 107 # Repository branch to scan 108 JF_GIT_BASE_BRANCH: $res_frogbotGitRepo_gitRepoSourceDefaultBranch 109 110 # [Mandatory if the two conditions below are met] 111 # 1. The project uses yarn 2, NuGet or .NET Core to download its dependencies 112 # 2. The `installCommand` variable isn't set in your frogbot-config.yml file. 113 # 114 # The command that installs the project dependencies (e.g "nuget restore") 115 # JF_INSTALL_DEPS_CMD: "" 116 117 # [Optional, default: "."] 118 # Relative path to the root of the project in the Git repository 119 # JF_WORKING_DIR: path/to/project/dir 120 121 # [Default: "*.git*;*node_modules*;*target*;*venv*;*test*"] 122 # List of exclusion patterns (utilizing wildcards) for excluding paths in the source code of the Git repository during SCA scans. 123 # JF_PATH_EXCLUSIONS: "*.git*;*node_modules*;*target*;*venv*;*test*" 124 125 # [Optional] 126 # Xray Watches. Learn more about them here: https://www.jfrog.com/confluence/display/JFROG/Configuring+Xray+Watches 127 # JF_WATCHES: <watch-1>,<watch-2>...<watch-n> 128 129 # [Optional] 130 # JFrog project. Learn more about it here: https://www.jfrog.com/confluence/display/JFROG/Projects 131 # JF_PROJECT: <project-key> 132 133 # [Optional, default: "FALSE"] 134 # Displays all existing vulnerabilities, including the ones that were added by the pull request. 135 # JF_INCLUDE_ALL_VULNERABILITIES: "TRUE" 136 137 # [Optional, default: "FALSE"] 138 # When adding new comments on pull requests, keep old comments that were added by previous scans. 139 # JF_AVOID_PREVIOUS_PR_COMMENTS_DELETION: "TRUE" 140 141 # [Optional, default: "TRUE"] 142 # Fails the Frogbot task if any security issue is found. 143 # JF_FAIL: "FALSE" 144 145 # [Optional] 146 # Frogbot will download the project dependencies if they're not cached locally. To download the 147 # dependencies from a virtual repository in Artifactory, set the name of the repository. There's no 148 # need to set this value, if it is set in the frogbot-config.yml file. 149 # JF_DEPS_REPO: "" 150 151 # [Optional] 152 # Template for the branch name generated by Frogbot when creating pull requests with fixes. 153 # The template must include {BRANCH_NAME_HASH}, to ensure that the generated branch name is unique. 154 # The template can optionally include the {IMPACTED_PACKAGE} and {FIX_VERSION} variables. 155 # JF_BRANCH_NAME_TEMPLATE: "'frogbot-{IMPACTED_PACKAGE}-{BRANCH_NAME_HASH}'" 156 157 # [Optional] 158 # Template for the commit message generated by Frogbot when creating pull requests with fixes 159 # The template can optionally include the {IMPACTED_PACKAGE} and {FIX_VERSION} variables. 160 # JF_COMMIT_MESSAGE_TEMPLATE: "'Upgrade {IMPACTED_PACKAGE} to {FIX_VERSION}'" 161 162 # [Optional] 163 # Template for the pull request title generated by Frogbot when creating pull requests with fixes. 164 # The template can optionally include the {IMPACTED_PACKAGE} and {FIX_VERSION} variables. 165 # JF_PULL_REQUEST_TITLE_TEMPLATE: "'[🐸 Frogbot] Upgrade {IMPACTED_PACKAGE} to {FIX_VERSION}'" 166 167 # [Optional, Default: "FALSE"] 168 # If TRUE, Frogbot creates a single pull request with all the fixes. 169 # If FALSE, Frogbot creates a separate pull request for each fix. 170 # JF_GIT_AGGREGATE_FIXES: "FALSE" 171 172 # [Optional, Default: "FALSE"] 173 # Handle vulnerabilities with fix versions only 174 # JF_FIXABLE_ONLY: "TRUE" 175 176 # [Optional] 177 # Set the minimum severity for vulnerabilities that should be fixed and commented on in pull requests 178 # The following values are accepted: Low, Medium, High or Critical 179 # JF_MIN_SEVERITY: "" 180 181 # [Optional, Default: eco-system+frogbot@jfrog.com] 182 # Set the email of the commit author 183 # JF_GIT_EMAIL_AUTHOR: "" 184 185 # [Optional] 186 # List of comma separated email addresses to receive email notifications about secrets 187 # detected during pull request scanning. The notification is also sent to the email set 188 # in the committer git profile regardless of whether this variable is set or not. 189 # JF_EMAIL_RECEIVERS: "" 190 191 # [Optional] 192 # Set the list of allowed licenses 193 # The full list of licenses can be found in: 194 # https://github.com/jfrog/frogbot/blob/master/docs/licenses.md 195 # JF_ALLOWED_LICENSES: "MIT, Apache-2.0" 196 197 # [Optional] 198 # Add a title to pull request comments generated by Frogbot. 199 # JF_PR_COMMENT_TITLE: "" 200 201 execution: 202 onExecute: 203 - cd $res_frogbotGitRepo_resourcePath 204 # For Linux/Mac runner: 205 - | 206 getFrogbotScriptPath=$( [[ -z "$JF_RELEASES_REPO" ]] && echo "https://releases.jfrog.io" || echo "${JF_URL}/artifactory/${JF_RELEASES_REPO}" ) 207 curl -fLg "$getFrogbotScriptPath/artifactory/frogbot/v2/[RELEASE]/getFrogbot.sh" | sh 208 restore_cache_files dotnet_cache ~/.nuget/packages 209 ./frogbot scan-all-pull-requests 210 ./frogbot scan-multiple-repositories 211 add_cache_files dotnet_cache ~/.nuget/packages || true 212 213 # For Windows runner: 214 # - | 215 # if (-not $env:JF_RELEASES_REPO) { 216 # $getFrogbotScriptPath = "https://releases.jfrog.io" 217 # } else { 218 # $getFrogbotScriptPath = "$($env:JF_URL)/artifactory/$($env:JF_RELEASES_REPO)" 219 # } 220 # 221 # $scriptUrl = "$($getFrogbotScriptPath)/artifactory/frogbot/v2/[RELEASE]/getFrogbot.sh" 222 # Invoke-Expression (Invoke-WebRequest -Uri $scriptUrl -UseBasicParsing).Content 223 # restore_cache_files dotnet_cache "%userprofile%\.nuget\packages" 224 # .\frogbot.exe scan-all-pull-requests 225 # .\frogbot.exe scan-multiple-repositories 226 # add_cache_files dotnet_cache "%userprofile%\.nuget\packages" || true