aquasecurity / chain-bench

An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.
Apache License 2.0
712 stars 63 forks source link

Add support for self-hosted SCM #111

Closed hunter closed 1 year ago

hunter commented 1 year ago

Description

This PR adds support for optionally specifying a SCM to support self-hosted environments. The change defaults to github for backwards compatibility but should support Gitlab or GitHub self-hosted/enterprise deployments on a custom domain.

Before

chain-bench scan --repository-url <REPOSITORY_URL> --access-token <TOKEN> -o <OUTPUT_PATH>

After

chain-bench scan --repository-url <REPOSITORY_URL> --access-token <TOKEN> --scm-platform gitlab -o <OUTPUT_PATH>

Without SCM, chain-bench will fallback to Github SaaS - chain-bench scan --repository-url <REPOSITORY_URL> --access-token <TOKEN> -o <OUTPUT_PATH>

Currently only tested on Gitlab but opening the PR early for discussion. The PR also includes a small fix for Gitlab querying protected branches where repo names don't match the escaped path.

Related issues

Checklist

CLAassistant commented 1 year ago

CLA assistant check
All committers have signed the CLA.