Skip to main content

Jfrog Xray scanner reference for STO



You can ingest scan results for your container images from JFrog Xray.

Workflow descriptions​

This workflow applies to scanner integrations that support Ingestion mode.

  1. Add a Build or Security stage to your pipeline.

  2. Add a Run step and set it up to save your scan results to a shared folder.

    For more information, go to Run an ingestion scan in an STO Pipeline.

  3. Add a Custom Scan step.

  4. Review the Important notes for Custom Scan steps for additional requirements and relevant information.

  5. Add the relevant key:value pairs to Settings.

Required settings​

YAML step example 
- step:
    type: Security
    name: custom_scan_xray
    identifier: custom_scan_xray
    spec:
      privileged: true
      settings:
        policy_type: ingestionOnly
        scan_type: containerImage
        product_name: xray
        product_config_name: default
        target_name: YOUR_REPO/YOUR_IMAGE
        target_variant: YOUR_TAG
        ingestion_file: /shared/scan_results/xray2.json

Custom Scan step settings for JFrog XRay​

Scanner settings​

These settings are required.

Product name​

Key​
product_name
Value​
xray

Scan type​

Key​
scan_type
Value​
containerImage

Policy type​

Key​
policy_type
Value​
ingestionOnly

Product config​

Key​
product_config_name
Value​
default

Target and variant​

Every Custom Scan step needs a target and baseline.

Target name​

Key​
target_name
Value​

A user-defined label for the code repository, container, application, or configuration to scan. Specify a unique, descriptive name. This makes it much easier to navigate your scan results in the STO UI.

Target variant​

Key​
target_variant
Value​

A user-defined label for the branch, tag, or other target variant to scan.

Ingestion file​

This setting applies to Custom Scan steps when the policy_type is ingestionOnly.

Key​
ingestion_file
Value​

The path to your scan results when running an Ingestion scan, for example /shared/scan_results/myscan.latest.sarif.

  • The data file must be in a supported format for the scanner.

  • The data file must be accessible to the scan step. It's good practice to save your scan results to a shared path in your stage. In the visual editor, go to the stage where you're running the scan. Then go to Overview > Shared Paths. You can also add the path to the YAML stage definition like this:

        - stage:
          spec:
            sharedPaths:
              - /shared/scan_results

Fail on severity​

If the scan finds any vulnerability with the specified severity level or higher, the pipeline fails automatically. NONE means do not fail on severity.

For more information, go to Stop builds based on scan results.

Key​
fail_on_severity
Value​
CRITICAL
MEDIUM
LOW
INFO
NONE

YAML pipeline example​

The following pipeline example shows a simple ingestion workflow. The Run step downloads a results file to /shared/scan_results/xray2.json. The Custom Scan step then ingests the file.

For information about running scans using XRay, go to the JFrog documentation.


pipeline:
  name: xray_ingest_example
  identifier: xray_ingest_example
  projectIdentifier: default
  orgIdentifier: default
  tags: {}
  properties:
    ci:
      codebase:
        connectorRef: stoplugins
        build: <+input>
  stages:
    - stage:
        name: xray_scan_stage
        identifier: xray_scan_stage
        description: ""
        type: SecurityTests
        spec:
          cloneCodebase: true
          caching:
            enabled: true
            paths: []
          platform:
            os: Linux
            arch: Amd64
          runtime:
            type: Cloud
            spec: {}
          execution:
            steps:
              - step:
                  type: Run
                  name: pull_from_s3
                  identifier: pull_from_s3
                  spec:
                    connectorRef: YOUR_IMAGE_REGISTRY_CONNECTOR_ID
                    image: amazon/aws-cli
                    shell: Sh
                    command: aws s3api get-object --bucket my-xray-scan-results --key YOUR_RESULTS_FILE /shared/scan_results/YOUR_RESULTS_FILE
                    envVariables:
                      AWS_ACCESS_KEY_ID: <+secrets.getValue("YOUR_AWS_ACCESS_KEY")>
                      AWS_SECRET_ACCESS_KEY: <+secrets.getValue("YOUR_SECRET_ACCESS_KEY")>
                      AWS_DEFAULT_REGION: us-east-1
                  when:
                    stageStatus: Success
              - step:
                  type: Security
                  name: custom_scan_xray
                  identifier: custom_scan_xray
                  spec:
                    privileged: true
                    settings:
                      policy_type: ingestionOnly
                      scan_type: containerImage
                      product_name: xray
                      product_config_name: default
                      target_name: YOUR_REPO/YOUR_IMAGE
                      target_variant: YOUR_TAG
                      ingestion_file: /shared/scan_results/YOUR_RESULTS_FILE
          sharedPaths:
            - /shared/scan_results/