Detect vulnerable libraries within your GitHub environments for free
Tags: github, javascript, java, tutorial
Published: 2022-10-21 03:08:27

Combine the power of GitHub Actions for automated Continuous Integration/Continuous Deployment (CI/CD) pipelines with Contrast Security’s powerful free developer tool, CodeSec, to identify vulnerable dependencies in your Java, .NET, NodeJS, Ruby, Python, Go or PHP projects.

The first step is to install CodeSec locally. CodeSec is at the free tier of Contrast Security’s product suite. It is very easy to install with either Homebrew, npm or straight from binary. You can find CodeSec at Contrast’s [Developer Central online portal.](https://www.contrastsecurity.com/developer/codesec/?hsLang=en-us)

Once CodeSec is installed on your machine, you will need to run the command _**contrast config**_. This will give you the CodeSec account keys that you can use in your project’s GitHub Actions configuration file.



![CodeSec config keys](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ixiigozs1q2qwvorlssg.png)

_CodeSec config keys_

Second, you need to set those keys as secrets in your GitHub repository’s settings. This is available in your GitHub project repository on the Settings tab, Security section, Secrets option, Actions sub-option. Add secrets with the names CONTRAST_API_KEY, CONTRAST_ORGANIZATION_ID and CONTRAST_AUTH_HEADER along with their corresponding values from the **_contrast config_** command.



![CodeSec + GitHub](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nk8oq2bxcw4bhzqifl2s.png)

_Add GitHub repository secrets_

With those config keys set as repository secrets, you are now ready to use the [Contrast SCA GitHub Action](https://github.com/marketplace/actions/contrast-security-sca). **Contrast SCA** is an enterprise-level cybersecurity tool that identifies vulnerabilities in the third-party components that your project uses.

The [Contrast SCA GitHub Action page](https://github.com/marketplace/actions/contrast-security-sca) gives examples of GitHub Action configuration files for use with several different languages. In this article we will walk through an example of using the NodeJS config file.

Create a new Git branch in your project with _**git checkout -b your-branch-name.**_




![CodeSec SCA + GitHub](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bjcbm0t6ntg3gjsw6vcd.png)


_Create a new Git branch_

Next, create a new GitHub Actions build file at _**./.github/workflows/build.yml**_, if your project does not have one yet. If it does, you may want to just edit your existing file.



![CodeSec SCA + GitHub](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bu0yq0p0n2mosiax3sq8.png)


_New GitHub Actions build configuration file_

Then, in the **build.yml** file, add the job to run the Contrast SCA action. Use the Node template from the [Contrast SCA GitHub Action page](https://github.com/marketplace/actions/contrast-security-sca). Be sure that it uses the CodeSec config secrets that you made at the beginning of the article! Note: One difference from the template is that we won’t specify the **apiUrl** setting and will let Contrast SCA default to the free Community Edition of the Contrast tool suite server. You will also need to customize the path to your project’s config files and make sure that you target branch “main”, which is the default name of the repository’s primary branch on GitHub.




![CodeSec SCA + GitHub](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/72o0hgs7qdiclci74snj.png)

_Example build.yml for a NodeJS project_

Back on the command line, add the new file to your local Git repository, commit the changes and then push it up to your remote GitHub repository.




![CodeSec SCA + GitHub](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j81a3uc23j9s8c946rse.png)

_Git add, commit and push your new build file_

The output of **git push** gives you a URL to use to create the pull request for your changes. In this example, it was https://github.com/JacobMagesHaskinsContrast/resource-mon/pull/new/add-sca-check.




![CodeSec SCA + GitHub](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/joldobtz9wp34cnbo842.png)

_Pull request on the GitHub repository_

After merging the changes, you can look at the Actions tab and see that “SCA Node” is now an available workflow that runs in your repository.




![CodeSec SCA + GitHub](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5g4gwj4tfqc2f6xzl1h1.png)

_SCA Node workflow in the repository actions_


If your project has a vulnerability, like the deliberate example vulnerability in this project, you can click on the workflow’s run to see its details. In the details, you can find the specific vulnerabilities in libraries that your project uses, along with advice on fixing them.




![CodeSec SCA + GitHub](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/21ufmra49bk1b6v6zx4d.png)

_Contrast SCA GitHub Action results_
 

## **Conclusion**

GitHub Actions are a powerful tool. Much could be written on all the various options available for using them to power your project’s CI/CD pipelines. The Contrast SCA GitHub Action, when paired with CodeSec, is a strong new tool for securing your project from cybersecurity threats.

Test out Contrast SCA’s newest **GitHub Action** feature for yourself with [CodeSec!](https://www.contrastsecurity.com/developer?hsLang=en-us)


**To learn more about Contrast's new GitHub Action:**

**[Click here](https://youtu.be/A5B-_zbxkY8)** for our video tutorial.
**[Click here](https://github.com/marketplace/actions/contrast-security-sca)** to check us out on GitHub Marketplace.