Gitlab Bot

1. Make sure the Lambda has these permissions in the AWS account:

   Copy

   lambda:GetAccountSettings
   cloudformation:DescribeStacks
   iam:CreateRole
   iam:DeleteRole
   apigateway:POST
   logs:CreateLogGroup
   iam:PutRolePolicy

2. Launch the stack. See AWS documentation.

3. Generate a private key in the settings of your new GitHub app.

4. Encode the private key in base64 without line breaks. This is an example command in OpenSSL: openssl base64 -A -in your-private-key.pem

5. Enter the private key in the GITHUB_PRIVATE_KEY field.

6. For Check Policy, select one of these:

   • Fail on any issue

   • Fail on critical only

   • Fail on high and above

   • Fail on medium and above

   • Fail on low and above

   • Always pass

Use the Spectral Terraform module to deploy AWS resources. Set the value of the integration_type parameter to github.

Deploy AWS resources using our Terraform module (set the integration_type parameter value to github).

Follow the deployment instructions on our DockerHub repo for the GitHub scanner.

1. Download and unzip the Lambda code:

   1. Download the Lambda code as a .zip file.

   2. Unzip the downloaded file.

2. Add the multi_app.json file to the unzipped directory. Make sure that the frontend and backend lambda functions contain the file in their deployments. This is an example of the multi_app.json file:
   

   Copy

   {
     "github": {
       "<app_id>": {
         "private_key": ""
       }
     }
   }

3. Zip the file and upload it to Lambda:

   1. Select all of the files in the unzipped directory.

   2. Zip the files again.

   3. Upload the new .zip file to AWS Lambda A serverless compute service that lets you run code without provisioning or managing servers, creating workload-aware cluster scaling logic, maintaining event integrations, or managing runtimes..

The github object is a dictionary containing all the GitHub Apps. Do these steps for each app:

1. Set the private_key. This is a bse64-encoded string of the GitHub App's private key.

2. Make sure the <app_id> contains the GitHup App ID to configure a specific application.

3. Optional - Set one or more of these optional parameters:

   • check_failure_policy: Determines the failure policy for scans from this specific GitHub App. The default value of this parameter is defined by the CHECK_POLICY Integration Environment Variable.

   • spectral_dsn: Allows splitting scans using a different DSN for this GitHub App. The default value of this parameter is defined by the SPECTRAL_DSN Integration Environment Variable.

   • webhook_token: Allows the use of a webhook secret for this GitHub App. The default value of this parameter is defined by the GITHUB_WEBHOOK_SECRET Integration Environment Variable.

   • secret_vault: Enables storing secrets (webhook secret, app private key, spectral DSN) in a vault at the app level. When using a vault, you must specify all the keys for the webhook secret, GitHub App private key, and optional spectral DSN.

1. Set the value of the Secrets_VAULT Integration Environment Variable to aws_secrets_manager.

2. Set these secrets in your vault:

   • Spectral_GithubBot_PrivateKey (for GITHUB_PRIVATE_KEY)

   • Spectral_GithubBot_WebhookSecret (for GITHUB_WEBHOOK_SECRET)

   • Spectral_Dsn (for SPECTRAL_DSN)

3. Set these Integration Environment Variables to create custom secret vault keys:

   • VAULT_KEY_SPECTRAL_DSN - Spectral DSN key name.
     Format: Spectral_Dsn-*

   • VAULT_KEY_GITHUB_WEBHOOK_SECRET - GitHub app webhook secret.
     Format: Spectral_GithubBot_WebhookSecret-*

   • VAULT_KEY_GITHUB_PRIVATE_KEY - Private key.
     Format: Spectral_GithubBot_PrivateKey-*

   Note - In a CloudFormation or Terraform deployment, the role that you create for the lambdas gives permission to perform the secretsmanager:GetSecretValue action only for those 3 secrets.

1. Create a blacklist text file that contain a list of full URLs of repositorie to exclude(for example: https://github.com/expressjs/express). Start each URL on a new line.

2. Define these Integration Environment Variables:

   • S3_BLACK_LIST_BUCKET_NAME - the name of the bucket containing the blacklist file.

   • S3_BLACK_LIST_OBJECT_KEY - the object key of the blacklist file